diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 89eeea7716..72efa7e858 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -6,11 +6,6 @@ "redirect_document_id": true }, { -"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np", -"redirect_document_id": true -}, -{ "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md", "redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", "redirect_document_id": true @@ -631,11 +626,21 @@ "redirect_document_id": true }, { -"source_path": "windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity", +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/oldtoc.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-rules-in-windows-10-enterprise-e3.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-rules-in-windows-10-enterprise-e3", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md", +"redirect_url": "windows/security/threat-protection/microsoft-defender-atp/manage-indicators", +"redirect_document_id": false +}, +{ "source_path": "windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", "redirect_url": "/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control", "redirect_document_id": true @@ -726,96 +731,196 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", +"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/controlled-folders", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/emet-exploit-protection", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/enable-attack-surface-reduction", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/evaluate-attack-surface-reduction", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/evaluate-controlled-folder-access", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-network-protection", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp", +"redirect_document_id": false +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/event-views", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/graphics.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/graphics", "redirect_document_id": true @@ -826,11 +931,21 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/network-protection", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/prerelease.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/prerelease", "redirect_document_id": true @@ -841,13 +956,18 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md", "redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations", "redirect_document_id": true }, { -"source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np", +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations", "redirect_document_id": true }, { @@ -856,6 +976,11 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", +"redirect_document_id": false +}, +{ "source_path": "windows/keep-secure/advanced-features-windows-defender-advanced-threat-protection.md", "redirect_url": "/windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection", "redirect_document_id": true @@ -1006,11 +1131,6 @@ "redirect_document_id": true }, { -"source_path": "windows/security/threat-protection/windows-defender-atp/view-incidents-queue.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue", -"redirect_document_id": true -}, -{ "source_path": "windows/security/threat-protection/windows-defender-atp/configuration-score.md", "redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/configuration-score", "redirect_document_id": true @@ -1221,6 +1341,11 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/microsoft-defender-atp/enable-custom-ti.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", +"redirect_document_id": false +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md", "redirect_url": "/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection", "redirect_document_id": true @@ -1611,12 +1736,22 @@ "redirect_document_id": true }, { +"source_path": "windows/keep-secure/preferences-setup-windows-defender-advanced-threat-protection.md", +"redirect_url": "/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md", "redirect_url": "/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/use-apis", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/use-apis.md", "redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/preferences-setup", "redirect_document_id": true }, @@ -1696,6 +1831,16 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/microsoft-defender-atp/response-actions.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts", +"redirect_document_id": false +}, +{ +"source_path": "windows/keep-secure/response-actions-windows-defender-advanced-threat-protection.md", +"redirect_url": "/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md", "redirect_url": "/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", "redirect_document_id": true @@ -1811,11 +1956,6 @@ "redirect_document_id": true }, { -"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp", -"redirect_document_id": true -}, -{ "source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-overview.md", "redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview", "redirect_document_id": true @@ -3076,11 +3216,6 @@ "redirect_document_id": true }, { -"source_path": "windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md", -"redirect_url": "/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security", -"redirect_document_id": true -}, -{ "source_path": "windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md", "redirect_url": "/windows/security/threat-protection/device-guard/deploy-managed-installer-for-device-guard", "redirect_document_id": true @@ -3121,6 +3256,16 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md", +"redirect_url": "/windows/security/threat-protection/device-guard/memory-integrity", +"redirect_document_id": true +}, +{ "source_path": "windows/device-security/device-guard/steps-to-deploy-windows-defender-application-control.md", "redirect_url": "/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", "redirect_document_id": true @@ -4411,6 +4556,11 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md", +"redirect_url": "/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity", +"redirect_document_id": true +}, +{ "source_path": "windows/device-security/get-support-for-security-baselines.md", "redirect_url": "/windows/security/threat-protection/get-support-for-security-baselines", "redirect_document_id": true @@ -9631,6 +9781,11 @@ "redirect_document_id": true }, { +"source_path": "windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md", +"redirect_url": "/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security", +"redirect_document_id": true +}, +{ "source_path": "windows/keep-secure/deploy-manage-report-windows-defender-antivirus.md", "redirect_url": "/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", "redirect_document_id": true @@ -12036,11 +12191,6 @@ "redirect_document_id": true }, { -"source_path": "windows/keep-secure/preferences-setup-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ "source_path": "windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md", "redirect_url": "/windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies", "redirect_document_id": true @@ -12161,11 +12311,6 @@ "redirect_document_id": true }, { -"source_path": "windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity", -"redirect_document_id": true -}, -{ "source_path": "windows/keep-secure/requirements-for-deploying-applocker-policies.md", "redirect_url": "/windows/device-security/applocker/requirements-for-deploying-applocker-policies", "redirect_document_id": true @@ -12191,11 +12336,6 @@ "redirect_document_id": true }, { -"source_path": "windows/keep-secure/response-actions-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ "source_path": "windows/keep-secure/restore-files-and-directories.md", "redirect_url": "/windows/device-security/security-policy-settings/restore-files-and-directories", "redirect_document_id": true @@ -14446,11 +14586,6 @@ "redirect_document_id": true }, { -"source_path":"windows/security/threat-protection/windows-defender-atp/use-apis.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/use-apis", -"redirect_document_id": false -}, -{ "source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md", "redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp", "redirect_document_id": false @@ -14658,7 +14793,7 @@ { "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md", "redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md", @@ -14668,7 +14803,7 @@ { "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md", "redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines", -"redirect_document_id": true +"redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md", @@ -14796,6 +14931,11 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/microsoft-defender-atp/get-started.md", +"redirect_url": "/windows/security/threat-protection/index.md", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md", "redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false @@ -14861,9 +15001,9 @@ "redirect_document_id": true }, { -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-ms-flow.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-ms-flow", -"redirect_document_id": true + "source_path": "windows/security/threat-protection/windows-defender-atp/api-microsoft-flow.md", + "redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/api-microsoft-flow", + "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-app-token.md", @@ -14871,8 +15011,8 @@ "redirect_document_id": true }, { -"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-user-token", +"source_path": "windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-app-token.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/api-power-bi", "redirect_document_id": true }, { @@ -14956,11 +15096,6 @@ "redirect_document_id": true }, { -"source_path": "windows/security/threat-protection/windows-defender-atp/incidents-queue.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/incidents-queue", -"redirect_document_id": true -}, -{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-ti-indicator-by-id-windows-defender-advanced-threat-protection.md", "redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false @@ -15011,6 +15146,21 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-alerts", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp/is-ip-seen-org.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp/exposed-apis-list", +"redirect_document_id": false +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md", "redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/machineaction", "redirect_document_id": true @@ -15041,6 +15191,31 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/incidents-queue.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/incidents-queue", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/incidents-queue.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp", +"redirect_document_id": true +}, +{ +"source_path":"windows/security/threat-protection/windows-defender-atp/use-apis.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/use-apis", +"redirect_document_id": false +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/user-alert-windows-defender-advanced-threat-protection-new.md", "redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/user", "source_path": "windows/deployment/planning/windows-10-fall-creators-deprecation.md", @@ -15063,18 +15238,23 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", +"redirect_document_id": false +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators-windows-defender-advanced-threat-protection.md", "redirect_url": "/windows/security/threat-protection/windows-defender-atp/manage-indicators", "redirect_document_id": true }, { -"source_path": "windows/deployment/windows-10-enterprise-subscription-activation.md", -"redirect_url": "/windows/deployment/windows-10-subscription-activation", -"redirect_document_id": true +"source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators.md", +"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list", +"redirect_document_id": false }, { -"source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators.md", -"redirect_url": "/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", +"source_path": "windows/deployment/windows-10-enterprise-subscription-activation.md", +"redirect_url": "/windows/deployment/windows-10-subscription-activation", "redirect_document_id": true }, { @@ -15161,6 +15341,13 @@ "source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md", "redirect_url": "/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11", "redirect_document_id": true +}, +{ +"source_path": "devices/surface/surface.yml", +"redirect_url": "/surface/get-started", +"redirect_document_id": true } ] } + + diff --git a/browsers/edge/about-microsoft-edge.md b/browsers/edge/about-microsoft-edge.md index c9801bd936..1b86c5d81f 100644 --- a/browsers/edge/about-microsoft-edge.md +++ b/browsers/edge/about-microsoft-edge.md @@ -45,7 +45,7 @@ Some of the components might also need additional system resources. Check the co ## Supported languages -Microsoft Edge supports all of the same languages as Windows 10 and you can use the [Microsoft Translator extension](https://www.microsoft.com/en-us/p/translator-for-microsoft-edge/9nblggh4n4n3) to translate foreign language web pages and text selections for 60+ languages. +Microsoft Edge supports all of the same languages as Windows 10 and you can use the [Microsoft Translator extension](https://www.microsoft.com/p/translator-for-microsoft-edge/9nblggh4n4n3) to translate foreign language web pages and text selections for 60+ languages. If the extension does not work after install, restart Microsoft Edge. If the extension still does not work, provide feedback through the Feedback Hub. diff --git a/browsers/edge/docfx.json b/browsers/edge/docfx.json index 5944d644ce..730c9d7ac2 100644 --- a/browsers/edge/docfx.json +++ b/browsers/edge/docfx.json @@ -7,7 +7,9 @@ "**/*.yml" ], "exclude": [ - "**/obj/**" + "**/obj/**", + "**/includes/**", + "**/shortdesc/**" ] } ], @@ -28,7 +30,10 @@ "breadcrumb_path": "/microsoft-edge/deploy/breadcrumb/toc.json", "ROBOTS": "INDEX, FOLLOW", "ms.technology": "microsoft-edge", + "audience": "ITPro", "ms.topic": "article", + "manager": "laurawi", + "ms.prod": "edge", "feedback_system": "GitHub", "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", diff --git a/browsers/edge/emie-to-improve-compatibility.md b/browsers/edge/emie-to-improve-compatibility.md index bddff62c1d..e9ec39db3f 100644 --- a/browsers/edge/emie-to-improve-compatibility.md +++ b/browsers/edge/emie-to-improve-compatibility.md @@ -41,11 +41,11 @@ If you're having trouble deciding whether Microsoft Edge is right for your organ |Microsoft Edge |IE11 | |---------|---------| -|Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana. |IE11 offers enterprises additional security, manageability, performance, backward compatibility, and modern standards support. | +|Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana. |IE11 offers enterprises additional security, manageability, performance, backward compatibility, and modern standards support. | ## Configure the Enterprise Mode Site List -[Available policy options](includes/configure-enterprise-mode-site-list-include.md) +[!INCLUDE [Available policy options](includes/configure-enterprise-mode-site-list-include.md)] ## Related topics diff --git a/browsers/edge/img-microsoft-edge-infographic-lg.md b/browsers/edge/img-microsoft-edge-infographic-lg.md index 2a2ca7e399..722efc8aa2 100644 --- a/browsers/edge/img-microsoft-edge-infographic-lg.md +++ b/browsers/edge/img-microsoft-edge-infographic-lg.md @@ -9,7 +9,7 @@ author: eavena --- Return to: [Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md)
-Download image: [Total Economic Impact of Microsoft Edge: Infographic](https://www.microsoft.com/en-us/download/details.aspx?id=53892) +Download image: [Total Economic Impact of Microsoft Edge: Infographic](https://www.microsoft.com/download/details.aspx?id=53892) ![Full-sized Microsoft Edge infographic](images/img-microsoft-edge-infographic-lg.png) diff --git a/browsers/edge/includes/allow-adobe-flash-include.md b/browsers/edge/includes/allow-adobe-flash-include.md index d22ca7fe3b..3a7671c32a 100644 --- a/browsers/edge/includes/allow-adobe-flash-include.md +++ b/browsers/edge/includes/allow-adobe-flash-include.md @@ -1,45 +1,46 @@ ---- -author: eavena -ms.author: eravena -ms.date: 10/02/2018 -ms.reviewer: -audience: itpro manager: dansimp -ms.prod: edge -ms.topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Enabled or not configured (Allowed)* - -[!INCLUDE [allow-adobe-flash-shortdesc](../shortdesc/allow-adobe-flash-shortdesc.md)] - -### Supported values - -| Group Policy | MDM | Registry | Description | -|-----------------------|:---:|:--------:|-------------| -| Disabled | 0 | 0 | Prevented | -| Enabled **(default)** | 1 | 1 | Allowed | - ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow Adobe Flash -- **GP name:** AllowFlash -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowFlash](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser\#browser-allowflash) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowAdobeFlash -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Addons -- **Value name:** FlashPlayerEnabled -- **Value type:** REG_DWORD - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Enabled or not configured (Allowed)* + +[!INCLUDE [allow-adobe-flash-shortdesc](../shortdesc/allow-adobe-flash-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | +|-----------------------|:---:|:--------:|-------------| +| Disabled | 0 | 0 | Prevented | +| Enabled **(default)** | 1 | 1 | Allowed | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow Adobe Flash +- **GP name:** AllowFlash +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowFlash](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser\#browser-allowflash) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowFlash +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Addons +- **Value name:** FlashPlayerEnabled +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/configure-enterprise-mode-site-list-include.md b/browsers/edge/includes/configure-enterprise-mode-site-list-include.md index 66ad97e9f7..0c02984f58 100644 --- a/browsers/edge/includes/configure-enterprise-mode-site-list-include.md +++ b/browsers/edge/includes/configure-enterprise-mode-site-list-include.md @@ -38,8 +38,9 @@ ### Related Policies -[Show message opening sites in IE](../available-policies.md#show-message-when-opening-sites-in-internet-explorer): [!INCLUDE -[show-message-when-opening-sites-in-ie-shortdesc](../shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] +[Show message opening sites in IE](../available-policies.md#show-message-when-opening-sites-in-internet-explorer) + +[!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](../shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] ### Related topics diff --git a/browsers/edge/microsoft-edge-forrester.md b/browsers/edge/microsoft-edge-forrester.md index 2407ccef53..b4035d8b3e 100644 --- a/browsers/edge/microsoft-edge-forrester.md +++ b/browsers/edge/microsoft-edge-forrester.md @@ -16,7 +16,7 @@ Forrester Research measures the return on investment (ROI) of Microsoft Edge in ## Forrester report video summary View a brief overview of the Forrester TEI case study that Microsoft commissioned to examine the value your organization can achieve by utilizing Microsoft Edge: -> ![VIDEO ] +> ![VIDEO ] ## Forrester Study report diff --git a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md index 5150d172c9..9781a1de92 100644 --- a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md +++ b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md @@ -1,265 +1,266 @@ ---- -title: Deploy Microsoft Edge kiosk mode -description: Microsoft Edge kiosk mode works with assigned access to allow IT admins to create a tailored browsing experience designed for kiosk devices. To use Microsoft Edge kiosk mode, you must configure Microsoft Edge as an application in assigned access. -ms.assetid: -ms.reviewer: -audience: itpro manager: dansimp -author: eavena -ms.author: eravena -ms.prod: edge -ms.sitesec: library -ms.topic: get-started-article -ms.localizationpriority: medium -ms.date: 10/29/2018 ---- - -# Deploy Microsoft Edge kiosk mode - ->Applies to: Microsoft Edge on Windows 10, version 1809 ->Professional, Enterprise, and Education - -In the Windows 10 October 2018 Update, we added the capability to use Microsoft Edge as a kiosk using assigned access. With assigned access, you create a tailored browsing experience locking down a Windows 10 device to only run as a single-app or multi-app kiosk. Assigned access restricts a local standard user account so that it only has access to one or more Windows app, such as Microsoft Edge in kiosk mode. - -In this topic, you learn how to configure the behavior of Microsoft Edge when it's running in kiosk mode with assigned access. You also learn how to set up your kiosk device using either Windows Setting or Microsoft Intune or other MDM service. - -At the end of this topic, you can find a list of [supported policies](#supported-policies-for-kiosk-mode) for kiosk mode and a [feature comparison](#feature-comparison-of-kiosk-mode-and-kiosk-browser-app) of the kiosk mode policy and kiosk browser app. You also find instructions on how to provide us feedback or get support. - - -## Kiosk mode configuration types - ->**Policy** = Configure kiosk mode (ConfigureKioskMode) - -Microsoft Edge kiosk mode supports four configurations types that depend on how Microsoft Edge is set up with assigned access, either as a single-app or multi-app kiosk. These configuration types help you determine what is best suited for your kiosk device or scenario. - -- Learn about [creating a kiosk experience](https://docs.microsoft.com/windows-hardware/customize/enterprise/create-a-kiosk-image) - - - [Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage) - - - [Create a Windows 10 kiosk that runs multiple apps](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps). - -- Learn about configuring a more secure kiosk experience: [Other settings to lock down](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage#other-settings-to-lock-down). - - -### Important things to remember before getting started - -- The public browsing kiosk types run Microsoft Edge InPrivate mode to protect user data with a browsing experience designed for public kiosks. - -- Microsoft Edge kiosk mode has a built-in timer to help keep data safe in public browsing sessions. When the idle time (no user activity) meets the time limit, a confirmation message prompts the user to continue, and if no user activity Microsoft Edge resets the session to the default URL. By default, the idle timer is 5 minutes, but you can choose a value of your own. - -- Optionally, you can define a single URL for the Home button, Start page, and New Tab page. See [Supported policies for kiosk mode](#supported-policies-for-kiosk-mode) to learn more. - -- No matter which configuration type you choose, you must set up Microsoft Edge in assigned access; otherwise, Microsoft Edge ignores the settings in this policy (Configure kiosk mode/ConfigureKioskMode).

Learn more about assigned access: - - - [Configure kiosk and shared devices running Windows desktop editions](https://aka.ms/E489vw). - - - [Kiosk apps for assigned access best practices](https://aka.ms/H1s8y4). - - - [Guidelines for choosing an app for assigned access (kiosk mode)](https://aka.ms/Ul7dw3). - - -### Supported configuration types - -[!INCLUDE [configure-kiosk-mode-supported-values-include](includes/configure-kiosk-mode-supported-values-include.md)] - -## Set up Microsoft Edge kiosk mode - -Now that you're familiar with the different kiosk mode configurations and have the one you want to use in mind, you can use one of the following methods to set up Microsoft Edge kiosk mode: - -- **Windows Settings.** Use only to set up a couple of single-app devices because you perform these steps physically on each device. For a multi-app kiosk device, use Microsoft Intune or other MDM service. - -- **Microsoft Intune or other MDM service.** Use to set up several single-app or multi-app kiosk devices. Microsoft Intune and other MDM service providers offer more options for customizing the Microsoft Edge kiosk mode experience using any of the [Supported policies for kiosk mode](#supported-policies-for-kiosk-mode). - - -### Prerequisites - -- Microsoft Edge on Windows 10, version 1809 (Professional, Enterprise, and Education). - -- URL to load when the kiosk launches. The URL that you provide sets the Home button, Start page, and New Tab page. - -- _**For Microsoft Intune or other MDM service**_, you must have the AppUserModelID (AUMID) to set up Microsoft Edge: - - ``` - Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge - ``` - - -### Use Windows Settings - -Windows Settings is the simplest and the only way to set up one or a couple of single-app devices. - - -1. On the kiosk device, open Windows Settings, and in the search field type **kiosk** and then select **Set up a kiosk (assigned access)**. - -2. On the **Set up a kiosk** page, click **Get started**. - -3. Type a name to create a new kiosk account, or choose an existing account from the populated list and click **Next**. - -4. On the **Choose a kiosk app** page, select **Microsoft Edge** and then click **Next**. - -5. Select how Microsoft Edge displays when running in kiosk mode: - - - **As a digital sign or interactive display** - Displays a specific site in full-screen mode, running Microsoft Edge InPrivate protecting user data. - - - **As a public browser** - Runs a limited multi-tab version of Microsoft Edge, protecting user data. - -6. Select **Next**. - -7. Type the URL to load when the kiosk launches. - -8. Accept the default value of **5 minutes** for the idle time or provide a value of your own. - -9. Click **Next**. - -10. Close the **Settings** window to save and apply your choices. - -11. Restart the kiosk device and sign in with the local kiosk account to validate the configuration. - -**_Congratulations!_**

You’ve just finished setting up a single-app kiosk device using Windows Settings. - -**_What's next?_** - -- User your new kiosk device.

- OR

-- Make changes to your kiosk device. In Windows Settings, on the **Set up a kiosk** page, make your changes to **Choose a kiosk mode** and **Set up Microsoft Edge**. - ---- - - -### Use Microsoft Intune or other MDM service - -With this method, you can use Microsoft Intune or other MDM services to configure Microsoft Edge kiosk mode in assigned access and how it behaves on a kiosk device. To learn about a few app fundamentals and requirements before adding them to Intune, see [Add apps to Microsoft Intune](https://docs.microsoft.com/intune/apps-add). - ->[!IMPORTANT] ->If you are using a local account as a kiosk account in Microsoft Intune, make sure to sign into this account and then sign out before configuring the kiosk device. - -1. In Microsoft Intune or other MDM service, configure [AssignedAccess](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to prevent users from accessing the file system, running executables, or other apps. - -2. Configure the following MDM settings to setup Microsoft Edge kiosk mode on the kiosk device and then restart the device. - - | | | - |---|---| - | **[ConfigureKioskMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode)**

![](images/icon-thin-line-computer.png) | Configure the display mode for Microsoft Edge as a kiosk app.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskMode

**Data type:** Integer

**Allowed values:**

| - | **[ConfigureKioskResetAfterIdleTimeout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout)**

![](images/icon-thin-line-computer.png) | Change the time in minutes from the last user activity before Microsoft Edge kiosk mode resets the user's session.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskResetAfterIdleTimeout

**Data type:** Integer

**Allowed values:**

| - | **[HomePages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-homepages)**

![](images/icon-thin-line-computer.png) | Set one or more start pages, URLs, to load when Microsoft Edge launches.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/HomePages

**Data type:** String

**Allowed values:**

Enter one or more URLs, for example,
   \\ | - | **[ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton)**

![](images/icon-thin-line-computer.png) | Configure how the Home Button behaves.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton

**Data type:** Integer

**Allowed values:**

| - | **[SetHomeButtonURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl)**

![](images/icon-thin-line-computer.png) | If you set ConfigureHomeButton to 2, configure the home button URL.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetHomeButtonURL

**Data type:** String

**Allowed values:** Enter a URL, for example, https://www.bing.com | - | **[SetNewTabPageURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl)**

![](images/icon-thin-line-computer.png) | Set a custom URL for the New Tab page.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetNewTabPageURL

**Data type:** String

**Allowed values:** Enter a URL, for example, https://www.msn.com | - - -**_Congratulations!_**

You’ve just finished setting up a kiosk or digital signage with policies for Microsoft Edge kiosk mode using Microsoft Intune or other MDM service. - -**_What's next?_**

Now it's time to use your new kiosk device. Sign into the device with the kiosk account selected to run Microsoft Edge kiosk mode. - ---- - - -## Supported policies for kiosk mode - -Use any of the Microsoft Edge policies listed below to enhance the kiosk experience depending on the Microsoft Edge kiosk mode type you configure. To learn more about these policies, see [Policy CSP - Browser](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser). - -Make sure to check with your provider for instructions. - -| **MDM Setting** | **Digital /
Interactive signage** | **Public browsing
single-app** | **Public browsing
multi-app** | **Normal
mode** | -|------------------|:---------:|:---------:|:---------:|:---------:| -| [AllowAddressBarDropdown](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowaddressbardropdown) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowAutofill](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowautofill) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowBrowser](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowbrowser) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | -| [AllowConfigurationUpdateForBooksLibrary](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowconfigurationupdateforbookslibrary) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowCookies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowcookies) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [AllowDeveloperTools](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowdevelopertools) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowDoNotTrack](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowdonottrack) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [AllowExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowextensions) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowFlash](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowflash) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [AllowFlashClickToRun](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowflashclicktorun) | ![Supported](images/148767.png)2 | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [AllowFullscreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowfullscreenmode)\* | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [AllowInPrivate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowinprivate) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowMicrosoftCompatibilityList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowmicrosoftcompatibilitylist) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png)1 | ![Supported](images/148767.png) | -| [AllowPasswordManager](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowpasswordmanager) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowPopups](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowpopups) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [AllowPrelaunch](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowprelaunch)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowPrinting](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowprinting)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [AllowSavingHistory](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsavinghistory)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowSearchEngineCustomization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsearchenginecustomization) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowSearchSuggestionsinAddressBar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsearchenginecustomization) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [AllowSideloadingExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsideloadingofextensions)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [AllowSyncMySettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowsyncmysettings) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowTabPreloading](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowWebContentOnNewTabPage](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowwebcontentonnewtabpage)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AlwaysEnabledBooksLibrary](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [ClearBrowsingDataOnExit](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-clearbrowsingdataonexit) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [ConfigureAdditionalSearchEngines](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configureadditionalsearchengines) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [ConfigureFavoritesBar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurefavoritesbar)\* | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -|  [ConfigureKioskMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -|  [ConfigureKioskResetAfterIdleTimeout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout)\* | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | -| [ConfigureOpenEdgeWith](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [ConfigureTelemetryForMicrosoft365Analytics](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configuretelemetryformicrosoft365analytics)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [DisableLockdownOfStartPages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-disablelockdownofstartpages) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [Experience/DoNotSyncBrowserSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-donotsyncbrowsersetting)\* and [Experience/PreventTurningOffRequiredExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventturningoffrequiredextensions)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [EnableExtendedBooksTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enableextendedbookstelemetry) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png)1 | ![Supported](images/148767.png) | -| [FirstRunURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-firstrunurl) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | -| [HomePages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-homepages) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [LockdownFavorites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-lockdownfavorites) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [PreventAccessToAboutFlagsInMicrosoftEdge](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventaccesstoaboutflagsinmicrosoftedge) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [PreventCertErrorOverrides](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [PreventFirstRunPage](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventfirstrunpage) | ![Supported](images/148767.png) | ![Supported](images/148767.png)| ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [PreventLiveTileDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventlivetiledatacollection) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [PreventSmartScreenPromptOverride](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventsmartscreenpromptoverride) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [PreventSmartScreenPromptOverrideForFiles](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventsmartscreenpromptoverrideforfiles) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [PreventTurningOffRequiredExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventturningoffrequiredextensions)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [PreventUsingLocalHostIPAddressForWebRTC](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventusinglocalhostipaddressforwebrtc) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [ProvisionFavorites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [SendIntranetTraffictoInternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sendintranettraffictointernetexplorer) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png)1 | ![Supported](images/148767.png) | -| [SetDefaultSearchEngine](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-setdefaultsearchengine) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [SetHomeButtonURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl)\* | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [SetNewTabPageURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl)\* | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| [ShowMessageWhenOpeningInteretExplorerSites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-showmessagewhenopeningsitesininternetexplorer) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png)1 | ![Supported](images/148767.png) | -| [SyncFavoritesBetweenIEAndMicrosoftEdge](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-syncfavoritesbetweenieandmicrosoftedge) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png)1 | ![Supported](images/148767.png) | -| [UnlockHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [UseSharedFolderForBooks](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-usesharedfolderforbooks) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | - - -*\* New policy as of Windows 10, version 1809.*

-*1) For multi-app assigned access, you must configure Internet Explorer 11.*
-*2) For digital/interactive signage to enable Flash, set [AllowFlashClickToRun](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowflashclicktorun) to 0.* - -**Legend:**

-       ![Not supported](images/148766.png) = Not applicable or not supported
-       ![Supported](images/148767.png) = Supported - ---- - -## Feature comparison of kiosk mode and kiosk browser app -In the following table, we show you the features available in both Microsoft Edge kiosk mode and Kiosk Browser app available in Microsoft Store. Both kiosk mode and kiosk browser app work in assigned access. - - -| **Feature** | **Microsoft Edge kiosk mode** | **Microsoft Kiosk browser app** | -|-----------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------:|:-------------------------------------------------------------------------------------------------------------------------------------------------------:| -| Print support | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | -| Multi-tab support | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | -| Allow/Block URL support | ![Supported](images/148767.png)

*\*For Microsoft Edge kiosk mode use* Windows Defender Firewall. Microsoft kiosk browser has custom policy support. | ![Supported](images/148767.png) | -| Configure Home Button | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| Set Start page(s) URL | ![Supported](images/148767.png) | ![Supported](images/148767.png)

*Same as Home button URL* | -| Set New Tab page URL | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | -| Favorites management | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | -| End session button | ![Supported](images/148767.png) | ![Supported](images/148767.png)

*In Microsoft Intune, you must create a custom URI to enable. Dedicated UI configuration introduced in version 1808.* | -| Reset on inactivity | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| Internet Explorer integration (Enterprise Mode site list) | ![Supported](images/148767.png)

*Multi-app mode only* | ![Not supported](images/148766.png) | -| Available in Microsoft Store | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| SKU availability | Windows 10 October 2018 Update
Professional, Enterprise, and Education | Windows 10 April 2018 Update
Professional, Enterprise, and Education | - -**\*Windows Defender Firewall**

-To prevent access to unwanted websites on your kiosk device, use Windows Defender Firewall to configure a list of allowed websites, blocked websites or both. For more details, see [Windows Defender Firewall with Advanced Security Deployment](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide). - ---- - -## Provide feedback or get support - -To provide feedback on Microsoft Edge kiosk mode in Feedback Hub, select **Microsoft Edge** as the **Category**, and **All other issues** as the subcategory. - -**_For multi-app kiosk only._** If you have set up the Feedback Hub in assigned access, you can you submit the feedback from the device running Microsoft Edge in kiosk mode in which you can include diagnostic logs. In the Feedback Hub, select **Microsoft Edge** as the **Category**, and **All other issues** as the subcategory. - - - +--- +title: Deploy Microsoft Edge kiosk mode +description: Microsoft Edge kiosk mode works with assigned access to allow IT admins to create a tailored browsing experience designed for kiosk devices. To use Microsoft Edge kiosk mode, you must configure Microsoft Edge as an application in assigned access. +ms.assetid: +ms.reviewer: +audience: itpro +manager: dansimp +author: eavena +ms.author: eravena +ms.prod: edge +ms.sitesec: library +ms.topic: article +ms.localizationpriority: medium +ms.date: 10/29/2018 +--- + +# Deploy Microsoft Edge kiosk mode + +>Applies to: Microsoft Edge on Windows 10, version 1809 +>Professional, Enterprise, and Education + +In the Windows 10 October 2018 Update, we added the capability to use Microsoft Edge as a kiosk using assigned access. With assigned access, you create a tailored browsing experience locking down a Windows 10 device to only run as a single-app or multi-app kiosk. Assigned access restricts a local standard user account so that it only has access to one or more Windows app, such as Microsoft Edge in kiosk mode. + +In this topic, you learn how to configure the behavior of Microsoft Edge when it's running in kiosk mode with assigned access. You also learn how to set up your kiosk device using either Windows Setting or Microsoft Intune or other MDM service. + +At the end of this topic, you can find a list of [supported policies](#supported-policies-for-kiosk-mode) for kiosk mode and a [feature comparison](#feature-comparison-of-kiosk-mode-and-kiosk-browser-app) of the kiosk mode policy and kiosk browser app. You also find instructions on how to provide us feedback or get support. + + +## Kiosk mode configuration types + +>**Policy** = Configure kiosk mode (ConfigureKioskMode) + +Microsoft Edge kiosk mode supports four configurations types that depend on how Microsoft Edge is set up with assigned access, either as a single-app or multi-app kiosk. These configuration types help you determine what is best suited for your kiosk device or scenario. + +- Learn about [creating a kiosk experience](https://docs.microsoft.com/windows-hardware/customize/enterprise/create-a-kiosk-image) + + - [Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage) + + - [Create a Windows 10 kiosk that runs multiple apps](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps). + +- Learn about configuring a more secure kiosk experience: [Other settings to lock down](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage#other-settings-to-lock-down). + + +### Important things to remember before getting started + +- The public browsing kiosk types run Microsoft Edge InPrivate mode to protect user data with a browsing experience designed for public kiosks. + +- Microsoft Edge kiosk mode has a built-in timer to help keep data safe in public browsing sessions. When the idle time (no user activity) meets the time limit, a confirmation message prompts the user to continue, and if no user activity Microsoft Edge resets the session to the default URL. By default, the idle timer is 5 minutes, but you can choose a value of your own. + +- Optionally, you can define a single URL for the Home button, Start page, and New Tab page. See [Supported policies for kiosk mode](#supported-policies-for-kiosk-mode) to learn more. + +- No matter which configuration type you choose, you must set up Microsoft Edge in assigned access; otherwise, Microsoft Edge ignores the settings in this policy (Configure kiosk mode/ConfigureKioskMode).

Learn more about assigned access: + + - [Configure kiosk and shared devices running Windows desktop editions](https://aka.ms/E489vw). + + - [Kiosk apps for assigned access best practices](https://aka.ms/H1s8y4). + + - [Guidelines for choosing an app for assigned access (kiosk mode)](https://aka.ms/Ul7dw3). + + +### Supported configuration types + +[!INCLUDE [configure-kiosk-mode-supported-values-include](includes/configure-kiosk-mode-supported-values-include.md)] + +## Set up Microsoft Edge kiosk mode + +Now that you're familiar with the different kiosk mode configurations and have the one you want to use in mind, you can use one of the following methods to set up Microsoft Edge kiosk mode: + +- **Windows Settings.** Use only to set up a couple of single-app devices because you perform these steps physically on each device. For a multi-app kiosk device, use Microsoft Intune or other MDM service. + +- **Microsoft Intune or other MDM service.** Use to set up several single-app or multi-app kiosk devices. Microsoft Intune and other MDM service providers offer more options for customizing the Microsoft Edge kiosk mode experience using any of the [Supported policies for kiosk mode](#supported-policies-for-kiosk-mode). + + +### Prerequisites + +- Microsoft Edge on Windows 10, version 1809 (Professional, Enterprise, and Education). + +- URL to load when the kiosk launches. The URL that you provide sets the Home button, Start page, and New Tab page. + +- _**For Microsoft Intune or other MDM service**_, you must have the AppUserModelID (AUMID) to set up Microsoft Edge: + + ``` + Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge + ``` + + +### Use Windows Settings + +Windows Settings is the simplest and the only way to set up one or a couple of single-app devices. + + +1. On the kiosk device, open Windows Settings, and in the search field type **kiosk** and then select **Set up a kiosk (assigned access)**. + +2. On the **Set up a kiosk** page, click **Get started**. + +3. Type a name to create a new kiosk account, or choose an existing account from the populated list and click **Next**. + +4. On the **Choose a kiosk app** page, select **Microsoft Edge** and then click **Next**. + +5. Select how Microsoft Edge displays when running in kiosk mode: + + - **As a digital sign or interactive display** - Displays a specific site in full-screen mode, running Microsoft Edge InPrivate protecting user data. + + - **As a public browser** - Runs a limited multi-tab version of Microsoft Edge, protecting user data. + +6. Select **Next**. + +7. Type the URL to load when the kiosk launches. + +8. Accept the default value of **5 minutes** for the idle time or provide a value of your own. + +9. Click **Next**. + +10. Close the **Settings** window to save and apply your choices. + +11. Restart the kiosk device and sign in with the local kiosk account to validate the configuration. + +**_Congratulations!_**

You’ve just finished setting up a single-app kiosk device using Windows Settings. + +**_What's next?_** + +- User your new kiosk device.

+ OR

+- Make changes to your kiosk device. In Windows Settings, on the **Set up a kiosk** page, make your changes to **Choose a kiosk mode** and **Set up Microsoft Edge**. + +--- + + +### Use Microsoft Intune or other MDM service + +With this method, you can use Microsoft Intune or other MDM services to configure Microsoft Edge kiosk mode in assigned access and how it behaves on a kiosk device. To learn about a few app fundamentals and requirements before adding them to Intune, see [Add apps to Microsoft Intune](https://docs.microsoft.com/intune/apps-add). + +>[!IMPORTANT] +>If you are using a local account as a kiosk account in Microsoft Intune, make sure to sign into this account and then sign out before configuring the kiosk device. + +1. In Microsoft Intune or other MDM service, configure [AssignedAccess](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to prevent users from accessing the file system, running executables, or other apps. + +2. Configure the following MDM settings to setup Microsoft Edge kiosk mode on the kiosk device and then restart the device. + + | | | + |---|---| + | **[ConfigureKioskMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode)**

![](images/icon-thin-line-computer.png) | Configure the display mode for Microsoft Edge as a kiosk app.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskMode

**Data type:** Integer

**Allowed values:**

| + | **[ConfigureKioskResetAfterIdleTimeout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout)**

![](images/icon-thin-line-computer.png) | Change the time in minutes from the last user activity before Microsoft Edge kiosk mode resets the user's session.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskResetAfterIdleTimeout

**Data type:** Integer

**Allowed values:**

| + | **[HomePages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-homepages)**

![](images/icon-thin-line-computer.png) | Set one or more start pages, URLs, to load when Microsoft Edge launches.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/HomePages

**Data type:** String

**Allowed values:**

Enter one or more URLs, for example,
   \\ | + | **[ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton)**

![](images/icon-thin-line-computer.png) | Configure how the Home Button behaves.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton

**Data type:** Integer

**Allowed values:**

| + | **[SetHomeButtonURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl)**

![](images/icon-thin-line-computer.png) | If you set ConfigureHomeButton to 2, configure the home button URL.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetHomeButtonURL

**Data type:** String

**Allowed values:** Enter a URL, for example, https://www.bing.com | + | **[SetNewTabPageURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl)**

![](images/icon-thin-line-computer.png) | Set a custom URL for the New Tab page.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetNewTabPageURL

**Data type:** String

**Allowed values:** Enter a URL, for example, https://www.msn.com | + + +**_Congratulations!_**

You’ve just finished setting up a kiosk or digital signage with policies for Microsoft Edge kiosk mode using Microsoft Intune or other MDM service. + +**_What's next?_**

Now it's time to use your new kiosk device. Sign into the device with the kiosk account selected to run Microsoft Edge kiosk mode. + +--- + + +## Supported policies for kiosk mode + +Use any of the Microsoft Edge policies listed below to enhance the kiosk experience depending on the Microsoft Edge kiosk mode type you configure. To learn more about these policies, see [Policy CSP - Browser](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser). + +Make sure to check with your provider for instructions. + +| **MDM Setting** | **Digital /
Interactive signage** | **Public browsing
single-app** | **Public browsing
multi-app** | **Normal
mode** | +|------------------|:---------:|:---------:|:---------:|:---------:| +| [AllowAddressBarDropdown](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowaddressbardropdown) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowAutofill](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowautofill) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowBrowser](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowbrowser) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | +| [AllowConfigurationUpdateForBooksLibrary](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowconfigurationupdateforbookslibrary) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowCookies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowcookies) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [AllowDeveloperTools](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowdevelopertools) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowDoNotTrack](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowdonottrack) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [AllowExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowextensions) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowFlash](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowflash) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [AllowFlashClickToRun](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowflashclicktorun) | ![Supported](images/148767.png)2 | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [AllowFullscreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowfullscreenmode)\* | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [AllowInPrivate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowinprivate) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowMicrosoftCompatibilityList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowmicrosoftcompatibilitylist) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png)1 | ![Supported](images/148767.png) | +| [AllowPasswordManager](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowpasswordmanager) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowPopups](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowpopups) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [AllowPrelaunch](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowprelaunch)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowPrinting](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowprinting)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [AllowSavingHistory](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsavinghistory)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowSearchEngineCustomization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsearchenginecustomization) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowSearchSuggestionsinAddressBar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsearchenginecustomization) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [AllowSideloadingExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsideloadingofextensions)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [AllowSyncMySettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowsyncmysettings) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowTabPreloading](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowWebContentOnNewTabPage](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowwebcontentonnewtabpage)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AlwaysEnabledBooksLibrary](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [ClearBrowsingDataOnExit](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-clearbrowsingdataonexit) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [ConfigureAdditionalSearchEngines](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configureadditionalsearchengines) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [ConfigureFavoritesBar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurefavoritesbar)\* | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +|  [ConfigureKioskMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +|  [ConfigureKioskResetAfterIdleTimeout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout)\* | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | +| [ConfigureOpenEdgeWith](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [ConfigureTelemetryForMicrosoft365Analytics](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configuretelemetryformicrosoft365analytics)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [DisableLockdownOfStartPages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-disablelockdownofstartpages) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [Experience/DoNotSyncBrowserSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-donotsyncbrowsersetting)\* and [Experience/PreventTurningOffRequiredExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventturningoffrequiredextensions)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [EnableExtendedBooksTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enableextendedbookstelemetry) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png)1 | ![Supported](images/148767.png) | +| [FirstRunURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-firstrunurl) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | +| [HomePages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-homepages) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [LockdownFavorites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-lockdownfavorites) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [PreventAccessToAboutFlagsInMicrosoftEdge](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventaccesstoaboutflagsinmicrosoftedge) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [PreventCertErrorOverrides](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [PreventFirstRunPage](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventfirstrunpage) | ![Supported](images/148767.png) | ![Supported](images/148767.png)| ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [PreventLiveTileDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventlivetiledatacollection) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [PreventSmartScreenPromptOverride](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventsmartscreenpromptoverride) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [PreventSmartScreenPromptOverrideForFiles](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventsmartscreenpromptoverrideforfiles) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [PreventTurningOffRequiredExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventturningoffrequiredextensions)\* | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [PreventUsingLocalHostIPAddressForWebRTC](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventusinglocalhostipaddressforwebrtc) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [ProvisionFavorites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [SendIntranetTraffictoInternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sendintranettraffictointernetexplorer) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png)1 | ![Supported](images/148767.png) | +| [SetDefaultSearchEngine](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-setdefaultsearchengine) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [SetHomeButtonURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl)\* | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [SetNewTabPageURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl)\* | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| [ShowMessageWhenOpeningInteretExplorerSites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-showmessagewhenopeningsitesininternetexplorer) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png)1 | ![Supported](images/148767.png) | +| [SyncFavoritesBetweenIEAndMicrosoftEdge](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-syncfavoritesbetweenieandmicrosoftedge) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png)1 | ![Supported](images/148767.png) | +| [UnlockHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [UseSharedFolderForBooks](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-usesharedfolderforbooks) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | + + +*\* New policy as of Windows 10, version 1809.*

+*1) For multi-app assigned access, you must configure Internet Explorer 11.*
+*2) For digital/interactive signage to enable Flash, set [AllowFlashClickToRun](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowflashclicktorun) to 0.* + +**Legend:**

+       ![Not supported](images/148766.png) = Not applicable or not supported
+       ![Supported](images/148767.png) = Supported + +--- + +## Feature comparison of kiosk mode and kiosk browser app +In the following table, we show you the features available in both Microsoft Edge kiosk mode and Kiosk Browser app available in Microsoft Store. Both kiosk mode and kiosk browser app work in assigned access. + + +| **Feature** | **Microsoft Edge kiosk mode** | **Microsoft Kiosk browser app** | +|-----------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------:|:-------------------------------------------------------------------------------------------------------------------------------------------------------:| +| Print support | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | +| Multi-tab support | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | +| Allow/Block URL support | ![Supported](images/148767.png)

*\*For Microsoft Edge kiosk mode use* Windows Defender Firewall. Microsoft kiosk browser has custom policy support. | ![Supported](images/148767.png) | +| Configure Home Button | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| Set Start page(s) URL | ![Supported](images/148767.png) | ![Supported](images/148767.png)

*Same as Home button URL* | +| Set New Tab page URL | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | +| Favorites management | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | +| End session button | ![Supported](images/148767.png) | ![Supported](images/148767.png)

*In Microsoft Intune, you must create a custom URI to enable. Dedicated UI configuration introduced in version 1808.* | +| Reset on inactivity | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| Internet Explorer integration (Enterprise Mode site list) | ![Supported](images/148767.png)

*Multi-app mode only* | ![Not supported](images/148766.png) | +| Available in Microsoft Store | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| SKU availability | Windows 10 October 2018 Update
Professional, Enterprise, and Education | Windows 10 April 2018 Update
Professional, Enterprise, and Education | + +**\*Windows Defender Firewall**

+To prevent access to unwanted websites on your kiosk device, use Windows Defender Firewall to configure a list of allowed websites, blocked websites or both. For more details, see [Windows Defender Firewall with Advanced Security Deployment](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide). + +--- + +## Provide feedback or get support + +To provide feedback on Microsoft Edge kiosk mode in Feedback Hub, select **Microsoft Edge** as the **Category**, and **All other issues** as the subcategory. + +**_For multi-app kiosk only._** If you have set up the Feedback Hub in assigned access, you can you submit the feedback from the device running Microsoft Edge in kiosk mode in which you can include diagnostic logs. In the Feedback Hub, select **Microsoft Edge** as the **Category**, and **All other issues** as the subcategory. + + + diff --git a/browsers/edge/troubleshooting-microsoft-edge.md b/browsers/edge/troubleshooting-microsoft-edge.md index ba351d8b48..5cd394e473 100644 --- a/browsers/edge/troubleshooting-microsoft-edge.md +++ b/browsers/edge/troubleshooting-microsoft-edge.md @@ -34,4 +34,4 @@ If you want to deliver applications to users via Citrix through Microsoft Edge, ## Missing SettingSync.admx and SettingSync.adml files -Make sure to [download](https://www.microsoft.com/en-us/download/windows.aspx) the latest templates to C:\windows\policydefinitions\. +Make sure to [download](https://www.microsoft.com/download/windows.aspx) the latest templates to C:\windows\policydefinitions\. diff --git a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md index c90d6b1c59..15560fccc7 100644 --- a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md +++ b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md @@ -171,13 +171,13 @@ You can determine which zones or domains are used for data collection, using Pow **To set up data collection using a domain allow list** - - Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -SiteAllowList sharepoint.com,outlook.com,onedrive.com`. +- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -SiteAllowList sharepoint.com,outlook.com,onedrive.com`. >**Important**
Wildcards, like \*.microsoft.com, aren’t supported. **To set up data collection using a zone allow list** - - Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -ZoneAllowList Computer,Intranet,TrustedSites,Internet,RestrictedSites`. +- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -ZoneAllowList Computer,Intranet,TrustedSites,Internet,RestrictedSites`. >**Important**
Only Computer, Intranet, TrustedSites, Internet, and RestrictedSites are supported. diff --git a/browsers/enterprise-mode/enterprise-mode.md b/browsers/enterprise-mode/enterprise-mode.md index 3e22df673d..9e9f2933fe 100644 --- a/browsers/enterprise-mode/enterprise-mode.md +++ b/browsers/enterprise-mode/enterprise-mode.md @@ -5,7 +5,7 @@ ms.pagetype: security description: Use this section to learn about how to turn on Enterprise Mode. author: eavena ms.author: eravena -ms.prod: edge, ie11 +ms.prod: edge ms.assetid: ms.reviewer: manager: dansimp diff --git a/browsers/includes/helpful-topics-include.md b/browsers/includes/helpful-topics-include.md index 9d4ab636ca..0a0f72e971 100644 --- a/browsers/includes/helpful-topics-include.md +++ b/browsers/includes/helpful-topics-include.md @@ -24,7 +24,7 @@ ms.topic: include - [Web Application Compatibility Lab Kit](https://technet.microsoft.com/microsoft-edge/mt612809.aspx) -- [Microsoft Services Support](https://www.microsoft.com/en-us/microsoftservices/support.aspx) +- [Microsoft Services Support](https://www.microsoft.com/microsoftservices/support.aspx) - [Find a Microsoft partner on Pinpoint](https://partnercenter.microsoft.com/pcv/search) diff --git a/browsers/internet-explorer/TOC.md b/browsers/internet-explorer/TOC.md index 0fed701c19..c2812cb730 100644 --- a/browsers/internet-explorer/TOC.md +++ b/browsers/internet-explorer/TOC.md @@ -1,188 +1,188 @@ -#[IE11 Deployment Guide for IT Pros](ie11-deploy-guide/index.md) +# [IE11 Deployment Guide for IT Pros](ie11-deploy-guide/index.md) -##[Change history for the Internet Explorer 11 (IE11) Deployment Guide](ie11-deploy-guide/change-history-for-internet-explorer-11.md) +## [Change history for the Internet Explorer 11 (IE11) Deployment Guide](ie11-deploy-guide/change-history-for-internet-explorer-11.md) -##[System requirements and language support for Internet Explorer 11](ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md) +## [System requirements and language support for Internet Explorer 11](ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md) -##[List of updated features and tools - Internet Explorer 11 (IE11)](ie11-deploy-guide/updated-features-and-tools-with-ie11.md) +## [List of updated features and tools - Internet Explorer 11 (IE11)](ie11-deploy-guide/updated-features-and-tools-with-ie11.md) -##[Install and Deploy Internet Explorer 11 (IE11)](ie11-deploy-guide/install-and-deploy-ie11.md) -###[Customize Internet Explorer 11 installation packages](ie11-deploy-guide/customize-ie11-install-packages.md) -####[Using IEAK 11 to create packages](ie11-deploy-guide/using-ieak11-to-create-install-packages.md) -####[Create packages for multiple operating systems or languages](ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md) -####[Using .INF files to create packages](ie11-deploy-guide/using-inf-files-to-create-install-packages.md) -###[Choose how to install Internet Explorer 11 (IE11)](ie11-deploy-guide/choose-how-to-install-ie11.md) -####[Install Internet Explorer 11 (IE11) - System Center 2012 R2 Configuration Manager](ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md) -####[Install Internet Explorer 11 (IE11) - Windows Server Update Services (WSUS)](ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md) -####[Install Internet Explorer 11 (IE11) - Microsoft Intune](ie11-deploy-guide/install-ie11-using-microsoft-intune.md) -####[Install Internet Explorer 11 (IE11) - Network](ie11-deploy-guide/install-ie11-using-the-network.md) -####[Install Internet Explorer 11 (IE11) - Operating system deployment systems](ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md) -####[Install Internet Explorer 11 (IE11) - Third-party tools](ie11-deploy-guide/install-ie11-using-third-party-tools.md) -###[Choose how to deploy Internet Explorer 11 (IE11)](ie11-deploy-guide/choose-how-to-deploy-ie11.md) -####[Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS)](ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md) -####[Deploy Internet Explorer 11 using software distribution tools](ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md) -###[Virtualization and compatibility with Internet Explorer 11](ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md) +## [Install and Deploy Internet Explorer 11 (IE11)](ie11-deploy-guide/install-and-deploy-ie11.md) +### [Customize Internet Explorer 11 installation packages](ie11-deploy-guide/customize-ie11-install-packages.md) +#### [Using IEAK 11 to create packages](ie11-deploy-guide/using-ieak11-to-create-install-packages.md) +#### [Create packages for multiple operating systems or languages](ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md) +#### [Using .INF files to create packages](ie11-deploy-guide/using-inf-files-to-create-install-packages.md) +### [Choose how to install Internet Explorer 11 (IE11)](ie11-deploy-guide/choose-how-to-install-ie11.md) +#### [Install Internet Explorer 11 (IE11) - System Center 2012 R2 Configuration Manager](ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md) +#### [Install Internet Explorer 11 (IE11) - Windows Server Update Services (WSUS)](ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md) +#### [Install Internet Explorer 11 (IE11) - Microsoft Intune](ie11-deploy-guide/install-ie11-using-microsoft-intune.md) +#### [Install Internet Explorer 11 (IE11) - Network](ie11-deploy-guide/install-ie11-using-the-network.md) +#### [Install Internet Explorer 11 (IE11) - Operating system deployment systems](ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md) +#### [Install Internet Explorer 11 (IE11) - Third-party tools](ie11-deploy-guide/install-ie11-using-third-party-tools.md) +### [Choose how to deploy Internet Explorer 11 (IE11)](ie11-deploy-guide/choose-how-to-deploy-ie11.md) +#### [Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS)](ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md) +#### [Deploy Internet Explorer 11 using software distribution tools](ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md) +### [Virtualization and compatibility with Internet Explorer 11](ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md) -##[Collect data using Enterprise Site Discovery](ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md) +## [Collect data using Enterprise Site Discovery](ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md) -##[Enterprise Mode for Internet Explorer 11 (IE11)](ie11-deploy-guide/enterprise-mode-overview-for-ie11.md) -###[Tips and tricks to manage Internet Explorer compatibility](ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md) -###[Enterprise Mode and the Enterprise Mode Site List](ie11-deploy-guide/what-is-enterprise-mode.md) -###[Set up Enterprise Mode logging and data collection](ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md) -###[Turn on Enterprise Mode and use a site list](ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md) -###[Enterprise Mode schema v.2 guidance](ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md) -###[Enterprise Mode schema v.1 guidance](ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md) -###[Check for a new Enterprise Mode site list xml file](ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md) -###[Turn on local control and logging for Enterprise Mode](ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md) -###[Use the Enterprise Mode Site List Manager](ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md) -####[Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) -####[Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) -####[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) -####[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) -####[Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager](ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) -####[Fix validation problems using the Enterprise Mode Site List Manager](ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) -####[Search your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) -####[Save your site list to XML in the Enterprise Mode Site List Manager](ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) -####[Export your Enterprise Mode site list from the Enterprise Mode Site List Manager](ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) -####[Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md) -####[Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) -####[Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) -###[Use the Enterprise Mode Site List Portal](ie11-deploy-guide/use-the-enterprise-mode-portal.md) -####[Set up the Enterprise Mode Site List Portal](ie11-deploy-guide/set-up-enterprise-mode-portal.md) -#####[Use the Settings page to finish setting up the Enterprise Mode Site List Portal](ie11-deploy-guide/configure-settings-enterprise-mode-portal.md) -#####[Add employees to the Enterprise Mode Site List Portal](ie11-deploy-guide/add-employees-enterprise-mode-portal.md) -####[Workflow-based processes for employees using the Enterprise Mode Site List Portal](ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md) -#####[Create a change request using the Enterprise Mode Site List Portal](ie11-deploy-guide/create-change-request-enterprise-mode-portal.md) -#####[Verify your changes using the Enterprise Mode Site List Portal](ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md) -#####[Approve a change request using the Enterprise Mode Site List Portal](ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md) -#####[Schedule approved change requests for production using the Enterprise Mode Site List Portal](ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md) -#####[Verify the change request update in the production environment using the Enterprise Mode Site List Portal](ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md) -#####[View the apps currently on the Enterprise Mode Site List](ie11-deploy-guide/view-apps-enterprise-mode-site-list.md) -#####[View the available Enterprise Mode reports from the Enterprise Mode Site List Portal](ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md) -###[Using IE7 Enterprise Mode or IE8 Enterprise Mode](ie11-deploy-guide/using-enterprise-mode.md) -###[Fix web compatibility issues using document modes and the Enterprise Mode site list](ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md) -###[Remove sites from a local Enterprise Mode site list](ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md) -###[Remove sites from a local compatibility view list](ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md) -###[Turn off Enterprise Mode](ie11-deploy-guide/turn-off-enterprise-mode.md) +## [Enterprise Mode for Internet Explorer 11 (IE11)](ie11-deploy-guide/enterprise-mode-overview-for-ie11.md) +### [Tips and tricks to manage Internet Explorer compatibility](ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md) +### [Enterprise Mode and the Enterprise Mode Site List](ie11-deploy-guide/what-is-enterprise-mode.md) +### [Set up Enterprise Mode logging and data collection](ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md) +### [Turn on Enterprise Mode and use a site list](ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md) +### [Enterprise Mode schema v.2 guidance](ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md) +### [Enterprise Mode schema v.1 guidance](ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md) +### [Check for a new Enterprise Mode site list xml file](ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md) +### [Turn on local control and logging for Enterprise Mode](ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md) +### [Use the Enterprise Mode Site List Manager](ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md) +#### [Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) +#### [Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) +#### [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) +#### [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) +#### [Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager](ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) +#### [Fix validation problems using the Enterprise Mode Site List Manager](ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) +#### [Search your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +#### [Save your site list to XML in the Enterprise Mode Site List Manager](ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) +#### [Export your Enterprise Mode site list from the Enterprise Mode Site List Manager](ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) +#### [Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md) +#### [Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +#### [Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +### [Use the Enterprise Mode Site List Portal](ie11-deploy-guide/use-the-enterprise-mode-portal.md) +#### [Set up the Enterprise Mode Site List Portal](ie11-deploy-guide/set-up-enterprise-mode-portal.md) +##### [Use the Settings page to finish setting up the Enterprise Mode Site List Portal](ie11-deploy-guide/configure-settings-enterprise-mode-portal.md) +##### [Add employees to the Enterprise Mode Site List Portal](ie11-deploy-guide/add-employees-enterprise-mode-portal.md) +#### [Workflow-based processes for employees using the Enterprise Mode Site List Portal](ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md) +##### [Create a change request using the Enterprise Mode Site List Portal](ie11-deploy-guide/create-change-request-enterprise-mode-portal.md) +##### [Verify your changes using the Enterprise Mode Site List Portal](ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md) +##### [Approve a change request using the Enterprise Mode Site List Portal](ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md) +##### [Schedule approved change requests for production using the Enterprise Mode Site List Portal](ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md) +##### [Verify the change request update in the production environment using the Enterprise Mode Site List Portal](ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md) +##### [View the apps currently on the Enterprise Mode Site List](ie11-deploy-guide/view-apps-enterprise-mode-site-list.md) +##### [View the available Enterprise Mode reports from the Enterprise Mode Site List Portal](ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md) +### [Using IE7 Enterprise Mode or IE8 Enterprise Mode](ie11-deploy-guide/using-enterprise-mode.md) +### [Fix web compatibility issues using document modes and the Enterprise Mode site list](ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md) +### [Remove sites from a local Enterprise Mode site list](ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md) +### [Remove sites from a local compatibility view list](ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md) +### [Turn off Enterprise Mode](ie11-deploy-guide/turn-off-enterprise-mode.md) -##[Group Policy and Internet Explorer 11 (IE11)](ie11-deploy-guide/group-policy-and-ie11.md) -###[Group Policy management tools](ie11-deploy-guide/group-policy-objects-and-ie11.md) -####[Group Policy and the Group Policy Management Console (GPMC)](ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md) -####[Group Policy and the Local Group Policy Editor](ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md) -####[Group Policy and Advanced Group Policy Management (AGPM)](ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md) -####[Group Policy and Windows Powershell](ie11-deploy-guide/group-policy-windows-powershell-ie11.md) -####[Group Policy and Shortcut Extensions](ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md) -###[New group policy settings for Internet Explorer 11](ie11-deploy-guide/new-group-policy-settings-for-ie11.md) -###[Set the default browser using Group Policy](ie11-deploy-guide/set-the-default-browser-using-group-policy.md) -###[ActiveX installation using group policy](ie11-deploy-guide/activex-installation-using-group-policy.md) -###[Group Policy and compatibility with Internet Explorer 11](ie11-deploy-guide/group-policy-compatibility-with-ie11.md) -###[Group policy preferences and Internet Explorer 11](ie11-deploy-guide/group-policy-preferences-and-ie11.md) -###[Administrative templates and Internet Explorer 11](ie11-deploy-guide/administrative-templates-and-ie11.md) -###[Enable and disable add-ons using administrative templates and group policy](ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md) +## [Group Policy and Internet Explorer 11 (IE11)](ie11-deploy-guide/group-policy-and-ie11.md) +### [Group Policy management tools](ie11-deploy-guide/group-policy-objects-and-ie11.md) +#### [Group Policy and the Group Policy Management Console (GPMC)](ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md) +#### [Group Policy and the Local Group Policy Editor](ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md) +#### [Group Policy and Advanced Group Policy Management (AGPM)](ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md) +#### [Group Policy and Windows Powershell](ie11-deploy-guide/group-policy-windows-powershell-ie11.md) +#### [Group Policy and Shortcut Extensions](ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md) +### [New group policy settings for Internet Explorer 11](ie11-deploy-guide/new-group-policy-settings-for-ie11.md) +### [Set the default browser using Group Policy](ie11-deploy-guide/set-the-default-browser-using-group-policy.md) +### [ActiveX installation using group policy](ie11-deploy-guide/activex-installation-using-group-policy.md) +### [Group Policy and compatibility with Internet Explorer 11](ie11-deploy-guide/group-policy-compatibility-with-ie11.md) +### [Group policy preferences and Internet Explorer 11](ie11-deploy-guide/group-policy-preferences-and-ie11.md) +### [Administrative templates and Internet Explorer 11](ie11-deploy-guide/administrative-templates-and-ie11.md) +### [Enable and disable add-ons using administrative templates and group policy](ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md) -##[Manage Internet Explorer 11](ie11-deploy-guide/manage-ie11-overview.md) -###[Auto detect settings Internet Explorer 11](ie11-deploy-guide/auto-detect-settings-for-ie11.md) -###[Auto configuration settings for Internet Explorer 11](ie11-deploy-guide/auto-configuration-settings-for-ie11.md) -###[Auto proxy configuration settings for Internet Explorer 11](ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md) +## [Manage Internet Explorer 11](ie11-deploy-guide/manage-ie11-overview.md) +### [Auto detect settings Internet Explorer 11](ie11-deploy-guide/auto-detect-settings-for-ie11.md) +### [Auto configuration settings for Internet Explorer 11](ie11-deploy-guide/auto-configuration-settings-for-ie11.md) +### [Auto proxy configuration settings for Internet Explorer 11](ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md) -##[Troubleshoot Internet Explorer 11 (IE11)](ie11-deploy-guide/troubleshoot-ie11.md) -###[Setup problems with Internet Explorer 11](ie11-deploy-guide/setup-problems-with-ie11.md) -###[Install problems with Internet Explorer 11](ie11-deploy-guide/install-problems-with-ie11.md) -###[Problems after installing Internet Explorer 11](ie11-deploy-guide/problems-after-installing-ie11.md) -###[Auto configuration and auto proxy problems with Internet Explorer 11](ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md) -###[User interface problems with Internet Explorer 11](ie11-deploy-guide/user-interface-problems-with-ie11.md) -###[Group Policy problems with Internet Explorer 11](ie11-deploy-guide/group-policy-problems-ie11.md) -###[.NET Framework problems with Internet Explorer 11](ie11-deploy-guide/net-framework-problems-with-ie11.md) -###[Enhanced Protected Mode problems with Internet Explorer](ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md) -###[Fix font rendering problems by turning off natural metrics](ie11-deploy-guide/turn-off-natural-metrics.md) -###[Intranet problems with Internet Explorer 11](ie11-deploy-guide/intranet-problems-and-ie11.md) -###[Browser cache changes and roaming profiles](ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md) +## [Troubleshoot Internet Explorer 11 (IE11)](ie11-deploy-guide/troubleshoot-ie11.md) +### [Setup problems with Internet Explorer 11](ie11-deploy-guide/setup-problems-with-ie11.md) +### [Install problems with Internet Explorer 11](ie11-deploy-guide/install-problems-with-ie11.md) +### [Problems after installing Internet Explorer 11](ie11-deploy-guide/problems-after-installing-ie11.md) +### [Auto configuration and auto proxy problems with Internet Explorer 11](ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md) +### [User interface problems with Internet Explorer 11](ie11-deploy-guide/user-interface-problems-with-ie11.md) +### [Group Policy problems with Internet Explorer 11](ie11-deploy-guide/group-policy-problems-ie11.md) +### [.NET Framework problems with Internet Explorer 11](ie11-deploy-guide/net-framework-problems-with-ie11.md) +### [Enhanced Protected Mode problems with Internet Explorer](ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md) +### [Fix font rendering problems by turning off natural metrics](ie11-deploy-guide/turn-off-natural-metrics.md) +### [Intranet problems with Internet Explorer 11](ie11-deploy-guide/intranet-problems-and-ie11.md) +### [Browser cache changes and roaming profiles](ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md) -##[Out-of-date ActiveX control blocking](ie11-deploy-guide/out-of-date-activex-control-blocking.md) -###[Blocked out-of-date ActiveX controls](ie11-deploy-guide/blocked-out-of-date-activex-controls.md) +## [Out-of-date ActiveX control blocking](ie11-deploy-guide/out-of-date-activex-control-blocking.md) +### [Blocked out-of-date ActiveX controls](ie11-deploy-guide/blocked-out-of-date-activex-controls.md) -##[Deprecated document modes and Internet Explorer 11](ie11-deploy-guide/deprecated-document-modes.md) +## [Deprecated document modes and Internet Explorer 11](ie11-deploy-guide/deprecated-document-modes.md) -##[What is the Internet Explorer 11 Blocker Toolkit?](ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md) -###[Internet Explorer 11 delivery through automatic updates](ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) -###[Internet Explorer 11 Blocker Toolkit FAQ](ie11-faq/faq-ie11-blocker-toolkit.md) +## [What is the Internet Explorer 11 Blocker Toolkit?](ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md) +### [Internet Explorer 11 delivery through automatic updates](ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) +### [Internet Explorer 11 Blocker Toolkit FAQ](ie11-faq/faq-ie11-blocker-toolkit.md) -##[Missing Internet Explorer Maintenance settings for Internet Explorer 11](ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md) +## [Missing Internet Explorer Maintenance settings for Internet Explorer 11](ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md) -##[Missing the Compatibility View Button](ie11-deploy-guide/missing-the-compatibility-view-button.md) +## [Missing the Compatibility View Button](ie11-deploy-guide/missing-the-compatibility-view-button.md) -##[Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013](ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md) +## [Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013](ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md) -#[IE11 Frequently Asked Questions (FAQ) Guide for IT Pros](ie11-faq/faq-for-it-pros-ie11.md) +# [IE11 Frequently Asked Questions (FAQ) Guide for IT Pros](ie11-faq/faq-for-it-pros-ie11.md) -#[Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](ie11-ieak/index.md) -##[What IEAK can do for you](ie11-ieak/what-ieak-can-do-for-you.md) -##[Internet Explorer Administration Kit (IEAK) information and downloads](ie11-ieak/ieak-information-and-downloads.md) -##[Before you start using IEAK 11](ie11-ieak/before-you-create-custom-pkgs-ieak11.md) -###[Hardware and software requirements for IEAK 11](ie11-ieak/hardware-and-software-reqs-ieak11.md) -###[Determine the licensing version and features to use in IEAK 11](ie11-ieak/licensing-version-and-features-ieak11.md) -###[Security features and IEAK 11](ie11-ieak/security-and-ieak11.md) -###[File types used or created by IEAK 11](ie11-ieak/file-types-ieak11.md) -###[Tasks and references to consider before creating and deploying custom packages using IEAK 11](ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md) -###[Create the build computer folder structure using IEAK 11](ie11-ieak/create-build-folder-structure-ieak11.md) -###[Set up auto detection for DHCP or DNS servers using IEAK 11](ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md) -###[Use proxy auto-configuration (.pac) files with IEAK 11](ie11-ieak/proxy-auto-config-examples.md) -###[Customize the toolbar button and Favorites List icons using IEAK 11](ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md) -###[Use the uninstallation .INF files to uninstall custom components](ie11-ieak/create-uninstall-inf-files-for-custom-components.md) -###[Add and approve ActiveX controls using the IEAK 11](ie11-ieak/add-and-approve-activex-controls-ieak11.md) -###[Register an uninstall app for custom components using IEAK 11](ie11-ieak/register-uninstall-app-ieak11.md) -###[Customize Automatic Search for Internet Explorer using IEAK 11](ie11-ieak/customize-automatic-search-for-ie.md) -###[Create multiple versions of your custom package using IEAK 11](ie11-ieak/create-multiple-browser-packages-ieak11.md) -###[Before you install your package over your network using IEAK 11](ie11-ieak/prep-network-install-with-ieak11.md) -###[Use the RSoP snap-in to review policy settings](ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md) -###[IEAK 11 - Frequently Asked Questions](ie11-faq/faq-ieak11.md) -###[Troubleshoot custom package and IEAK 11 problems](ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md) +# [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](ie11-ieak/index.md) +## [What IEAK can do for you](ie11-ieak/what-ieak-can-do-for-you.md) +## [Internet Explorer Administration Kit (IEAK) information and downloads](ie11-ieak/ieak-information-and-downloads.md) +## [Before you start using IEAK 11](ie11-ieak/before-you-create-custom-pkgs-ieak11.md) +### [Hardware and software requirements for IEAK 11](ie11-ieak/hardware-and-software-reqs-ieak11.md) +### [Determine the licensing version and features to use in IEAK 11](ie11-ieak/licensing-version-and-features-ieak11.md) +### [Security features and IEAK 11](ie11-ieak/security-and-ieak11.md) +### [File types used or created by IEAK 11](ie11-ieak/file-types-ieak11.md) +### [Tasks and references to consider before creating and deploying custom packages using IEAK 11](ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md) +### [Create the build computer folder structure using IEAK 11](ie11-ieak/create-build-folder-structure-ieak11.md) +### [Set up auto detection for DHCP or DNS servers using IEAK 11](ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md) +### [Use proxy auto-configuration (.pac) files with IEAK 11](ie11-ieak/proxy-auto-config-examples.md) +### [Customize the toolbar button and Favorites List icons using IEAK 11](ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md) +### [Use the uninstallation .INF files to uninstall custom components](ie11-ieak/create-uninstall-inf-files-for-custom-components.md) +### [Add and approve ActiveX controls using the IEAK 11](ie11-ieak/add-and-approve-activex-controls-ieak11.md) +### [Register an uninstall app for custom components using IEAK 11](ie11-ieak/register-uninstall-app-ieak11.md) +### [Customize Automatic Search for Internet Explorer using IEAK 11](ie11-ieak/customize-automatic-search-for-ie.md) +### [Create multiple versions of your custom package using IEAK 11](ie11-ieak/create-multiple-browser-packages-ieak11.md) +### [Before you install your package over your network using IEAK 11](ie11-ieak/prep-network-install-with-ieak11.md) +### [Use the RSoP snap-in to review policy settings](ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md) +### [IEAK 11 - Frequently Asked Questions](ie11-faq/faq-ieak11.md) +### [Troubleshoot custom package and IEAK 11 problems](ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md) -##[Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](ie11-ieak/ieak11-wizard-custom-options.md) -###[Use the File Locations page in the IEAK 11 Wizard](ie11-ieak/file-locations-ieak11-wizard.md) -###[Use the Platform Selection page in the IEAK 11 Wizard](ie11-ieak/platform-selection-ieak11-wizard.md) -###[Use the Language Selection page in the IEAK 11 Wizard](ie11-ieak/language-selection-ieak11-wizard.md) -###[Use the Package Type Selection page in the IEAK 11 Wizard](ie11-ieak/pkg-type-selection-ieak11-wizard.md) -###[Use the Feature Selection page in the IEAK 11 Wizard](ie11-ieak/feature-selection-ieak11-wizard.md) -###[Use the Automatic Version Synchronization page in the IEAK 11 Wizard](ie11-ieak/auto-version-sync-ieak11-wizard.md) -###[Use the Custom Components page in the IEAK 11 Wizard](ie11-ieak/custom-components-ieak11-wizard.md) -###[Use the Internal Install page in the IEAK 11 Wizard](ie11-ieak/internal-install-ieak11-wizard.md) -###[Use the User Experience page in the IEAK 11 Wizard](ie11-ieak/user-experience-ieak11-wizard.md) -###[Use the Browser User Interface page in the IEAK 11 Wizard](ie11-ieak/browser-ui-ieak11-wizard.md) -###[Use the Search Providers page in the IEAK 11 Wizard](ie11-ieak/search-providers-ieak11-wizard.md) -###[Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard](ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md) -###[Use the Accelerators page in the IEAK 11 Wizard](ie11-ieak/accelerators-ieak11-wizard.md) -###[Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard](ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md) -###[Use the Browsing Options page in the IEAK 11 Wizard](ie11-ieak/browsing-options-ieak11-wizard.md) -###[Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard](ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md) -###[Use the Compatibility View page in the IEAK 11 Wizard](ie11-ieak/compat-view-ieak11-wizard.md) -###[Use the Connection Manager page in the IEAK 11 Wizard](ie11-ieak/connection-mgr-ieak11-wizard.md) -###[Use the Connection Settings page in the IEAK 11 Wizard](ie11-ieak/connection-settings-ieak11-wizard.md) -###[Use the Automatic Configuration page in the IEAK 11 Wizard](ie11-ieak/auto-config-ieak11-wizard.md) -###[Use the Proxy Settings page in the IEAK 11 Wizard](ie11-ieak/proxy-settings-ieak11-wizard.md) -###[Use the Security and Privacy Settings page in the IEAK 11 Wizard](ie11-ieak/security-and-privacy-settings-ieak11-wizard.md) -###[Use the Add a Root Certificate page in the IEAK 11 Wizard](ie11-ieak/add-root-certificate-ieak11-wizard.md) -###[Use the Programs page in the IEAK 11 Wizard](ie11-ieak/programs-ieak11-wizard.md) -###[Use the Additional Settings page in the IEAK 11 Wizard](ie11-ieak/additional-settings-ieak11-wizard.md) -###[Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard](ie11-ieak/wizard-complete-ieak11-wizard.md) +## [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](ie11-ieak/ieak11-wizard-custom-options.md) +### [Use the File Locations page in the IEAK 11 Wizard](ie11-ieak/file-locations-ieak11-wizard.md) +### [Use the Platform Selection page in the IEAK 11 Wizard](ie11-ieak/platform-selection-ieak11-wizard.md) +### [Use the Language Selection page in the IEAK 11 Wizard](ie11-ieak/language-selection-ieak11-wizard.md) +### [Use the Package Type Selection page in the IEAK 11 Wizard](ie11-ieak/pkg-type-selection-ieak11-wizard.md) +### [Use the Feature Selection page in the IEAK 11 Wizard](ie11-ieak/feature-selection-ieak11-wizard.md) +### [Use the Automatic Version Synchronization page in the IEAK 11 Wizard](ie11-ieak/auto-version-sync-ieak11-wizard.md) +### [Use the Custom Components page in the IEAK 11 Wizard](ie11-ieak/custom-components-ieak11-wizard.md) +### [Use the Internal Install page in the IEAK 11 Wizard](ie11-ieak/internal-install-ieak11-wizard.md) +### [Use the User Experience page in the IEAK 11 Wizard](ie11-ieak/user-experience-ieak11-wizard.md) +### [Use the Browser User Interface page in the IEAK 11 Wizard](ie11-ieak/browser-ui-ieak11-wizard.md) +### [Use the Search Providers page in the IEAK 11 Wizard](ie11-ieak/search-providers-ieak11-wizard.md) +### [Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard](ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md) +### [Use the Accelerators page in the IEAK 11 Wizard](ie11-ieak/accelerators-ieak11-wizard.md) +### [Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard](ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md) +### [Use the Browsing Options page in the IEAK 11 Wizard](ie11-ieak/browsing-options-ieak11-wizard.md) +### [Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard](ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md) +### [Use the Compatibility View page in the IEAK 11 Wizard](ie11-ieak/compat-view-ieak11-wizard.md) +### [Use the Connection Manager page in the IEAK 11 Wizard](ie11-ieak/connection-mgr-ieak11-wizard.md) +### [Use the Connection Settings page in the IEAK 11 Wizard](ie11-ieak/connection-settings-ieak11-wizard.md) +### [Use the Automatic Configuration page in the IEAK 11 Wizard](ie11-ieak/auto-config-ieak11-wizard.md) +### [Use the Proxy Settings page in the IEAK 11 Wizard](ie11-ieak/proxy-settings-ieak11-wizard.md) +### [Use the Security and Privacy Settings page in the IEAK 11 Wizard](ie11-ieak/security-and-privacy-settings-ieak11-wizard.md) +### [Use the Add a Root Certificate page in the IEAK 11 Wizard](ie11-ieak/add-root-certificate-ieak11-wizard.md) +### [Use the Programs page in the IEAK 11 Wizard](ie11-ieak/programs-ieak11-wizard.md) +### [Use the Additional Settings page in the IEAK 11 Wizard](ie11-ieak/additional-settings-ieak11-wizard.md) +### [Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard](ie11-ieak/wizard-complete-ieak11-wizard.md) -##[Using Internet Settings (.INS) files with IEAK 11](ie11-ieak/using-internet-settings-ins-files.md) -###[Use the Branding .INS file to create custom branding and setup info](ie11-ieak/branding-ins-file-setting.md) -###[Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar](ie11-ieak/browsertoolbars-ins-file-setting.md) -###[Use the CabSigning .INS file to review the digital signatures for your apps](ie11-ieak/cabsigning-ins-file-setting.md) -###[Use the ConnectionSettings .INS file to review the network connections for install](ie11-ieak/connectionsettings-ins-file-setting.md) -###[Use the CustomBranding .INS file to specify the custom branding location](ie11-ieak/custombranding-ins-file-setting.md) -###[Use the ExtRegInf .INS file to specify installation files and mode](ie11-ieak/extreginf-ins-file-setting.md) -###[Use the FavoritesEx .INS file for your Favorites icon and URLs](ie11-ieak/favoritesex-ins-file-setting.md) -###[Use the HideCustom .INS file to hide GUIDs](ie11-ieak/hidecustom-ins-file-setting.md) -###[Use the ISP_Security .INS file to add your root certificate](ie11-ieak/isp-security-ins-file-setting.md) -###[Use the Media .INS file to specify your install media](ie11-ieak/media-ins-file-setting.md) -###[Use the Proxy .INS file to specify a proxy server](ie11-ieak/proxy-ins-file-setting.md) -###[Use the Security Imports .INS file to import security info](ie11-ieak/security-imports-ins-file-setting.md) -###[Use the URL .INS file to use an auto-configured proxy server](ie11-ieak/url-ins-file-setting.md) +## [Using Internet Settings (.INS) files with IEAK 11](ie11-ieak/using-internet-settings-ins-files.md) +### [Use the Branding .INS file to create custom branding and setup info](ie11-ieak/branding-ins-file-setting.md) +### [Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar](ie11-ieak/browsertoolbars-ins-file-setting.md) +### [Use the CabSigning .INS file to review the digital signatures for your apps](ie11-ieak/cabsigning-ins-file-setting.md) +### [Use the ConnectionSettings .INS file to review the network connections for install](ie11-ieak/connectionsettings-ins-file-setting.md) +### [Use the CustomBranding .INS file to specify the custom branding location](ie11-ieak/custombranding-ins-file-setting.md) +### [Use the ExtRegInf .INS file to specify installation files and mode](ie11-ieak/extreginf-ins-file-setting.md) +### [Use the FavoritesEx .INS file for your Favorites icon and URLs](ie11-ieak/favoritesex-ins-file-setting.md) +### [Use the HideCustom .INS file to hide GUIDs](ie11-ieak/hidecustom-ins-file-setting.md) +### [Use the ISP_Security .INS file to add your root certificate](ie11-ieak/isp-security-ins-file-setting.md) +### [Use the Media .INS file to specify your install media](ie11-ieak/media-ins-file-setting.md) +### [Use the Proxy .INS file to specify a proxy server](ie11-ieak/proxy-ins-file-setting.md) +### [Use the Security Imports .INS file to import security info](ie11-ieak/security-imports-ins-file-setting.md) +### [Use the URL .INS file to use an auto-configured proxy server](ie11-ieak/url-ins-file-setting.md) -##[IExpress Wizard for Windows Server 2008 R2 with SP1](ie11-ieak/iexpress-wizard-for-win-server.md) -###[IExpress Wizard command-line options](ie11-ieak/iexpress-command-line-options.md) -###[Internet Explorer Setup command-line options and return codes](ie11-ieak/ie-setup-command-line-options-and-return-codes.md) +## [IExpress Wizard for Windows Server 2008 R2 with SP1](ie11-ieak/iexpress-wizard-for-win-server.md) +### [IExpress Wizard command-line options](ie11-ieak/iexpress-command-line-options.md) +### [Internet Explorer Setup command-line options and return codes](ie11-ieak/ie-setup-command-line-options-and-return-codes.md) diff --git a/browsers/internet-explorer/docfx.json b/browsers/internet-explorer/docfx.json index 153f4be5f1..934ad0e5f6 100644 --- a/browsers/internet-explorer/docfx.json +++ b/browsers/internet-explorer/docfx.json @@ -24,10 +24,11 @@ "globalMetadata": { "breadcrumb_path": "/internet-explorer/breadcrumb/toc.json", "ROBOTS": "INDEX, FOLLOW", - "ms.author": "shortpatti", - "author": "eross-msft", + "audience": "ITPro", "ms.technology": "internet-explorer", + "ms.prod": "ie11", "ms.topic": "article", + "manager": "laurawi", "ms.date": "04/05/2017", "feedback_system": "GitHub", "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md index a430073e9d..563f38160c 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md @@ -25,7 +25,7 @@ Before you install Internet Explorer 11, you should: - **Choose how you'll deploy your installation package.** Your deployment method should be based on whether you're installing to computers already running Windows, or if you're deploying IE11 as part of a Windows installation. - - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](https://www.microsoft.com/en-us/cloud-platform/microsoft-intune). + - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](https://www.microsoft.com/cloud-platform/microsoft-intune). - **As part of a Windows deployment.** Update your Windows images to include IE11, and then add the update to your MDT deployment share or to your Windows image. For instructions about how to create and use Windows images, see [Create and Manage a Windows Image Using DISM](https://go.microsoft.com/fwlink/p/?LinkId=299408). For general information about deploying IE, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148), [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669). diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md index aaabccc9ae..12049fdcb9 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md +++ b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md @@ -1,482 +1,483 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. -author: dansimp -ms.prod: ie11 -ms.assetid: a145e80f-eb62-4116-82c4-3cc35fd064b6 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: dansimp -title: Collect data using Enterprise Site Discovery -ms.sitesec: library -ms.date: 07/27/2017 ---- - -# Collect data using Enterprise Site Discovery - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 with Service Pack 1 (SP1) - -Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. This inventory information helps you build a list of websites used by your company so you can make more informed decisions about your IE deployments, including figuring out which sites might be at risk or require overhauls during future upgrades. - ->**Upgrade Readiness and Windows upgrades**
->You can use Upgrade Readiness to help manage your Windows 10 upgrades on devices running Windows 8.1 and Windows 7 (SP1). You can also use Upgrade Readiness to review several site discovery reports. For more information, see [Manage Windows upgrades with Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness). - - -## Before you begin -Before you start, you need to make sure you have the following: - -- Latest cumulative security update (for all supported versions of Internet Explorer): - - 1. Go to the [Microsoft Security Bulletin](https://go.microsoft.com/fwlink/p/?LinkID=718223) page, and change the filter to **Windows Internet Explorer 11**. - - ![microsoft security bulletin techcenter](images/securitybulletin-filter.png) - - 2. Click the title of the latest cumulative security update, and then scroll down to the **Affected software** table. - - ![affected software section](images/affectedsoftware.png) - - 3. Click the link that represents both your operating system version and Internet Explorer 11, and then follow the instructions in the **How to get this update** section. - -- [Setup and configuration package](https://go.microsoft.com/fwlink/p/?LinkId=517719), including: - - - Configuration-related PowerShell scripts - - - IETelemetry.mof file - - - Sample System Center 2012 report templates - - You must use System Center 2012 R2 Configuration Manager or later for these samples to work. - -Both the PowerShell script and the Managed Object Format (.MOF) file need to be copied to the same location on the client device, before you run the scripts. - -## What data is collected? -Data is collected on the configuration characteristics of IE and the sites it browses, as shown here. - -|Data point |IE11 |IE10 |IE9 |IE8 |Description | -|------------------------|-----|-----|-----|-----|------------------------------------------------------------------------| -|URL | X | X | X | X |URL of the browsed site, including any parameters included in the URL. | -|Domain | X | X | X | X |Top-level domain of the browsed site. | -|ActiveX GUID | X | X | X | X |GUID of the ActiveX controls loaded by the site. | -|Document mode | X | X | X | X |Document mode used by IE for a site, based on page characteristics. | -|Document mode reason | X | X | | |The reason why a document mode was set by IE. | -|Browser state reason | X | X | | |Additional information about why the browser is in its current state. Also called, browser mode. | -|Hang count | X | X | X | X |Number of visits to the URL when the browser hung. | -|Crash count | X | X | X | X |Number of visits to the URL when the browser crashed. | -|Most recent navigation failure (and count) | X | X | X | X |Description of the most recent navigation failure (like, a 404 bad request or 500 internal server error) and the number of times it happened. | -|Number of visits | X | X | X | X |Number of times a site has been visited. | -|Zone | X | X | X | X |Zone used by IE to browse sites, based on browser settings. | - - ->**Important**
By default, IE doesn’t collect this data; you have to turn this feature on if you want to use it. After you turn on this feature, data is collected on all sites visited by IE, except during InPrivate sessions. Additionally, the data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements. - -### Understanding the returned reason codes -The following tables provide more info about the Document mode reason, Browser state reason, and the Zone codes that are returned as part of your data collection. - -#### DocMode reason -The codes in this table can tell you what document mode was set by IE for a webpage.
These codes only apply to Internet Explorer 10 and Internet Explorer 11. - -|Code |Description | -|-----|------------| -|3 |Page state is set by the `FEATURE_DOCUMENT_COMPATIBLE_MODE` feature control key.| -|4 |Page is using an X-UA-compatible meta tag. | -|5 |Page is using an X-UA-compatible HTTP header. | -|6 |Page appears on an active **Compatibility View** list. | -|7 |Page is using native XML parsing. | -|8 |Page is using a special Quirks Mode Emulation (QME) mode that uses the modern layout engine, but the quirks behavior of Internet Explorer 5. | -|9 |Page state is set by the browser mode and the page's DOCTYPE.| - -#### Browser state reason -The codes in this table can tell you why the browser is in its current state. Also called “browser mode”.
These codes only apply to Internet Explorer 10 and Internet Explorer 11. - -|Code |Description | -|-----|------------| -|1 |Site is on the intranet, with the **Display intranet sites in Compatibility View** box checked. | -|2 |Site appears on an active **Compatibility View** list, created in Group Policy. | -|3 |Site appears on an active **Compatibility View** list, created by the user. | -|4 |Page is using an X-UA-compatible tag. | -|5 |Page state is set by the **Developer** toolbar. | -|6 |Page state is set by the `FEATURE_BROWSER_EMULATION` feature control key. | -|7 |Site appears on the Microsoft **Compatibility View (CV)** list. | -|8 |Site appears on the **Quirks** list, created in Group Policy. | -|11 |Site is using the default browser. | - -#### Zone -The codes in this table can tell you what zone is being used by IE to browse sites, based on browser settings.
These codes apply to Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11. - -|Code |Description | -|-----|------------| -|-1 |Internet Explorer is using an invalid zone. | -|0 |Internet Explorer is using the Local machine zone. | -|1 |Internet Explorer is using the Local intranet zone. | -|2 |Internet Explorer is using the Trusted sites zone. | -|3 |Internet Explorer is using the Internet zone. | -|4 |Internet Explorer is using the Restricted sites zone. | - -## Where is the data stored and how do I collect it? -The data is stored locally, in an industry-standard WMI class, .MOF file or in an XML file, depending on your configuration. This file remains on the client computer until it’s collected. To collect the files, we recommend: - -- **WMI file**. Use Microsoft Configuration Manager or any agent that can read the contents of a WMI class on your computer. - -- **XML file**. Any agent that works with XML can be used. - -## WMI Site Discovery suggestions -We recommend that you collect your data for at most a month at a time, to capture a user’s typical workflow. We don’t recommend collecting data longer than that because the data is stored in a WMI provider and can fill up your computer’s hard drive. You may also want to collect data only for pilot users or a representative sample of people, instead of turning this feature on for everyone in your company. - -On average, a website generates about 250bytes of data for each visit, causing only a minor impact to Internet Explorer’s performance. Over the course of a month, collecting data from 20 sites per day from 1,000 users, you’ll get about 150MB of data:

250 bytes (per site visit) X 20 sites/day X 30 days = (approximately) 150KB X 1000 users = (approximately) 150MB - ->**Important**
The data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements. - -## Getting ready to use Enterprise Site Discovery -Before you can start to collect your data, you must run the provided PowerShell script (IETelemetrySetUp.ps1) on your client devices to start generating the site discovery data and to set up a place to store this data locally. Then, you must start collecting the site discovery data from the client devices, using one of these three options: - -- Collect your hardware inventory using the MOF Editor, while connecting to a client device.

--OR- -- Collect your hardware inventory using the MOF Editor with a .MOF import file.

--OR- -- Collect your hardware inventory using the SMS\DEF.MOF file (System Center Configuration Manager 2007 only) - -### WMI only: Running the PowerShell script to compile the .MOF file and to update security privileges -You need to set up your computers for data collection by running the provided PowerShell script (IETelemetrySetUp.ps1) to compile the .mof file and to update security privileges for the new WMI classes. - ->**Important**
You must run this script if you’re using WMI as your data output. It's not necessary if you're using XML as your data output. - -**To set up Enterprise Site Discovery** - -- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1 by by-passing the PowerShell execution policy, using this command: `powershell -ExecutionPolicy Bypass .\IETelemetrySetUp.ps1`. For more info, see [about Execution Policies](https://go.microsoft.com/fwlink/p/?linkid=517460). - -### WMI only: Set up your firewall for WMI data -If you choose to use WMI as your data output, you need to make sure that your WMI data can travel through your firewall for the domain. If you’re sure, you can skip this section; otherwise, follow these steps: - -**To set up your firewall** - -1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. - -2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. - -3. Restart your computer to start collecting your WMI data. - -## Use PowerShell to finish setting up Enterprise Site Discovery -You can determine which zones or domains are used for data collection, using PowerShell. If you don’t want to use PowerShell, you can do this using Group Policy. For more info, see [Use Group Policy to finish setting up Enterprise Site Discovery](#use-group-policy-to-finish-setting-up-enterprise-site-discovery). - ->**Important**
The .ps1 file updates turn on Enterprise Site Discovery and WMI collection for all users on a device. - -- **Domain allow list.** If you have a domain allow list, a comma-separated list of domains that should have this feature turned on, you should use this process. - -- **Zone allow list.** If you have a zone allow list, a comma-separated list of zones that should have this feature turned on, you should use this process. - -**To set up data collection using a domain allow list** - - - Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -SiteAllowList sharepoint.com,outlook.com,onedrive.com`. - - >**Important**
Wildcards, like \*.microsoft.com, aren’t supported. - -**To set up data collection using a zone allow list** - - - Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -ZoneAllowList Computer,Intranet,TrustedSites,Internet,RestrictedSites`. - - >**Important**
Only Computer, Intranet, TrustedSites, Internet, and RestrictedSites are supported. - -## Use Group Policy to finish setting up Enterprise Site Discovery -You can use Group Policy to finish setting up Enterprise Site Discovery. If you don’t want to use Group Policy, you can do this using PowerShell. For more info, see [Use Powershell to finish setting up Enterprise Site Discovery](#use-powershell-to-finish-setting-up-enterprise-site-discovery). - ->**Note**
 All of the Group Policy settings can be used individually or as a group. - - **To set up Enterprise Site Discovery using Group Policy** - -- Open your Group Policy editor, and go to these new settings: - - |Setting name and location |Description |Options | - |---------------------------|-------------|---------| - |Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery WMI output |Writes collected data to a WMI class, which can be aggregated using a client-management solution like Configuration Manager. |

| - |Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery XML output |Writes collected data to an XML file, which is stored in your specified location. | | - |Administrative Templates\Windows Components\Internet Explorer\Limit Site Discovery output by Zone |Manages which zone can collect data. |To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:

0 – Restricted Sites zone
0 – Internet zone
0 – Trusted Sites zone
0 – Local Intranet zone
0 – Local Machine zone

**Example 1:** Include only the Local Intranet zone

Binary representation: *00010*, based on:

0 – Restricted Sites zone
0 – Internet zone
0 – Trusted Sites zone
1 – Local Intranet zone
0 – Local Machine zone

**Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones

Binary representation: *10110*, based on:

1 – Restricted Sites zone
0 – Internet zone
1 – Trusted Sites zone
1 – Local Intranet zone
1 – Local Machine zone | - |Administrative Templates\Windows Components\Internet Explorer\Limit Site Discovery output by domain |Manages which domains can collect data |To specify which domains can collect data, you must include your selected domains, one domain per line, in the provided box. It should look like:

microsoft.sharepoint.com
outlook.com
onedrive.com
timecard.contoso.com
LOBApp.contoso.com | - -### Combining WMI and XML Group Policy settings -You can use both the WMI and XML settings individually or together: - -**To turn off Enterprise Site Discovery** - - - - - - - - - - - - - -
Setting nameOption
Turn on Site Discovery WMI outputOff
Turn on Site Discovery XML outputBlank
- -**Turn on WMI recording only** - - - - - - - - - - - - - -
Setting nameOption
Turn on Site Discovery WMI outputOn
Turn on Site Discovery XML outputBlank
- -**To turn on XML recording only** - - - - - - - - - - - - - -
Setting nameOption
Turn on Site Discovery WMI outputOff
Turn on Site Discovery XML outputXML file path
- -To turn on both WMI and XML recording - - - - - - - - - - - - - -
Setting nameOption
Turn on Site Discovery WMI outputOn
Turn on Site Discovery XML outputXML file path
- -## Use Configuration Manager to collect your data -After you’ve collected your data, you’ll need to get the local files off of your employee’s computers. To do this, use the hardware inventory process in Configuration Manager, using one of these options: - -- Collect your hardware inventory using the MOF Editor, while connecting to a client device.

--OR- -- Collect your hardware inventory using the MOF Editor with a .MOF import file.

--OR- -- Collect your hardware inventory using the SMS\DEF.MOF file (System Center Configuration Manager 2007 only) - -### Collect your hardware inventory using the MOF Editor while connected to a client device -You can collect your hardware inventory using the MOF Editor, while you’re connected to your client devices. - - **To collect your inventory** - -1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. - - ![Configuration Manager, showing the hardware inventory settings for client computers](images/configmgrhardwareinventory.png) - -2. Click **Add**, click **Connect**, and connect to a computer that has completed the setup process and has already existing classes. - -3. Change the **WMI Namespace** to `root\cimv2\IETelemetry`, and click **Connect**. - - ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box](images/ie11-inventory-addclassconnectscreen.png) - -4. Select the check boxes next to the following classes, and then click **OK**: - - - IESystemInfo - - - IEURLInfo - - - IECountInfo - -5. Click **OK** to close the default windows.
-Your environment is now ready to collect your hardware inventory and review the sample reports. - -### Collect your hardware inventory using the MOF Editor with a .MOF import file -You can collect your hardware inventory using the MOF Editor and a .MOF import file. - - **To collect your inventory** - -1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. - -2. Click **Import**, choose the MOF file from the downloaded package we provided, and click **Open**. - -3. Pick the inventory items to install, and then click **Import**. - -4. Click **OK** to close the default windows.
-Your environment is now ready to collect your hardware inventory and review the sample reports. - -### Collect your hardware inventory using the SMS\DEF.MOF file (System Center Configuration Manager 2007 only) -You can collect your hardware inventory using the using the Systems Management Server (SMS\DEF.MOF) file. Editing this file lets you collect your data for System Center Configuration Manager 2007. If you aren’t using this version of Configuration Manager, you won’t want to use this option. - -**To collect your inventory** - -1. Using a text editor like Notepad, open the SMS\DEF.MOF file, located in your `\inboxes\clifiles.src\hinv` directory. - -2. Add this text to the end of the file: - - ``` - [SMS_Report (TRUE), - SMS_Group_Name ("IESystemInfo"), - SMS_Class_ID ("MICROSOFT|IESystemInfo|1.0"), - Namespace ("root\\\\cimv2\\\\IETelemetry") ] - Class IESystemInfo: SMS_Class_Template - { - [SMS_Report (TRUE), Key ] - String SystemKey; - [SMS_Report (TRUE) ] - String IEVer; - }; - - [SMS_Report (TRUE), - SMS_Group_Name ("IEURLInfo"), - SMS_Class_ID ("MICROSOFT|IEURLInfo|1.0"), - Namespace ("root\\\\cimv2\\\\IETelemetry") ] - Class IEURLInfo: SMS_Class_Template - { - [SMS_Report (TRUE), Key ] - String URL; - [SMS_Report (TRUE) ] - String Domain; - [SMS_Report (TRUE) ] - UInt32 DocMode; - [SMS_Report (TRUE) ] - UInt32 DocModeReason; - [SMS_Report (TRUE) ] - UInt32 Zone; - [SMS_Report (TRUE) ] - UInt32 BrowserStateReason; - [SMS_Report (TRUE) ] - String ActiveXGUID[]; - [SMS_Report (TRUE) ] - UInt32 CrashCount; - [SMS_Report (TRUE) ] - UInt32 HangCount; - [SMS_Report (TRUE) ] - UInt32 NavigationFailureCount; - [SMS_Report (TRUE) ] - UInt32 NumberOfVisits; - [SMS_Report (TRUE) ] - UInt32 MostRecentNavigationFailure; - }; - - [SMS_Report (TRUE), - SMS_Group_Name ("IECountInfo"), - SMS_Class_ID ("MICROSOFT|IECountInfo|1.0"), - Namespace ("root\\\\cimv2\\\\IETelemetry") ] - Class IECountInfo: SMS_Class_Template - { - [SMS_Report (TRUE), Key ] - String CountKey; - [SMS_Report (TRUE) ] - UInt32 CrashCount; - [SMS_Report (TRUE) ] - UInt32 HangCount; - [SMS_Report (TRUE) ] - UInt32 NavigationFailureCount; - }; - ``` - -3. Save the file and close it to the same location. - Your environment is now ready to collect your hardware inventory and review the sample reports. - -## View the sample reports with your collected data -The sample reports, **SCCM Report Sample – ActiveX.rdl** and **SCCM Report Sample – Site Discovery.rdl**, work with System Center 2012, so you can review your collected data. - -### SCCM Report Sample – ActiveX.rdl -Gives you a list of all of the ActiveX-related sites visited by the client computer. - -![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer](images/configmgractivexreport.png) - -### SCCM Report Sample – Site Discovery.rdl -Gives you a list of all of the sites visited by the client computer. - -![Site Discovery.rdl report, lists all websites visited by the client computer](images/ie-site-discovery-sample-report.png) - -## View the collected XML data -After the XML files are created, you can use your own solutions to extract and parse the data. The data will look like: - -``` xml - - - [dword] - [dword] - [dword] - - - [string] - - [guid] - - [dword] - [dword] - [dword] - [dword] - [dword] - [dword] - [dword] - [dword] - [string] - [dword] - - … - … - -``` -You can import this XML data into the correct version of the Enterprise Mode Site List Manager, automatically adding the included sites to your Enterprise Mode site list. - -**To add your XML data to your Enterprise Mode site list** - -1. Open the Enterprise Mode Site List Manager, click **File**, and then click **Bulk add from file**. - - ![Enterprise Mode Site List Manager with Bulk add from file option](images/bulkadd-emiesitelistmgr.png) - -2. Go to your XML file to add the included sites to the tool, and then click **Open**.
Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). - -3. Click **OK** to close the **Bulk add sites to the list** menu. - -## Turn off data collection on your client devices -After you’ve collected your data, you’ll need to turn Enterprise Site Discovery off. - -**To stop collecting data, using PowerShell** - -- On your client computer, start Windows PowerShell in elevated mode (using admin privileges) and run `IETelemetrySetUp.ps1`, using this command: `powershell -ExecutionPolicy Bypass .\IETelemetrySetUp.ps1 –IEFeatureOff`. - - >**Note**
Turning off data collection only disables the Enterprise Site Discovery feature – all data already written to WMI stays on your employee’s computer. - - -**To stop collecting data, using Group Policy** - -1. Open your Group Policy editor, go to `Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery WMI output`, and click **Off**. - -2. Go to `Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery XML output`, and clear the file path location. - -### Delete already stored data from client computers -You can completely remove the data stored on your employee’s computers. - -**To delete all existing data** - -- On the client computer, start PowerShell in elevated mode (using admin privileges) and run these four commands: - - - `Remove-WmiObject -Namespace root/cimv2/IETelemetry IEURLInfo` - - - `Remove-WmiObject -Namespace root/cimv2/IETelemetry IESystemInfo` - - - `Remove-WmiObject -Namespace root/cimv2/IETelemetry IECountInfo` - - - `Remove-Item -Path 'HKCU:\Software\Microsoft\Internet Explorer\WMITelemetry'` - -## Related topics -* [Enterprise Mode Site List Manager (schema v.2) download](https://go.microsoft.com/fwlink/?LinkId=746562) -* [Enterprise Mode for Internet Explorer 11 (IE11)](enterprise-mode-overview-for-ie11.md) - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. +author: dansimp +ms.prod: ie11 +ms.assetid: a145e80f-eb62-4116-82c4-3cc35fd064b6 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +title: Collect data using Enterprise Site Discovery +ms.sitesec: library +ms.date: 07/27/2017 +--- + +# Collect data using Enterprise Site Discovery + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 with Service Pack 1 (SP1) + +Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. This inventory information helps you build a list of websites used by your company so you can make more informed decisions about your IE deployments, including figuring out which sites might be at risk or require overhauls during future upgrades. + +>**Upgrade Readiness and Windows upgrades**
+>You can use Upgrade Readiness to help manage your Windows 10 upgrades on devices running Windows 8.1 and Windows 7 (SP1). You can also use Upgrade Readiness to review several site discovery reports. For more information, see [Manage Windows upgrades with Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness). + + +## Before you begin +Before you start, you need to make sure you have the following: + +- Latest cumulative security update (for all supported versions of Internet Explorer): + + 1. Go to the [Microsoft Security Bulletin](https://go.microsoft.com/fwlink/p/?LinkID=718223) page, and change the filter to **Windows Internet Explorer 11**. + + ![microsoft security bulletin techcenter](images/securitybulletin-filter.png) + + 2. Click the title of the latest cumulative security update, and then scroll down to the **Affected software** table. + + ![affected software section](images/affectedsoftware.png) + + 3. Click the link that represents both your operating system version and Internet Explorer 11, and then follow the instructions in the **How to get this update** section. + +- [Setup and configuration package](https://go.microsoft.com/fwlink/p/?LinkId=517719), including: + + - Configuration-related PowerShell scripts + + - IETelemetry.mof file + + - Sample System Center 2012 report templates + + You must use System Center 2012 R2 Configuration Manager or later for these samples to work. + +Both the PowerShell script and the Managed Object Format (.MOF) file need to be copied to the same location on the client device, before you run the scripts. + +## What data is collected? +Data is collected on the configuration characteristics of IE and the sites it browses, as shown here. + +|Data point |IE11 |IE10 |IE9 |IE8 |Description | +|------------------------|-----|-----|-----|-----|------------------------------------------------------------------------| +|URL | X | X | X | X |URL of the browsed site, including any parameters included in the URL. | +|Domain | X | X | X | X |Top-level domain of the browsed site. | +|ActiveX GUID | X | X | X | X |GUID of the ActiveX controls loaded by the site. | +|Document mode | X | X | X | X |Document mode used by IE for a site, based on page characteristics. | +|Document mode reason | X | X | | |The reason why a document mode was set by IE. | +|Browser state reason | X | X | | |Additional information about why the browser is in its current state. Also called, browser mode. | +|Hang count | X | X | X | X |Number of visits to the URL when the browser hung. | +|Crash count | X | X | X | X |Number of visits to the URL when the browser crashed. | +|Most recent navigation failure (and count) | X | X | X | X |Description of the most recent navigation failure (like, a 404 bad request or 500 internal server error) and the number of times it happened. | +|Number of visits | X | X | X | X |Number of times a site has been visited. | +|Zone | X | X | X | X |Zone used by IE to browse sites, based on browser settings. | + + +>**Important**
By default, IE doesn’t collect this data; you have to turn this feature on if you want to use it. After you turn on this feature, data is collected on all sites visited by IE, except during InPrivate sessions. Additionally, the data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements. + +### Understanding the returned reason codes +The following tables provide more info about the Document mode reason, Browser state reason, and the Zone codes that are returned as part of your data collection. + +#### DocMode reason +The codes in this table can tell you what document mode was set by IE for a webpage.
These codes only apply to Internet Explorer 10 and Internet Explorer 11. + +|Code |Description | +|-----|------------| +|3 |Page state is set by the `FEATURE_DOCUMENT_COMPATIBLE_MODE` feature control key.| +|4 |Page is using an X-UA-compatible meta tag. | +|5 |Page is using an X-UA-compatible HTTP header. | +|6 |Page appears on an active **Compatibility View** list. | +|7 |Page is using native XML parsing. | +|8 |Page is using a special Quirks Mode Emulation (QME) mode that uses the modern layout engine, but the quirks behavior of Internet Explorer 5. | +|9 |Page state is set by the browser mode and the page's DOCTYPE.| + +#### Browser state reason +The codes in this table can tell you why the browser is in its current state. Also called “browser mode”.
These codes only apply to Internet Explorer 10 and Internet Explorer 11. + +|Code |Description | +|-----|------------| +|1 |Site is on the intranet, with the **Display intranet sites in Compatibility View** box checked. | +|2 |Site appears on an active **Compatibility View** list, created in Group Policy. | +|3 |Site appears on an active **Compatibility View** list, created by the user. | +|4 |Page is using an X-UA-compatible tag. | +|5 |Page state is set by the **Developer** toolbar. | +|6 |Page state is set by the `FEATURE_BROWSER_EMULATION` feature control key. | +|7 |Site appears on the Microsoft **Compatibility View (CV)** list. | +|8 |Site appears on the **Quirks** list, created in Group Policy. | +|11 |Site is using the default browser. | + +#### Zone +The codes in this table can tell you what zone is being used by IE to browse sites, based on browser settings.
These codes apply to Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11. + +|Code |Description | +|-----|------------| +|-1 |Internet Explorer is using an invalid zone. | +|0 |Internet Explorer is using the Local machine zone. | +|1 |Internet Explorer is using the Local intranet zone. | +|2 |Internet Explorer is using the Trusted sites zone. | +|3 |Internet Explorer is using the Internet zone. | +|4 |Internet Explorer is using the Restricted sites zone. | + +## Where is the data stored and how do I collect it? +The data is stored locally, in an industry-standard WMI class, .MOF file or in an XML file, depending on your configuration. This file remains on the client computer until it’s collected. To collect the files, we recommend: + +- **WMI file**. Use Microsoft Configuration Manager or any agent that can read the contents of a WMI class on your computer. + +- **XML file**. Any agent that works with XML can be used. + +## WMI Site Discovery suggestions +We recommend that you collect your data for at most a month at a time, to capture a user’s typical workflow. We don’t recommend collecting data longer than that because the data is stored in a WMI provider and can fill up your computer’s hard drive. You may also want to collect data only for pilot users or a representative sample of people, instead of turning this feature on for everyone in your company. + +On average, a website generates about 250bytes of data for each visit, causing only a minor impact to Internet Explorer’s performance. Over the course of a month, collecting data from 20 sites per day from 1,000 users, you’ll get about 150MB of data:

250 bytes (per site visit) X 20 sites/day X 30 days = (approximately) 150KB X 1000 users = (approximately) 150MB + +>**Important**
The data collection process is silent, so there’s no notification to the employee. Therefore, you must get consent from the employee before you start collecting info. You must also make sure that using this feature complies with all applicable local laws and regulatory requirements. + +## Getting ready to use Enterprise Site Discovery +Before you can start to collect your data, you must run the provided PowerShell script (IETelemetrySetUp.ps1) on your client devices to start generating the site discovery data and to set up a place to store this data locally. Then, you must start collecting the site discovery data from the client devices, using one of these three options: + +- Collect your hardware inventory using the MOF Editor, while connecting to a client device.

+-OR- +- Collect your hardware inventory using the MOF Editor with a .MOF import file.

+-OR- +- Collect your hardware inventory using the SMS\DEF.MOF file (System Center Configuration Manager 2007 only) + +### WMI only: Running the PowerShell script to compile the .MOF file and to update security privileges +You need to set up your computers for data collection by running the provided PowerShell script (IETelemetrySetUp.ps1) to compile the .mof file and to update security privileges for the new WMI classes. + +>**Important**
You must run this script if you’re using WMI as your data output. It's not necessary if you're using XML as your data output. + +**To set up Enterprise Site Discovery** + +- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1 by by-passing the PowerShell execution policy, using this command: `powershell -ExecutionPolicy Bypass .\IETelemetrySetUp.ps1`. For more info, see [about Execution Policies](https://go.microsoft.com/fwlink/p/?linkid=517460). + +### WMI only: Set up your firewall for WMI data +If you choose to use WMI as your data output, you need to make sure that your WMI data can travel through your firewall for the domain. If you’re sure, you can skip this section; otherwise, follow these steps: + +**To set up your firewall** + +1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. + +2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. + +3. Restart your computer to start collecting your WMI data. + +## Use PowerShell to finish setting up Enterprise Site Discovery +You can determine which zones or domains are used for data collection, using PowerShell. If you don’t want to use PowerShell, you can do this using Group Policy. For more info, see [Use Group Policy to finish setting up Enterprise Site Discovery](#use-group-policy-to-finish-setting-up-enterprise-site-discovery). + +>**Important**
The .ps1 file updates turn on Enterprise Site Discovery and WMI collection for all users on a device. + +- **Domain allow list.** If you have a domain allow list, a comma-separated list of domains that should have this feature turned on, you should use this process. + +- **Zone allow list.** If you have a zone allow list, a comma-separated list of zones that should have this feature turned on, you should use this process. + +**To set up data collection using a domain allow list** + +- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -SiteAllowList sharepoint.com,outlook.com,onedrive.com`. + + >**Important**
Wildcards, like \*.microsoft.com, aren’t supported. + +**To set up data collection using a zone allow list** + +- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -ZoneAllowList Computer,Intranet,TrustedSites,Internet,RestrictedSites`. + + >**Important**
Only Computer, Intranet, TrustedSites, Internet, and RestrictedSites are supported. + +## Use Group Policy to finish setting up Enterprise Site Discovery +You can use Group Policy to finish setting up Enterprise Site Discovery. If you don’t want to use Group Policy, you can do this using PowerShell. For more info, see [Use Powershell to finish setting up Enterprise Site Discovery](#use-powershell-to-finish-setting-up-enterprise-site-discovery). + +>**Note**
 All of the Group Policy settings can be used individually or as a group. + + **To set up Enterprise Site Discovery using Group Policy** + +- Open your Group Policy editor, and go to these new settings: + + |Setting name and location |Description |Options | + |---------------------------|-------------|---------| + |Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery WMI output |Writes collected data to a WMI class, which can be aggregated using a client-management solution like Configuration Manager. |

| + |Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery XML output |Writes collected data to an XML file, which is stored in your specified location. | | + |Administrative Templates\Windows Components\Internet Explorer\Limit Site Discovery output by Zone |Manages which zone can collect data. |To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:

0 – Restricted Sites zone
0 – Internet zone
0 – Trusted Sites zone
0 – Local Intranet zone
0 – Local Machine zone

**Example 1:** Include only the Local Intranet zone

Binary representation: *00010*, based on:

0 – Restricted Sites zone
0 – Internet zone
0 – Trusted Sites zone
1 – Local Intranet zone
0 – Local Machine zone

**Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones

Binary representation: *10110*, based on:

1 – Restricted Sites zone
0 – Internet zone
1 – Trusted Sites zone
1 – Local Intranet zone
1 – Local Machine zone | + |Administrative Templates\Windows Components\Internet Explorer\Limit Site Discovery output by domain |Manages which domains can collect data |To specify which domains can collect data, you must include your selected domains, one domain per line, in the provided box. It should look like:

microsoft.sharepoint.com
outlook.com
onedrive.com
timecard.contoso.com
LOBApp.contoso.com | + +### Combining WMI and XML Group Policy settings +You can use both the WMI and XML settings individually or together: + +**To turn off Enterprise Site Discovery** + + + + + + + + + + + + + +
Setting nameOption
Turn on Site Discovery WMI outputOff
Turn on Site Discovery XML outputBlank
+ +**Turn on WMI recording only** + + + + + + + + + + + + + +
Setting nameOption
Turn on Site Discovery WMI outputOn
Turn on Site Discovery XML outputBlank
+ +**To turn on XML recording only** + + + + + + + + + + + + + +
Setting nameOption
Turn on Site Discovery WMI outputOff
Turn on Site Discovery XML outputXML file path
+ +To turn on both WMI and XML recording + + + + + + + + + + + + + +
Setting nameOption
Turn on Site Discovery WMI outputOn
Turn on Site Discovery XML outputXML file path
+ +## Use Configuration Manager to collect your data +After you’ve collected your data, you’ll need to get the local files off of your employee’s computers. To do this, use the hardware inventory process in Configuration Manager, using one of these options: + +- Collect your hardware inventory using the MOF Editor, while connecting to a client device.

+-OR- +- Collect your hardware inventory using the MOF Editor with a .MOF import file.

+-OR- +- Collect your hardware inventory using the SMS\DEF.MOF file (System Center Configuration Manager 2007 only) + +### Collect your hardware inventory using the MOF Editor while connected to a client device +You can collect your hardware inventory using the MOF Editor, while you’re connected to your client devices. + + **To collect your inventory** + +1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. + + ![Configuration Manager, showing the hardware inventory settings for client computers](images/configmgrhardwareinventory.png) + +2. Click **Add**, click **Connect**, and connect to a computer that has completed the setup process and has already existing classes. + +3. Change the **WMI Namespace** to `root\cimv2\IETelemetry`, and click **Connect**. + + ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box](images/ie11-inventory-addclassconnectscreen.png) + +4. Select the check boxes next to the following classes, and then click **OK**: + + - IESystemInfo + + - IEURLInfo + + - IECountInfo + +5. Click **OK** to close the default windows.
+Your environment is now ready to collect your hardware inventory and review the sample reports. + +### Collect your hardware inventory using the MOF Editor with a .MOF import file +You can collect your hardware inventory using the MOF Editor and a .MOF import file. + + **To collect your inventory** + +1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. + +2. Click **Import**, choose the MOF file from the downloaded package we provided, and click **Open**. + +3. Pick the inventory items to install, and then click **Import**. + +4. Click **OK** to close the default windows.
+Your environment is now ready to collect your hardware inventory and review the sample reports. + +### Collect your hardware inventory using the SMS\DEF.MOF file (System Center Configuration Manager 2007 only) +You can collect your hardware inventory using the using the Systems Management Server (SMS\DEF.MOF) file. Editing this file lets you collect your data for System Center Configuration Manager 2007. If you aren’t using this version of Configuration Manager, you won’t want to use this option. + +**To collect your inventory** + +1. Using a text editor like Notepad, open the SMS\DEF.MOF file, located in your `\inboxes\clifiles.src\hinv` directory. + +2. Add this text to the end of the file: + + ``` + [SMS_Report (TRUE), + SMS_Group_Name ("IESystemInfo"), + SMS_Class_ID ("MICROSOFT|IESystemInfo|1.0"), + Namespace ("root\\\\cimv2\\\\IETelemetry") ] + Class IESystemInfo: SMS_Class_Template + { + [SMS_Report (TRUE), Key ] + String SystemKey; + [SMS_Report (TRUE) ] + String IEVer; + }; + + [SMS_Report (TRUE), + SMS_Group_Name ("IEURLInfo"), + SMS_Class_ID ("MICROSOFT|IEURLInfo|1.0"), + Namespace ("root\\\\cimv2\\\\IETelemetry") ] + Class IEURLInfo: SMS_Class_Template + { + [SMS_Report (TRUE), Key ] + String URL; + [SMS_Report (TRUE) ] + String Domain; + [SMS_Report (TRUE) ] + UInt32 DocMode; + [SMS_Report (TRUE) ] + UInt32 DocModeReason; + [SMS_Report (TRUE) ] + UInt32 Zone; + [SMS_Report (TRUE) ] + UInt32 BrowserStateReason; + [SMS_Report (TRUE) ] + String ActiveXGUID[]; + [SMS_Report (TRUE) ] + UInt32 CrashCount; + [SMS_Report (TRUE) ] + UInt32 HangCount; + [SMS_Report (TRUE) ] + UInt32 NavigationFailureCount; + [SMS_Report (TRUE) ] + UInt32 NumberOfVisits; + [SMS_Report (TRUE) ] + UInt32 MostRecentNavigationFailure; + }; + + [SMS_Report (TRUE), + SMS_Group_Name ("IECountInfo"), + SMS_Class_ID ("MICROSOFT|IECountInfo|1.0"), + Namespace ("root\\\\cimv2\\\\IETelemetry") ] + Class IECountInfo: SMS_Class_Template + { + [SMS_Report (TRUE), Key ] + String CountKey; + [SMS_Report (TRUE) ] + UInt32 CrashCount; + [SMS_Report (TRUE) ] + UInt32 HangCount; + [SMS_Report (TRUE) ] + UInt32 NavigationFailureCount; + }; + ``` + +3. Save the file and close it to the same location. + Your environment is now ready to collect your hardware inventory and review the sample reports. + +## View the sample reports with your collected data +The sample reports, **SCCM Report Sample – ActiveX.rdl** and **SCCM Report Sample – Site Discovery.rdl**, work with System Center 2012, so you can review your collected data. + +### SCCM Report Sample – ActiveX.rdl +Gives you a list of all of the ActiveX-related sites visited by the client computer. + +![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer](images/configmgractivexreport.png) + +### SCCM Report Sample – Site Discovery.rdl +Gives you a list of all of the sites visited by the client computer. + +![Site Discovery.rdl report, lists all websites visited by the client computer](images/ie-site-discovery-sample-report.png) + +## View the collected XML data +After the XML files are created, you can use your own solutions to extract and parse the data. The data will look like: + +``` xml + + + [dword] + [dword] + [dword] + + + [string] + + [guid] + + [dword] + [dword] + [dword] + [dword] + [dword] + [dword] + [dword] + [dword] + [string] + [dword] + + … + … + +``` +You can import this XML data into the correct version of the Enterprise Mode Site List Manager, automatically adding the included sites to your Enterprise Mode site list. + +**To add your XML data to your Enterprise Mode site list** + +1. Open the Enterprise Mode Site List Manager, click **File**, and then click **Bulk add from file**. + + ![Enterprise Mode Site List Manager with Bulk add from file option](images/bulkadd-emiesitelistmgr.png) + +2. Go to your XML file to add the included sites to the tool, and then click **Open**.
Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). + +3. Click **OK** to close the **Bulk add sites to the list** menu. + +## Turn off data collection on your client devices +After you’ve collected your data, you’ll need to turn Enterprise Site Discovery off. + +**To stop collecting data, using PowerShell** + +- On your client computer, start Windows PowerShell in elevated mode (using admin privileges) and run `IETelemetrySetUp.ps1`, using this command: `powershell -ExecutionPolicy Bypass .\IETelemetrySetUp.ps1 –IEFeatureOff`. + + >**Note**
Turning off data collection only disables the Enterprise Site Discovery feature – all data already written to WMI stays on your employee’s computer. + + +**To stop collecting data, using Group Policy** + +1. Open your Group Policy editor, go to `Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery WMI output`, and click **Off**. + +2. Go to `Administrative Templates\Windows Components\Internet Explorer\Turn on Site Discovery XML output`, and clear the file path location. + +### Delete already stored data from client computers +You can completely remove the data stored on your employee’s computers. + +**To delete all existing data** + +- On the client computer, start PowerShell in elevated mode (using admin privileges) and run these four commands: + + - `Remove-WmiObject -Namespace root/cimv2/IETelemetry IEURLInfo` + + - `Remove-WmiObject -Namespace root/cimv2/IETelemetry IESystemInfo` + + - `Remove-WmiObject -Namespace root/cimv2/IETelemetry IECountInfo` + + - `Remove-Item -Path 'HKCU:\Software\Microsoft\Internet Explorer\WMITelemetry'` + +## Related topics +* [Enterprise Mode Site List Manager (schema v.2) download](https://go.microsoft.com/fwlink/?LinkId=746562) +* [Enterprise Mode for Internet Explorer 11 (IE11)](enterprise-mode-overview-for-ie11.md) + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md index 3e8e129b3d..292c85b771 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md @@ -30,10 +30,10 @@ If you don't want to use the Enterprise Mode Site List Manager, you also have th ## Enterprise Mode schema v.1 example The following is an example of the Enterprise Mode schema v.1. This schema can run on devices running Windows 7 and Windows 8.1. -**Important**
-Make sure that you don't specify a protocol when adding your URLs. Using a URL like `contoso.com` automatically applies to both https://contoso.com and https://contoso.com. +> [!IMPORTANT] +> Make sure that you don't specify a protocol when adding your URLs. Using a URL like `contoso.com` automatically applies to both http://contoso.com and https://contoso.com. -``` xml +```xml www.cpandl.com @@ -206,7 +206,7 @@ For example, say you want all of the sites in the contoso.com domain to open usi ### What not to include in your schema We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways: -- Don’t use protocols. For example, `https://`, `https://`, or custom protocols. They break parsing. +- Don’t use protocols. For example, `http://`, `https://`, or custom protocols. They break parsing. - Don’t use wildcards. - Don’t use query strings, ampersands break parsing. @@ -217,7 +217,7 @@ You can use trailing slashes at the path-level, but not at the domain-level: **Example** -``` xml +```xml contoso.com /about/ diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md index f561f79cfd..66a056c506 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md @@ -1,301 +1,298 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 10. -author: lomayor -ms.prod: ie11 -ms.assetid: 909ca359-5654-4df9-b9fb-921232fc05f5 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Enterprise Mode schema v.2 guidance (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 12/04/2017 ---- - - -# Enterprise Mode schema v.2 guidance - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 - -Use the Enterprise Mode Site List Manager to create and update your site list for devices running Windows 7, Windows 8.1, and Windows 10, using the version 2.0 (v.2) of the Enterprise Mode schema. If you don't want to use the Enterprise Mode Site List Manager, you also have the option to update your XML schema using Notepad, or any other XML-editing app. - -**Important**
-If you're running Windows 7 or Windows 8.1 and you've been using the version 1.0 (v.1) of the schema, you can continue to do so, but you won't get the benefits that come with the updated schema. For info about the v.1 schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -## Enterprise Mode schema v.2 updates -Because of the schema changes, you can't combine the old version (v.1) with the new version (v.2) of the schema. If you look at your XML file, you can tell which version you're using by: - -- <rules>. If your schema root node includes this key, you're using the v.1 version of the schema. - -- <site-list>. If your schema root node includes this key, you're using the v.2 version of the schema. - -You can continue to use the v.1 version of the schema on Windows 10, but you won't have the benefits of the new v.2 version schema updates and new features. Additionally, saving the v.1 version of the schema in the new Enterprise Mode Site List Manager (schema v.2) automatically updates the file to use the v.2 version of the schema. - -### Enterprise Mode v.2 schema example -The following is an example of the v.2 version of the Enterprise Mode schema. - -**Important**
-Make sure that you don't specify a protocol when adding your URLs. Using a URL like ``, automatically applies to both https://contoso.com and https://contoso.com. - -``` xml - - - - EnterpriseSitelistManager - 10240 - 20150728.135021 - - - - IE8Enterprise - MSEdge - - - default - IE11 - - - IE7Enterprise - IE11 - - - default - IE11 - - - default - none - - IE8Enterprise" - - - IE7 - IE11 - - - IE8Enterprise - IE11 - - - IE7 - IE11 - - -``` - -### Updated schema elements -This table includes the elements used by the v.2 version of the Enterprise Mode schema. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ElementDescriptionSupported browser
<site-list>A new root node with this text is using the updated v.2 version of the schema. It replaces <rules>. -

Example -

-<site-list version="205">
-  <site url="contoso.com">
-    <compat-mode>IE8Enterprise</compat-mode>
-    <open-in>IE11</open-in>
-  </site>
-</site-list>
Internet Explorer 11 and Microsoft Edge
<site>A unique entry added for each site you want to put on the Enterprise Mode site list. The first <site> element will overrule any additional <site> elements that use the same value for the <url> element. -

Example -

-<site url="contoso.com">
-  <compat-mode>default</compat-mode>
-  <open-in>none</open-in>
-</site>
--or- -

For IPv4 ranges:

<site url="10.122.34.99:8080">
-  <compat-mode>IE8Enterprise</compat-mode>
-<site>

--or- -

For IPv6 ranges:

<site url="[10.122.34.99]:8080">
-  <compat-mode>IE8Enterprise</compat-mode>
-<site>

-You can also use the self-closing version, <url="contoso.com" />, which also sets: -

    -
  • <compat-mode>default</compat-mode>
    • -
  • <open-in>none</open-in>
    • -
Internet Explorer 11 and Microsoft Edge
<compat-mode>A child element that controls what compatibility setting is used for specific sites or domains. This element is only supported in IE11. -

Example -

-<site url="contoso.com">
-  <compat-mode>IE8Enterprise</compat-mode>
-</site>
--or- -

For IPv4 ranges:

<site url="10.122.34.99:8080">
-  <compat-mode>IE8Enterprise</compat-mode>
-<site>

--or- -

For IPv6 ranges:

<site url="[10.122.34.99]:8080">
-  <compat-mode>IE8Enterprise</compat-mode>
-<site>

-Where: -

    -
  • IE8Enterprise. Loads the site in IE8 Enterprise Mode.
    This element is required for sites included in the EmIE section of the v.1 schema and is needed to load in IE8 Enterprise Mode.

    • -

  • IE7Enterprise. Loads the site in IE7 Enterprise Mode.
    This element is required for sites included in the EmIE section of the v.1 schema and is needed to load in IE7 Enterprise Mode.

    Important
    This tag replaces the combination of the "forceCompatView"="true" attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.

    • -

  • IE[x]. Where [x] is the document mode number into which the site loads.

    • -

  • Default or not specified. Loads the site using the default compatibility mode for the page. In this situation, X-UA-compatible meta tags or HTTP headers are honored.
    • -
Internet Explorer 11
<open-in>A child element that controls what browser is used for sites. This element supports the Open in IE11 or Open in Microsoft Edge experiences, for devices running Windows 10. -

Example -

-<site url="contoso.com">
-  <open-in>none</open-in>
-</site>

-Where: -

    -
  • IE11. Opens the site in IE11, regardless of which browser is opened by the employee.

    • -

  • MSEdge. Opens the site in Microsoft Edge, regardless of which browser is opened by the employee.

    • -

  • None or not specified. Opens in whatever browser the employee chooses.
    • -
Internet Explorer 11 and Microsoft Edge
- -### Updated schema attributes -The <url> attribute, as part of the <site> element in the v.2 version of the schema, replaces the <domain> element from the v.1 version of the schema. - - - - - - - - - - - - - - - - - - - - - - - - - -
AttributeDescriptionSupported browser
allow-redirectA boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser). -

Example -

-<site url="contoso.com/travel">
-  <open-in allow-redirect="true">IE11</open-in>
-</site>
-In this example, if https://contoso.com/travel is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer.		Internet Explorer 11 and Microsoft Edge
versionSpecifies the version of the Enterprise Mode Site List. This attribute is supported for the <site-list> element.Internet Explorer 11 and Microsoft Edge
urlSpecifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL. -
Note
-Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both https://contoso.com and https://contoso.com. -

Example -

-<site url="contoso.com:8080">
-  <compat-mode>IE8Enterprise</compat-mode>
-  <open-in>IE11</open-in>
-</site>
-In this example, going to https://contoso.com:8080 using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode.		Internet Explorer 11 and Microsoft Edge
- -### Deprecated attributes -These v.1 version schema attributes have been deprecated in the v.2 version of the schema: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Deprecated attributeNew attributeReplacement example
<forceCompatView><compat-mode>Replace <forceCompatView="true"> with <compat-mode>IE7Enterprise</compat-mode>
<docMode><compat-mode>Replace <docMode="IE5"> with <compat-mode>IE5</compat-mode>
<doNotTransition><open-in>Replace <doNotTransition="true"> with <open-in>none</open-in>
<domain> and <path><site>Replace: -
-<emie>
-  <domain exclude="false">contoso.com</domain>
-</emie>
-With: -
-<site url="contoso.com"/>
-  <compat-mode>IE8Enterprise</compat-mode>
-</site>
--AND-

-Replace: -

-<emie>
-  <domain exclude="true">contoso.com
-     <path exclude="false" forceCompatView="true">/about</path>
-  </domain>
-</emie>
-With: -
-<site url="contoso.com/about">
-  <compat-mode>IE7Enterprise</compat-mode>
-</site>
- -While the old, replaced attributes aren't supported in the v.2 version of the schema, they'll continue to work in the v.1 version of the schema. If, however, you're using the v.2 version of the schema and these attributes are still there, the v.2 version schema takes precedence. We don’t recommend combining the two schemas, and instead recommend that you move to the v.2 version of the schema to take advantage of the new features. - -**Important**
-Saving your v.1 version of the file using the new Enterprise Mode Site List Manager (schema v.2) automatically updates the XML to the new v.2 version of the schema. - -### What not to include in your schema -We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways: - -- Don’t use protocols. For example, https://, https://, or custom protocols. They break parsing. -- Don’t use wildcards. -- Don’t use query strings, ampersands break parsing. - -## Related topics -- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 10. +author: lomayor +ms.prod: ie11 +ms.assetid: 909ca359-5654-4df9-b9fb-921232fc05f5 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: lomayor +title: Enterprise Mode schema v.2 guidance (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 12/04/2017 +--- + + +# Enterprise Mode schema v.2 guidance + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 + +Use the Enterprise Mode Site List Manager to create and update your site list for devices running Windows 7, Windows 8.1, and Windows 10, using the version 2.0 (v.2) of the Enterprise Mode schema. If you don't want to use the Enterprise Mode Site List Manager, you also have the option to update your XML schema using Notepad, or any other XML-editing app. + +> [!IMPORTANT] +> If you're running Windows 7 or Windows 8.1 and you've been using the version 1.0 (v.1) of the schema, you can continue to do so, but you won't get the benefits that come with the updated schema. For info about the v.1 schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). + +## Enterprise Mode schema v.2 updates +Because of the schema changes, you can't combine the old version (v.1) with the new version (v.2) of the schema. If you look at your XML file, you can tell which version you're using by: + +- <rules>. If your schema root node includes this key, you're using the v.1 version of the schema. + +- <site-list>. If your schema root node includes this key, you're using the v.2 version of the schema. + +You can continue to use the v.1 version of the schema on Windows 10, but you won't have the benefits of the new v.2 version schema updates and new features. Additionally, saving the v.1 version of the schema in the new Enterprise Mode Site List Manager (schema v.2) automatically updates the file to use the v.2 version of the schema. + +### Enterprise Mode v.2 schema example +The following is an example of the v.2 version of the Enterprise Mode schema. + +> [!IMPORTANT] +> Make sure that you don't specify a protocol when adding your URLs. Using a URL like ``, automatically applies to both http://contoso.com and https://contoso.com. + +```xml + + + + EnterpriseSitelistManager + 10240 + 20150728.135021 + + + + IE8Enterprise + MSEdge + + + default + IE11 + + + IE7Enterprise + IE11 + + + default + IE11 + + + default + none + + IE8Enterprise" + + + IE7 + IE11 + + + IE8Enterprise + IE11 + + + IE7 + IE11 + + +``` + +### Updated schema elements +This table includes the elements used by the v.2 version of the Enterprise Mode schema. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ElementDescriptionSupported browser
<site-list>A new root node with this text is using the updated v.2 version of the schema. It replaces <rules>. +

Example +

+<site-list version="205">
+  <site url="contoso.com">
+    <compat-mode>IE8Enterprise</compat-mode>
+    <open-in>IE11</open-in>
+  </site>
+</site-list>
Internet Explorer 11 and Microsoft Edge
<site>A unique entry added for each site you want to put on the Enterprise Mode site list. The first <site> element will overrule any additional <site> elements that use the same value for the <url> element. +

Example +

+<site url="contoso.com">
+  <compat-mode>default</compat-mode>
+  <open-in>none</open-in>
+</site>
+-or- +

For IPv4 ranges:

<site url="10.122.34.99:8080">
+  <compat-mode>IE8Enterprise</compat-mode>
+<site>

+-or- +

For IPv6 ranges:

<site url="[10.122.34.99]:8080">
+  <compat-mode>IE8Enterprise</compat-mode>
+<site>

+You can also use the self-closing version, <url="contoso.com" />, which also sets: +

    +
  • <compat-mode>default</compat-mode>
    • +
  • <open-in>none</open-in>
    • +
Internet Explorer 11 and Microsoft Edge
<compat-mode>A child element that controls what compatibility setting is used for specific sites or domains. This element is only supported in IE11. +

Example +

+<site url="contoso.com">
+  <compat-mode>IE8Enterprise</compat-mode>
+</site>
+-or- +

For IPv4 ranges:

<site url="10.122.34.99:8080">
+  <compat-mode>IE8Enterprise</compat-mode>
+<site>

+-or- +

For IPv6 ranges:

<site url="[10.122.34.99]:8080">
+  <compat-mode>IE8Enterprise</compat-mode>
+<site>

+Where: +

    +
  • IE8Enterprise. Loads the site in IE8 Enterprise Mode.
    This element is required for sites included in the EmIE section of the v.1 schema and is needed to load in IE8 Enterprise Mode.

    • +

  • IE7Enterprise. Loads the site in IE7 Enterprise Mode.
    This element is required for sites included in the EmIE section of the v.1 schema and is needed to load in IE7 Enterprise Mode.

    Important
    This tag replaces the combination of the "forceCompatView"="true" attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.

    • +

  • IE[x]. Where [x] is the document mode number into which the site loads.

    • +

  • Default or not specified. Loads the site using the default compatibility mode for the page. In this situation, X-UA-compatible meta tags or HTTP headers are honored.
    • +
Internet Explorer 11
<open-in>A child element that controls what browser is used for sites. This element supports the Open in IE11 or Open in Microsoft Edge experiences, for devices running Windows 10. +

Example +

+<site url="contoso.com">
+  <open-in>none</open-in>
+</site>

+Where: +

    +
  • IE11. Opens the site in IE11, regardless of which browser is opened by the employee.

    • +

  • MSEdge. Opens the site in Microsoft Edge, regardless of which browser is opened by the employee.

    • +

  • None or not specified. Opens in whatever browser the employee chooses.
    • +
Internet Explorer 11 and Microsoft Edge
+ +### Updated schema attributes +The <url> attribute, as part of the <site> element in the v.2 version of the schema, replaces the <domain> element from the v.1 version of the schema. + + + + + + + + + + + + + + + + + + + + + + + + + +
AttributeDescriptionSupported browser
allow-redirectA boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser). +

Example +

+<site url="contoso.com/travel">
+  <open-in allow-redirect="true">IE11</open-in>
+</site>
+In this example, if https://contoso.com/travel is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer.		Internet Explorer 11 and Microsoft Edge
versionSpecifies the version of the Enterprise Mode Site List. This attribute is supported for the <site-list> element.Internet Explorer 11 and Microsoft Edge
urlSpecifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL. +
Note
+Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both http://contoso.com and https://contoso.com. +

Example +

+<site url="contoso.com:8080">
+  <compat-mode>IE8Enterprise</compat-mode>
+  <open-in>IE11</open-in>
+</site>
+In this example, going to https://contoso.com:8080 using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode.		Internet Explorer 11 and Microsoft Edge
+ +### Deprecated attributes +These v.1 version schema attributes have been deprecated in the v.2 version of the schema: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Deprecated attributeNew attributeReplacement example
<forceCompatView><compat-mode>Replace <forceCompatView="true"> with <compat-mode>IE7Enterprise</compat-mode>
<docMode><compat-mode>Replace <docMode="IE5"> with <compat-mode>IE5</compat-mode>
<doNotTransition><open-in>Replace <doNotTransition="true"> with <open-in>none</open-in>
<domain> and <path><site>Replace: +
+<emie>
+  <domain exclude="false">contoso.com</domain>
+</emie>
+With: +
+<site url="contoso.com"/>
+  <compat-mode>IE8Enterprise</compat-mode>
+</site>
+-AND-

+Replace: +

+<emie>
+  <domain exclude="true">contoso.com
+     <path exclude="false" forceCompatView="true">/about</path>
+  </domain>
+</emie>
+With: +
+<site url="contoso.com/about">
+  <compat-mode>IE7Enterprise</compat-mode>
+</site>
+ +While the old, replaced attributes aren't supported in the v.2 version of the schema, they'll continue to work in the v.1 version of the schema. If, however, you're using the v.2 version of the schema and these attributes are still there, the v.2 version schema takes precedence. We don’t recommend combining the two schemas, and instead recommend that you move to the v.2 version of the schema to take advantage of the new features. + +> [!IMPORTANT] +> Saving your v.1 version of the file using the new Enterprise Mode Site List Manager (schema v.2) automatically updates the XML to the new v.2 version of the schema. + +### What not to include in your schema +We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways: + +- Don’t use protocols. For example, `http://`, `https://`, or custom protocols. They break parsing. +- Don’t use wildcards. +- Don’t use query strings, ampersands break parsing. + +## Related topics +- [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md index 859cf8fbb7..7fc2191028 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md @@ -33,7 +33,7 @@ From AGPM you can: - **Manage your GPO lifecycle with change control features.** You can use the available version-control, history, and auditing features to help you manage your GPOs while moving through your archive, to your editing process, and finally to your GPO deployment. **Note**
-For more information about AGPM, and to get the license, see [Advanced Group Policy Management 4.0 Documents](https://www.microsoft.com/en-us/download/details.aspx?id=13975). +For more information about AGPM, and to get the license, see [Advanced Group Policy Management 4.0 Documents](https://www.microsoft.com/download/details.aspx?id=13975).   diff --git a/browsers/internet-explorer/ie11-deploy-guide/index.md b/browsers/internet-explorer/ie11-deploy-guide/index.md index 6d5935a29b..d2bc3fa2d1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/index.md +++ b/browsers/internet-explorer/ie11-deploy-guide/index.md @@ -1,13 +1,14 @@ --- ms.mktglfcycl: deploy description: Use this guide to learn about the several options and processes you'll need to consider while you're planning for, deploying, and customizing Internet Explorer 11 for your employee's devices. -author: shortpatti +author: lomayor +ms.author: lomayor ms.prod: ie11 ms.assetid: bddc2d97-c38d-45c5-9588-1f5bbff2e9c3 title: Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.localizationpriority: medium -ms.date: 07/27/2017 +manager: dansimp --- diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md index e93450be88..25226f2ad0 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md +++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md @@ -1,54 +1,54 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to add and deploy the Internet Explorer 11 update using Microsoft Intune. -author: lomayor -ms.prod: ie11 -ms.assetid: b2dfc08c-78af-4c22-8867-7be3b92b1616 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Install Internet Explorer 11 (IE11) using Microsoft Intune (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Install Internet Explorer 11 (IE11) using Microsoft Intune -Internet Explorer 11 is available as an update in Microsoft Intune. Microsoft Intune uses Windows cloud services to help you manage updates, monitor and protect your computers, provide remote assistance, track hardware and software inventory, and set security policies. For more information, see the [Documentation Library for Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=301805). - -## Adding and deploying the IE11 package -You can add and then deploy the IE11 package to any computer that's managed by Microsoft Intune. - - **To add the IE11 package** - -1. From the Microsoft Intune administrator console, start the Microsoft Intune Software Publisher. - -2. Add your IE11 package as either an external link or as a Windows installer package (.exe or .msi). - -For more info about how to decide which one to use, and how to use it, see [Deploy and configure apps](https://go.microsoft.com/fwlink/p/?LinkId=301806). - - **To automatically deploy and install the IE11 package** - -1. From the Microsoft Intune administrator console, start and run through the Deploy Software wizard. - -2. Deploy the package to any of your employee computers that are managed by Microsoft Intune. - -3. After the package is on your employee's computers, the installation process runs, based on what you set up in your wizard. - -For more info about this, see [Deploy and configure apps](https://go.microsoft.com/fwlink/p/?LinkId=301806). - - **To let your employees install the IE11 package** - -1. Install the package on your company's Microsoft Intune site, marking it as **Available** for the appropriate groups. - -2. Any employee in the assigned group can now install the package. - -For more info about this, see [Update apps using Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=301808) - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to add and deploy the Internet Explorer 11 update using Microsoft Intune. +author: lomayor +ms.prod: ie11 +ms.assetid: b2dfc08c-78af-4c22-8867-7be3b92b1616 +ms.reviewer: +manager: dansimp +ms.author: lomayor +title: Install Internet Explorer 11 (IE11) using Microsoft Intune (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Install Internet Explorer 11 (IE11) using Microsoft Intune +Internet Explorer 11 is available as an update in Microsoft Intune. Microsoft Intune uses Windows cloud services to help you manage updates, monitor and protect your computers, provide remote assistance, track hardware and software inventory, and set security policies. For more information, see the [Documentation Library for Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=301805). + +## Adding and deploying the IE11 package +You can add and then deploy the IE11 package to any computer that's managed by Microsoft Intune. + + **To add the IE11 package** + +1. From the Microsoft Intune administrator console, start the Microsoft Intune Software Publisher. + +2. Add your IE11 package as either an external link or as a Windows installer package (.exe or .msi). + +For more info about how to decide which one to use, and how to use it, see [Deploy and configure apps](https://go.microsoft.com/fwlink/p/?LinkId=301806). + + **To automatically deploy and install the IE11 package** + +1. From the Microsoft Intune administrator console, start and run through the Deploy Software wizard. + +2. Deploy the package to any of your employee computers that are managed by Microsoft Intune. + +3. After the package is on your employee's computers, the installation process runs, based on what you set up in your wizard. + +For more info about this, see [Deploy and configure apps](https://go.microsoft.com/fwlink/p/?LinkId=301806). + + **To let your employees install the IE11 package** + +1. Install the package on your company's Microsoft Intune site, marking it as **Available** for the appropriate groups. + +2. Any employee in the assigned group can now install the package. + +For more info about this, see [Update apps using Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=301808) + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md index 00029e6c5b..a4ca6348ac 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md +++ b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md @@ -127,7 +127,7 @@ We recommend that enterprise customers focus their new development on establishe - [Document modes](https://msdn.microsoft.com/library/dn384051(v=vs.85).aspx) - [What is Enterprise Mode?](what-is-enterprise-mode.md) - [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md) -- [Enterprise Site Discovery Toolkit](https://www.microsoft.com/en-us/download/details.aspx?id=44570) +- [Enterprise Site Discovery Toolkit](https://www.microsoft.com/download/details.aspx?id=44570) - [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) - [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) - [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md index 0212685d25..0f89abe875 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md @@ -163,6 +163,6 @@ Because the tool is open-source, the source code is readily available for examin - [Web Application Compatibility Lab Kit](https://technet.microsoft.com/microsoft-edge/mt612809.aspx) -- [Microsoft Services Support](https://www.microsoft.com/en-us/microsoftservices/support.aspx) +- [Microsoft Services Support](https://www.microsoft.com/microsoftservices/support.aspx) - [Find a Microsoft partner on Pinpoint](https://partnercenter.microsoft.com/pcv/search) diff --git a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md index c1f405ec66..d96bb1744c 100644 --- a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md @@ -1,51 +1,52 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Browsing Options page in the IEAK 11 Customization Wizard to manage items in the Favorites, Favorites Bar, and Feeds section. -author: lomayor -ms.prod: ie111 -ms.assetid: d6bd71ba-5df3-4b8c-8bb5-dcbc50fd974e -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Browsing Options page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Browsing Options page in the IEAK 11 Wizard -The **Browsing Options** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you decide how you want to manage items in the **Favorites, Favorites Bar, and Feeds** section, including the Microsoft-provided default items. - -The choices that you make on this page affect only the items shown on the **Favorites, Favorites Bar, and Feeds** page. - -**To use the Browsing Options page** - -1. Decide how you want to manage links that are already installed on your employee’s computer: - - - **Delete all existing items under Favorites, Favorites Bar and Feeds.** Removes all of the links, Web Slices, feeds, and Accelerators on the computer. This includes links and favorites added by you or the employee. Because this removes everything, we recommend that you use this option with caution. - - - **Only delete the items created by the administrator.** Removes only the items that you added for your employees on the **Favorites, Favorites Bar and Feeds** page. - - - **Don’t delete any items.** Doesn’t remove anything. Links Web Slices, feeds, and Accelerators are added to your employee computers at the top of the list, in the order you picked on the **Favorites, Favorites Bar and Feeds** page. - -2. Decide if you don’t want to add the Microsoft-default items: - - - **Favorites.** Checking this box won’t add the Microsoft-defined links. - - - **Web Slices and Links.** Checking this box won’t add the Microsoft-defined Web Slices or links. - - - **Feeds.** Checking this box won’t add the Microsoft-defined RSS feeds. - - - **Accelerators.** Checking this box won’t add the Microsoft-defined Accelerators. - -3. Click **Next** to go to the [First Run Wizard and Welcome Page Options](first-run-and-welcome-page-ieak11-wizard.md) page or **Back** to go to the [Favorites, Favorites Bar, and Feeds](favorites-favoritesbar-and-feeds-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Browsing Options page in the IEAK 11 Customization Wizard to manage items in the Favorites, Favorites Bar, and Feeds section. +author: lomayor +ms.prod: ie11 +ms.assetid: d6bd71ba-5df3-4b8c-8bb5-dcbc50fd974e +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: lomayor +title: Use the Browsing Options page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Browsing Options page in the IEAK 11 Wizard +The **Browsing Options** page of the Internet Explorer Administration Kit (IEAK 11) Customization Wizard lets you decide how you want to manage items in the **Favorites, Favorites Bar, and Feeds** section, including the Microsoft-provided default items. + +The choices that you make on this page affect only the items shown on the **Favorites, Favorites Bar, and Feeds** page. + +**To use the Browsing Options page** + +1. Decide how you want to manage links that are already installed on your employee’s computer: + + - **Delete all existing items under Favorites, Favorites Bar and Feeds.** Removes all of the links, Web Slices, feeds, and Accelerators on the computer. This includes links and favorites added by you or the employee. Because this removes everything, we recommend that you use this option with caution. + + - **Only delete the items created by the administrator.** Removes only the items that you added for your employees on the **Favorites, Favorites Bar and Feeds** page. + + - **Don’t delete any items.** Doesn’t remove anything. Links Web Slices, feeds, and Accelerators are added to your employee computers at the top of the list, in the order you picked on the **Favorites, Favorites Bar and Feeds** page. + +2. Decide if you don’t want to add the Microsoft-default items: + + - **Favorites.** Checking this box won’t add the Microsoft-defined links. + + - **Web Slices and Links.** Checking this box won’t add the Microsoft-defined Web Slices or links. + + - **Feeds.** Checking this box won’t add the Microsoft-defined RSS feeds. + + - **Accelerators.** Checking this box won’t add the Microsoft-defined Accelerators. + +3. Click **Next** to go to the [First Run Wizard and Welcome Page Options](first-run-and-welcome-page-ieak11-wizard.md) page or **Back** to go to the [Favorites, Favorites Bar, and Feeds](favorites-favoritesbar-and-feeds-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md index 78294cd509..0790851097 100644 --- a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md @@ -1,64 +1,64 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Feature Selection page in the IEAK 11 Customization Wizard to choose which parts of the setup processes and Internet Explorer 11 to change for your company. -author: lomayor -ms.prod: ie11 -ms.assetid: 9cb8324e-d73b-41ba-ade9-3acc796e21d8 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Feature Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Feature Selection page in the IEAK 11 Wizard -The **Feature Selection** page of the Internet Explorer Customization Wizard 11 lets you choose which parts of the setup processes and Internet Explorer 11 to change for your company, including: - -- **Setup Customizations.** Lets you add custom components, decide which components to install, provide your download site information, and modify the Setup title bar and graphics. - -- **Internal Install.** Lets you decide to install the latest updates, run the malicious Software Removal Tool, and set IE11 as the default browser. - -- **Connection Manager.** Lets you import your Connection Manager Profiles, created by the Connection Manager Administration Kit (CMAK). - -- **Browser User Interface.** Lets you change the toolbar buttons, the title bar, and the general look of the browser. - -- **Search Providers.** Lets you add, remove, and pick a new default search provider for IE11. - -- **Important URLs – Home Page and Support.** Lets you choose multiple **Home** pages that open in different tabs in IE. You can also use this page to change the **Welcome** and **Online Support** pages. - -- **Accelerators.** Lets you import, add, edit, or remove Accelerators, the contextual services that give you quick access to external services from any webpage. - -- **Favorites, Favorites Bar, and Feeds.** Lets you pick which favorites, web slices, and feeds are installed with your custom installation package. - -- **Browsing Options.** Lets you pick how you delete items in the Favorites, Favorites Bar, and Feeds folders, and whether to add the Microsoft default items. - -- **Compatibility View.** Lets you decide whether IE renders content using compatibility mode or standards mode. - -- **Connections Customization.** Lets you set up and deploy custom connections. - -- **Security Zones and Content Ratings.** Lets you control what your employees can view and what’s downloaded to their computer. - -- **Programs.** Lets you pick the default program that’s used automatically by email, HTML, newsgroups, Internet calls, calendars, and contact lists. - -- **Additional Settings.** Lets you pre-set and lockdown specific functionality on your employee’s computer. - -**Note**
Your choices on this page determine what wizard pages appear. - -**To use the Feature Selection page** - -1. Check the box next to each feature you want to include in your custom installation package.

-You can also click **Select All** to add, or **Clear All** to remove, all of the features. - -2. Click **Next** to go to the [Automatic Version Synchronization](auto-version-sync-ieak11-wizard.md) page or **Back** to go to the [Package Type Selection](pkg-type-selection-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Feature Selection page in the IEAK 11 Customization Wizard to choose which parts of the setup processes and Internet Explorer 11 to change for your company. +author: lomayor +ms.prod: ie11 +ms.assetid: 9cb8324e-d73b-41ba-ade9-3acc796e21d8 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: lomayor +title: Use the Feature Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +--- + + +# Use the Feature Selection page in the IEAK 11 Wizard +The **Feature Selection** page of the Internet Explorer Customization Wizard 11 lets you choose which parts of the setup processes and Internet Explorer 11 to change for your company, including: + +- **Setup Customizations.** Lets you add custom components, decide which components to install, provide your download site information, and modify the Setup title bar and graphics. + +- **Internal Install.** Lets you decide to install the latest updates, run the malicious Software Removal Tool, and set IE11 as the default browser. + +- **Connection Manager.** Lets you import your Connection Manager Profiles, created by the Connection Manager Administration Kit (CMAK). + +- **Browser User Interface.** Lets you change the toolbar buttons, the title bar, and the general look of the browser. + +- **Search Providers.** Lets you add, remove, and pick a new default search provider for IE11. + +- **Important URLs – Home Page and Support.** Lets you choose multiple **Home** pages that open in different tabs in IE. You can also use this page to change the **Welcome** and **Online Support** pages. + +- **Accelerators.** Lets you import, add, edit, or remove Accelerators, the contextual services that give you quick access to external services from any webpage. + +- **Favorites, Favorites Bar, and Feeds.** Lets you pick which favorites, web slices, and feeds are installed with your custom installation package. + +- **Browsing Options.** Lets you pick how you delete items in the Favorites, Favorites Bar, and Feeds folders, and whether to add the Microsoft default items. + +- **Compatibility View.** Lets you decide whether IE renders content using compatibility mode or standards mode. + +- **Connections Customization.** Lets you set up and deploy custom connections. + +- **Security Zones and Content Ratings.** Lets you control what your employees can view and what’s downloaded to their computer. + +- **Programs.** Lets you pick the default program that’s used automatically by email, HTML, newsgroups, Internet calls, calendars, and contact lists. + +- **Additional Settings.** Lets you pre-set and lockdown specific functionality on your employee’s computer. + +**Note**
Your choices on this page determine what wizard pages appear. + +**To use the Feature Selection page** + +1. Check the box next to each feature you want to include in your custom installation package.

+You can also click **Select All** to add, or **Clear All** to remove, all of the features. + +2. Click **Next** to go to the [Automatic Version Synchronization](auto-version-sync-ieak11-wizard.md) page or **Back** to go to the [Package Type Selection](pkg-type-selection-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/index.md b/browsers/internet-explorer/ie11-ieak/index.md index ea51efa9dc..6dc2619b8b 100644 --- a/browsers/internet-explorer/ie11-ieak/index.md +++ b/browsers/internet-explorer/ie11-ieak/index.md @@ -1,13 +1,14 @@ --- ms.mktglfcycl: plan description: IEAK 11 - Internet Explorer Administration Kit 11 Users Guide -author: shortpatti +author: lomayor +ms.author: lomayor ms.prod: ie11 ms.assetid: 847bd7b4-d5dd-4e10-87b5-4d7d3a99bbac title: Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide (Internet Explorer Administration Kit 11 for IT Pros) ms.sitesec: library ms.localizationpriority: medium -ms.date: 07/27/2017 +manager: dansimp --- diff --git a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md index 6cc535e14f..7a6e3d009f 100644 --- a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md @@ -1,106 +1,107 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: plan -description: Learn about the version of the IEAK 11 you should run, based on your license agreement. -author: lomayor -ms.author: lomayor -ms.prod: ie11, ieak11 -ms.assetid: 69d25451-08af-4db0-9daa-44ab272acc15 -ms.reviewer: -audience: itpro manager: dansimp -title: Determine the licensing version and features to use in IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 10/23/2018 ---- - - -# Determine the licensing version and features to use in IEAK 11 -In addition to the Software License Terms for the Internet Explorer Administration Kit 11 (IEAK 11, referred to as the "software"), these Guidelines further define how you may and may not use the software to create versions of Internet Explorer 11 with optional customizations (referred to as the "customized browser") for internal use and distribution in accordance with the IEAK 11 Software License Terms. IEAK 11 is for testing purposes only and is not intended to be used in a production environment. - -During installation, you must pick a version of IEAK 11, either **External** or **Internal**, based on your license agreement. Your version selection decides the options you can chose, the steps you follow to deploy your Internet Explorer 11 package, and how you manage the browser after deployment. - -- **External Distribution as an Internet Service Provider (ISP), Internet Content Provider (ICP), or Developer.** If you are an ISP or an ICP, your license agreement also states that you must show the Internet Explorer logo on your packaging and promotional goods, as well as on your website. - >[!IMPORTANT] - >Original Equipment Manufacturers (OEMs) that install IEAK 11 as part of a Windows product, under an OEM license agreement with Microsoft, must use their appropriate Windows OEM Preinstallation document (OPD) as the guide for allowable customizations. - -- **Internal Distribution via a Corporate Intranet.** This version is for network admins that plan to directly deploy IE11 into a corporate environment. - -## Available features by version - -| Feature | Internal | External | -|-------------------------------------------|:--------------------------------------------------------------------------------:|:------------------------------------------------------------------------------------:| -| Welcome screen | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| File locations | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Platform selection | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Language selection | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Package type selection | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Feature selection | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Automatic Version Synchronization (AVS) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Custom components | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Internal install | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | -| User experience | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | -| Browser user interface | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Search providers | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Important URLs – Home page and support | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Accelerators | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Favorites, Favorites bar, and feeds | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Browsing options | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | -| First Run wizard and Welcome page options | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Connection manager | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Connection settings | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Automatic configuration | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | -| Proxy settings | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Security and privacy settings | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | -| Add a root certificate | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | -| Programs | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | -| Additional settings | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | -| Wizard complete | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | - ---- - - -## Customization guidelines - -Two installation modes are available to you, depending on how you are planning to use the customized browser created with the software. Each mode requires a separate installation of the software. - -- **External Distribution** - This mode is available to anyone who wants to create a customized browser for distribution outside their company (for example, websites, magazines, retailers, non-profit organizations, independent hardware vendors, independent software vendors, Internet service providers, Internet content providers, software developers, and marketers). - -- **Internal Distribution** - This mode is available to companies for the creation and distribution of a customized browser only to their employees over a corporate intranet. - -The table below identifies which customizations you may or may not perform based on the mode you selected. - -| **Feature Name** | **External Distribution** | **Internal Distribution** | -|---------------------------------|:--------------------:|:-------------------:| -| **Custom Components** | Yes | Yes | -| **Title Bar** | Yes | Yes | -| **Favorites** | One folder, containing any number of links. | Any number of folders/links. | -| **Search Provider URLs** | Yes | Yes | -| **Search Guide URL** | No | Yes | -| **Online Support URL** | Yes | Yes | -| **Web Slice** | Suggested maximum five Web Slices. | Any number of Web Slices. | -| **Accelerator** | Search provider Accelerator must be the same as the search provider set for the Search Toolbox. We recommend that Any number of Accelerators/Accelerator Categories. Feature Name External Internal Accelerator category not exceed seven total categories, and each Accelerator category must be unique. We recommend each Accelerator category not have more than two Accelerators. The Accelerator display name should follow the syntax of verb + noun, such as "Map with Bing." | Any number of Accelerators/Accelerator Categories. | -| **Homepage URLs** | Can add a maximum of three. | Unlimited. | -| **First Run Wizard and Welcome Page Options** | Cannot remove Internet Explorer 11 First Run wizard. Can customize **Welcome** page. | Customizable. | -| **RSS Feeds** | One folder, containing any number of links. | Any number of folders/links. | -| **Browsing Options** | No | Yes | -| **Security and Privacy Settings** | No | Can add any number of sites. | -| **Corporate Options** (Latest Updates, Default Browser, Uninstall Info, Additional Settings) | No | Yes | -| **User Experience** (Setup/Restart) | No | Yes | -| **User Agent String** | Yes | Yes | -| **Compatibility View** | Yes | Yes | -| **Connection Settings and Manage** | Yes | Yes | - - -Support for some of the Internet Explorer settings on the wizard pages varies depending on your target operating system. For more information, see [Internet Explorer Customization Wizard 11 options](https://docs.microsoft.com/internet-explorer/ie11-ieak/ieak11-wizard-custom-options). - -## Distribution guidelines - -Two installation modes are available to you, depending on how you are planning to use the customized browser created with the software. Each mode requires a separate installation of the software. - -- **External Distribution** - You shall use commercially reasonable efforts to maintain the quality of (i) any non-Microsoft software distributed with Internet Explorer 11, and (ii) any media used for distribution (for example, optical media, flash drives), at a level that meets or exceeds the highest industry standards. If you distribute add-ons with Internet Explorer 11, those add-ons must comply with the [Microsoft browser extension policy](https://docs.microsoft.com/legal/windows/agreements/microsoft-browser-extension-policy). - -- **Internal Distribution - corporate intranet** - The software is solely for use by your employees within your company's organization and affiliated companies through your corporate intranet. Neither you nor any of your employees may permit redistribution of the software to or for use by third parties other than for third parties such as consultants, contractors, and temporary staff accessing your corporate intranet. +--- +ms.localizationpriority: medium +ms.mktglfcycl: plan +description: Learn about the version of the IEAK 11 you should run, based on your license agreement. +author: lomayor +ms.author: lomayor +ms.prod: ie11 +ms.assetid: 69d25451-08af-4db0-9daa-44ab272acc15 +ms.reviewer: +audience: itpro +manager: dansimp +title: Determine the licensing version and features to use in IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 10/23/2018 +--- + + +# Determine the licensing version and features to use in IEAK 11 +In addition to the Software License Terms for the Internet Explorer Administration Kit 11 (IEAK 11, referred to as the "software"), these Guidelines further define how you may and may not use the software to create versions of Internet Explorer 11 with optional customizations (referred to as the "customized browser") for internal use and distribution in accordance with the IEAK 11 Software License Terms. IEAK 11 is for testing purposes only and is not intended to be used in a production environment. + +During installation, you must pick a version of IEAK 11, either **External** or **Internal**, based on your license agreement. Your version selection decides the options you can chose, the steps you follow to deploy your Internet Explorer 11 package, and how you manage the browser after deployment. + +- **External Distribution as an Internet Service Provider (ISP), Internet Content Provider (ICP), or Developer.** If you are an ISP or an ICP, your license agreement also states that you must show the Internet Explorer logo on your packaging and promotional goods, as well as on your website. + >[!IMPORTANT] + >Original Equipment Manufacturers (OEMs) that install IEAK 11 as part of a Windows product, under an OEM license agreement with Microsoft, must use their appropriate Windows OEM Preinstallation document (OPD) as the guide for allowable customizations. + +- **Internal Distribution via a Corporate Intranet.** This version is for network admins that plan to directly deploy IE11 into a corporate environment. + +## Available features by version + +| Feature | Internal | External | +|-------------------------------------------|:--------------------------------------------------------------------------------:|:------------------------------------------------------------------------------------:| +| Welcome screen | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| File locations | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Platform selection | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Language selection | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Package type selection | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Feature selection | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Automatic Version Synchronization (AVS) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Custom components | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Internal install | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | +| User experience | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | +| Browser user interface | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Search providers | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Important URLs – Home page and support | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Accelerators | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Favorites, Favorites bar, and feeds | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Browsing options | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | +| First Run wizard and Welcome page options | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Connection manager | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Connection settings | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Automatic configuration | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | +| Proxy settings | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Security and privacy settings | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | +| Add a root certificate | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | +| Programs | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | +| Additional settings | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) | +| Wizard complete | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | + +--- + + +## Customization guidelines + +Two installation modes are available to you, depending on how you are planning to use the customized browser created with the software. Each mode requires a separate installation of the software. + +- **External Distribution** + This mode is available to anyone who wants to create a customized browser for distribution outside their company (for example, websites, magazines, retailers, non-profit organizations, independent hardware vendors, independent software vendors, Internet service providers, Internet content providers, software developers, and marketers). + +- **Internal Distribution** + This mode is available to companies for the creation and distribution of a customized browser only to their employees over a corporate intranet. + +The table below identifies which customizations you may or may not perform based on the mode you selected. + +| **Feature Name** | **External Distribution** | **Internal Distribution** | +|---------------------------------|:--------------------:|:-------------------:| +| **Custom Components** | Yes | Yes | +| **Title Bar** | Yes | Yes | +| **Favorites** | One folder, containing any number of links. | Any number of folders/links. | +| **Search Provider URLs** | Yes | Yes | +| **Search Guide URL** | No | Yes | +| **Online Support URL** | Yes | Yes | +| **Web Slice** | Suggested maximum five Web Slices. | Any number of Web Slices. | +| **Accelerator** | Search provider Accelerator must be the same as the search provider set for the Search Toolbox. We recommend that Any number of Accelerators/Accelerator Categories. Feature Name External Internal Accelerator category not exceed seven total categories, and each Accelerator category must be unique. We recommend each Accelerator category not have more than two Accelerators. The Accelerator display name should follow the syntax of verb + noun, such as "Map with Bing." | Any number of Accelerators/Accelerator Categories. | +| **Homepage URLs** | Can add a maximum of three. | Unlimited. | +| **First Run Wizard and Welcome Page Options** | Cannot remove Internet Explorer 11 First Run wizard. Can customize **Welcome** page. | Customizable. | +| **RSS Feeds** | One folder, containing any number of links. | Any number of folders/links. | +| **Browsing Options** | No | Yes | +| **Security and Privacy Settings** | No | Can add any number of sites. | +| **Corporate Options** (Latest Updates, Default Browser, Uninstall Info, Additional Settings) | No | Yes | +| **User Experience** (Setup/Restart) | No | Yes | +| **User Agent String** | Yes | Yes | +| **Compatibility View** | Yes | Yes | +| **Connection Settings and Manage** | Yes | Yes | + + +Support for some of the Internet Explorer settings on the wizard pages varies depending on your target operating system. For more information, see [Internet Explorer Customization Wizard 11 options](https://docs.microsoft.com/internet-explorer/ie11-ieak/ieak11-wizard-custom-options). + +## Distribution guidelines + +Two installation modes are available to you, depending on how you are planning to use the customized browser created with the software. Each mode requires a separate installation of the software. + +- **External Distribution** + You shall use commercially reasonable efforts to maintain the quality of (i) any non-Microsoft software distributed with Internet Explorer 11, and (ii) any media used for distribution (for example, optical media, flash drives), at a level that meets or exceeds the highest industry standards. If you distribute add-ons with Internet Explorer 11, those add-ons must comply with the [Microsoft browser extension policy](https://docs.microsoft.com/legal/windows/agreements/microsoft-browser-extension-policy). + +- **Internal Distribution - corporate intranet** + The software is solely for use by your employees within your company's organization and affiliated companies through your corporate intranet. Neither you nor any of your employees may permit redistribution of the software to or for use by third parties other than for third parties such as consultants, contractors, and temporary staff accessing your corporate intranet. diff --git a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md index efbae636fc..a3c0045275 100644 --- a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md @@ -1,35 +1,35 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Platform Selection page in the IEAK 11 Customization Wizard to pick the specs for your employee devices that will get the install package. -author: lomayor -ms.prod: ie11 -ms.assetid: 9cbf5abd-86f7-42b6-9810-0b606bbe8218 -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Platform Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Platform Selection page in the IEAK 11 Wizard -The **Platform Selection** page of the Internet Explorer Customization Wizard 11 lets you pick the operating system and architecture (32-bit or 64-bit) for the devices on which you’re going to install the custom installation package. - -**To use the Platform Selection page** - -1. Pick the operating system and architecture for the devices on which you’re going to install the custom package.

-You must create individual packages for each supported operating system.

-**Note**
To keep your settings across several operating system packages, you can specify the same destination folder. Then, after running the wizard, you can reuse the resulting .ins file. Any additional changes to the .ins file are saved. For more info about using .ins files, see [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md). For more info about adding in your .ins file, see [Use the File Locations page in the IEAK 11 Wizard](file-locations-ieak11-wizard.md). - -2. Click **Next** to go to the [Language Selection](language-selection-ieak11-wizard.md) page or **Back** to go to the [File Locations](file-locations-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Platform Selection page in the IEAK 11 Customization Wizard to pick the specs for your employee devices that will get the install package. +author: lomayor +ms.prod: ie11 +ms.assetid: 9cbf5abd-86f7-42b6-9810-0b606bbe8218 +ms.reviewer: +manager: dansimp +ms.author: lomayor +title: Use the Platform Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Platform Selection page in the IEAK 11 Wizard +The **Platform Selection** page of the Internet Explorer Customization Wizard 11 lets you pick the operating system and architecture (32-bit or 64-bit) for the devices on which you’re going to install the custom installation package. + +**To use the Platform Selection page** + +1. Pick the operating system and architecture for the devices on which you’re going to install the custom package.

+You must create individual packages for each supported operating system.

+**Note**
To keep your settings across several operating system packages, you can specify the same destination folder. Then, after running the wizard, you can reuse the resulting .ins file. Any additional changes to the .ins file are saved. For more info about using .ins files, see [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md). For more info about adding in your .ins file, see [Use the File Locations page in the IEAK 11 Wizard](file-locations-ieak11-wizard.md). + +2. Click **Next** to go to the [Language Selection](language-selection-ieak11-wizard.md) page or **Back** to go to the [File Locations](file-locations-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md index a4d2c384bb..8b0ff1ece4 100644 --- a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md +++ b/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md @@ -1,39 +1,39 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: How to use the Programs page in the IEAK 11 Customization Wizard to pick the default programs to use for Internet services. -author: lomayor -ms.prod: ie11 -ms.assetid: f715668f-a50d-4db0-b578-e6526fbfa1fc -ms.reviewer: -audience: itpro manager: dansimp -ms.author: lomayor -title: Use the Programs page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Use the Programs page in the IEAK 11 Wizard -The **Programs** page of the Internet Explorer Customization Wizard 11 lets you pick the default programs to use for Internet services, like email, contact lists, and newsgroups, by importing settings from your computer. - -**Important**
The customizations you make on this page only apply to Internet Explorer for the desktop. - -**To use the Programs page** - -1. Determine whether you want to customize your connection settings. You can pick: - - - **Do not customize Program Settings.** Pick this option if you don’t want to set program associations for your employee’s devices.

-OR-

- - - **Import the current Program Settings.** Pick this option to import the program associations from your device and use them as the preset for your employee’s program settings.

**Note**
If you want to change any of your settings, you can click **Modify Settings** to open the **Internet Properties** box, click **Set associations**, and make your changes. - -2. Click **Next** to go to the [Additional Settings](additional-settings-ieak11-wizard.md) page or **Back** to go to the [Add a Root Certificate](add-root-certificate-ieak11-wizard.md) page. - -  - -  - - - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: How to use the Programs page in the IEAK 11 Customization Wizard to pick the default programs to use for Internet services. +author: lomayor +ms.prod: ie11 +ms.assetid: f715668f-a50d-4db0-b578-e6526fbfa1fc +ms.reviewer: +manager: dansimp +ms.author: lomayor +title: Use the Programs page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Use the Programs page in the IEAK 11 Wizard +The **Programs** page of the Internet Explorer Customization Wizard 11 lets you pick the default programs to use for Internet services, like email, contact lists, and newsgroups, by importing settings from your computer. + +**Important**
The customizations you make on this page only apply to Internet Explorer for the desktop. + +**To use the Programs page** + +1. Determine whether you want to customize your connection settings. You can pick: + + - **Do not customize Program Settings.** Pick this option if you don’t want to set program associations for your employee’s devices.

-OR-

+ + - **Import the current Program Settings.** Pick this option to import the program associations from your device and use them as the preset for your employee’s program settings.

**Note**
If you want to change any of your settings, you can click **Modify Settings** to open the **Internet Properties** box, click **Set associations**, and make your changes. + +2. Click **Next** to go to the [Additional Settings](additional-settings-ieak11-wizard.md) page or **Back** to go to the [Add a Root Certificate](add-root-certificate-ieak11-wizard.md) page. + +  + +  + + + + + diff --git a/browsers/internet-explorer/index.md b/browsers/internet-explorer/index.md index c2dbda0086..ad64db8744 100644 --- a/browsers/internet-explorer/index.md +++ b/browsers/internet-explorer/index.md @@ -2,7 +2,7 @@ ms.mktglfcycl: deploy description: The landing page for IE11 that lets you access the documentation. author: shortpatti -ms.prod: IE11 +ms.prod: ie11 title: Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) assetid: be3dc32e-80d9-4d9f-a802-c7db6c50dbe0 ms.sitesec: library diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md index d50c95d74f..fe85d293be 100644 --- a/devices/hololens/TOC.md +++ b/devices/hololens/TOC.md @@ -1,34 +1,45 @@ -# [Microsoft HoloLens](index.md) -# [What's new in HoloLens](hololens-whats-new.md) -# [HoloLens in the enterprise: requirements and FAQ](hololens-requirements.md) -# [Set up HoloLens](hololens-setup.md) +# [HoloLens overview](index.md) +# [Hololens status](hololens-status.md) -# Device Management -## [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md) +# Get started with HoloLens (gen 1) +## [Start your HoloLens (1st gen) for the first time](hololens-start.md) ## [Install localized version of HoloLens](hololens-install-localized.md) + +# Get started with HoloLens in commercial environments +## [Overview and deployment planning](hololens-requirements.md) +## [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md) ## [Configure HoloLens using a provisioning package](hololens-provisioning.md) ## [Enroll HoloLens in MDM](hololens-enroll-mdm.md) -## [Manage updates to HoloLens](hololens-updates.md) -## [Restore HoloLens 2 using Advanced Recovery Companion](hololens-recovery.md) -## [Use the HoloLens Clicker](hololens-clicker.md) -## [Restart, reset, or recover the HoloLens](hololens-restart-recover.md) -## [Restart or recover the HoloLens clicker](hololens-clicker-restart-recover.md) +## [Set up ring based updates for HoloLens](hololens-updates.md) +## [Manage custom enterprise apps](hololens-install-apps.md) +## [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) + +# Navigating Windows Holographic +## [Windows Mixed Reality home](holographic-home.md) +## [Voice and Cortana](hololens-cortana.md) +## [Find and save files](hololens-find-and-save-files.md) +## [Create, share, and view photos and video](holographic-photos-and-video.md) + +# Accessories and connectivity +## [Connect to Bluetooth and USB-C devices](hololens-connect-devices.md) +## [Restart or recover the HoloLens (1st gen) clicker](hololens-clicker-restart-recover.md) +## [Connect to a network](hololens-network.md) +## [Use HoloLens offline](hololens-offline.md) # Application Management -## [Install apps on HoloLens](hololens-install-apps.md) ## [Share HoloLens with multiple people](hololens-multiple-users.md) -## [Cortana on HoloLens](hololens-cortana.md) ## [Get apps for HoloLens](hololens-get-apps.md) ## [Use apps on HoloLens](hololens-use-apps.md) ## [Use HoloLens offline](hololens-offline.md) ## [Spaces on HoloLens](hololens-spaces-on-hololens.md) +## [How HoloLens stores data for spaces](hololens-spaces.md) + +# Recovery and troubleshooting +## [Restore HoloLens 2 using Advanced Recovery Companion](hololens-recovery.md) +## [Restart, reset, or recover the HoloLens](hololens-restart-recover.md) # User/Access Management ## [Set up single application access](hololens-kiosk.md) -## [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) -## [How HoloLens stores data for spaces](hololens-spaces.md) -## [Find and save files](hololens-find-and-save-files.md) # [Insider preview for Microsoft HoloLens](hololens-insider.md) # [Change history for Microsoft HoloLens documentation](change-history-hololens.md) - diff --git a/devices/hololens/change-history-hololens.md b/devices/hololens/change-history-hololens.md index b886719944..a228d800c0 100644 --- a/devices/hololens/change-history-hololens.md +++ b/devices/hololens/change-history-hololens.md @@ -50,11 +50,6 @@ New or changed topic | Description --- | --- Insider preview for Microsoft HoloLens | New (topic retired on release of Windows 10, version 1809) -## June 2018 - -New or changed topic | Description ---- | --- -[HoloLens in the enterprise: requirements and FAQ](hololens-requirements.md#pin) | Added instructions for creating a sign-in PIN. ## May 2018 @@ -86,12 +81,6 @@ New or changed topic | Description --- | --- [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) | New -## May 2017 - -| New or changed topic | Description | -| --- | --- | -| [Microsoft HoloLens in the enterprise: requirements](hololens-requirements.md) | Changed title to **Microsoft HoloLens in the enterprise: requirements and FAQ**, added questions and answers in new [FAQ section](hololens-requirements.md#faq-for-hololens) | - ## January 2017 | New or changed topic | Description | diff --git a/devices/hololens/docfx.json b/devices/hololens/docfx.json index b19110b8f2..7cda17b22f 100644 --- a/devices/hololens/docfx.json +++ b/devices/hololens/docfx.json @@ -32,7 +32,8 @@ "breadcrumb_path": "/hololens/breadcrumb/toc.json", "ms.technology": "windows", "ms.topic": "article", - "ms.author": "jdecker", + "audience": "ITPro", + "manager": "laurawi", "ms.date": "04/05/2017", "feedback_system": "GitHub", "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", diff --git a/devices/hololens/holographic-home.md b/devices/hololens/holographic-home.md new file mode 100644 index 0000000000..576866ca2c --- /dev/null +++ b/devices/hololens/holographic-home.md @@ -0,0 +1,90 @@ +--- +title: Navigate the Windows Mixed Reality home +description: Navigate the Windows Mixed Reality home in Windows Holographic. +ms.assetid: 742bc126-7996-4f3a-abb2-cf345dff730c +ms.date: 08/07/2019 +keywords: hololens +ms.prod: hololens +ms.sitesec: library +author: scooley +ms.author: scooley +ms.topic: article +ms.localizationpriority: medium +--- + +# Navigate the Windows Mixed Reality home + +## [Navigating MR Home](https://docs.microsoft.com/en-us/windows/mixed-reality/navigating-the-windows-mixed-reality-home) + +## Use the Start menu + +The **Start** menu on HoloLens is where you'll open apps and get to the HoloLens camera. + +Wherever you are in HoloLens, you can always open the **Start** menu by using the [bloom gesture](https://support.microsoft.com/help/12644/hololens-use-gestures) on HoloLens (1st gen) or tapping your wrist on HoloLens 2. Usually, you'll use it once to get to **Start**, but sometimes you might need to use it twice. + +> [!TIP] +> When the **Start** menu is open, use the start gesture to hide it again. + +At the top of the **Start** menu, you'll see status indicators for Wi-Fi, battery, and volume, plus a clock. The tiles are your pinned apps. To talk to Cortana, select her tile, or just say "Hey Cortana" from anywhere on HoloLens. At the bottom you'll find the photo and video icons, which open the camera app. + +To see the rest of your apps, select **All apps**. To get back to **Start** from the **All apps** list, select **Pinned apps**. + +## Use apps on HoloLens + +Apps on HoloLens use either 2D view or holographic view. Apps with 2D view look like windows, and apps with holographic view surround you and become the only app you see. + +### Open apps + +You'll find your apps either pinned to **Start** or in the **All apps** list. To get to the **All apps** list, use the bloom gesture to go to **Start**, then select **All apps**. + +On **Start** or in the **All apps** list, select an app. It will open in a good position for viewing. + +>[!NOTE] +>- Up to three 2D app windows can be active at a time. You can open more, but only three will remain active. +>- Each open app can have one active window at a time, except Microsoft Edge, which can have up to three. +>- If you're having problems with apps, make sure there's enough light in your space, and walk around so HoloLens has a current scan. If you keep having trouble, see [HoloLens and holograms: FAQ](https://support.microsoft.com/help/13456/hololens-and-holograms-faq) for more info. + +## Move, resize, and rotate apps + +Moving and resizing apps on HoloLens works a bit differently than it does on a PC. Instead of dragging the app, you'll use your gaze, along with a [gesture](https://support.microsoft.com/help/12644/hololens-use-gestures) or the [clicker](hololens-clicker.md). You can also rotate an app window in 3D space. + +> [!TIP] +> Rearrange apps using your voice—gaze at an app and say "Face me," "Bigger," or "Smaller." Or have Cortana move an app for you: say "Hey Cortana, move <*app name*> here." + +### Move an app + +Gaze at the app, and then do one of the following. + +- Tap and hold to select the app. Move your hand to position the app, and raise your finger to place it. + +- Select **Adjust**, tap and hold, and move your hand to position the app. Raise your finger to place it, then select **Done**. +- Select **Adjust**, click and hold the clicker, and move your hand to position the app. Release the clicker, then select **Done**. + +> [!TIP] +> If you drop apps when you move them, make sure to keep your hand in the gesture frame by following it with your gaze. + +### Resize an app + +Gaze at the app, and then do one of the following. + +- Gaze at a corner or edge of an app window, and tap and hold. Move your hand to change the app's size, and raise your finger when you're done. + +- Select **Adjust**. Gaze at one of the blue squares at the corners of the app, tap and hold, then move your hand to resize the app. Raise your finger to release it, then select **Done**. +- Select **Adjust**. Gaze at one of the blue squares at the corners of the app, click and hold the clicker, then move your hand to resize the app. Release the clicker, then select **Done**. + +> [!TIP] +> In Adjust mode, you can move or resize any hologram. + +### Rotate an app + +Gaze at the app, and tap and hold with both hands to select it. Rotate the app by keeping one hand steady and moving your other hand around it. When you're done, raise both index fingers. + +## Close apps + +To close an app that uses 2D view, gaze at it, then select **Close**. + +To close an app that uses holographic view, use the bloom gesture to leave holographic view, then select **Close**. + +## Pin apps + +Keep your favorite apps handy by pinning them to **Start**. In the **All apps** list, gaze at an app to highlight it. Tap and hold until the menu appears, then select **Pin**. To unpin an app, gaze at the app on **Start**, then tap and hold and select **Unpin**. diff --git a/devices/hololens/holographic-photos-and-video.md b/devices/hololens/holographic-photos-and-video.md new file mode 100644 index 0000000000..25e8d4a104 --- /dev/null +++ b/devices/hololens/holographic-photos-and-video.md @@ -0,0 +1,42 @@ +--- +title: Create, share, and view photos and video +description: Create, share, and view photos and video +ms.assetid: 1b636ec3-6186-4fbb-81b2-71155aef0593 +keywords: hololens +ms.prod: hololens +ms.sitesec: library +author: Teresa-Motiv +ms.author: v-tea +ms.topic: article +ms.localizationpriority: medium +ms.date: 8/12/19 +ms.reviewer: +manager: jarrettr +appliesto: +- Hololens (1st gen) +--- + +# Create, share, and view photos and video + +Use your HoloLens to take photos and videos that capture the holograms you've placed in your world. + +To sync your photos and videos to OneDrive, open the OneDrive app and select **Settings** > **Camera upload**, and then turn on **Camera upload**. + +## Take a photo + +Use the [bloom](https://support.microsoft.com/help/12644/hololens-use-gestures) gesture to go to **Start**, then select **Photo**. Use gaze to position the photo frame, then air tap to take the picture. The picture will be saved to your collection in the Photos app.

+ +Want to snap a quick pic? Press the volume up and volume down buttons at the same time. [Where are the buttons?](https://support.microsoft.com/help/12649/hololens-whats-in-the-box) + +## Take a video + +Use the bloom gesture to go to **Start**, then select **Video**. Use gaze to position the video frame, then air tap to start recording. To stop recording, use bloom once. The video will be saved to your collection in the Photos app. + +To start recording more quickly, press and hold the volume up and volume down buttons simultaneously until a 3-second countdown begins. To stop recording, tap both buttons. + +> [!TIP] +> You can always have Cortana take a photo or a video for you. Just say "Hey Cortana, take a photo" or "Hey Cortana, take a video." [What else can I say to Cortana?](hololens-cortana.md) + +[Take + share photos and video with Mixed reality capture](https://docs.microsoft.com/en-us/windows/mixed-reality/mixed-reality-capture) + +[Find and view your photos](https://docs.microsoft.com/en-us/windows/mixed-reality/see-your-photos) diff --git a/devices/hololens/hololens-clicker-restart-recover.md b/devices/hololens/hololens-clicker-restart-recover.md index 81c7ffc704..25e49740c9 100644 --- a/devices/hololens/hololens-clicker-restart-recover.md +++ b/devices/hololens/hololens-clicker-restart-recover.md @@ -16,6 +16,8 @@ ms.localizationpriority: medium # Restart or recover the HoloLens clicker +[Clicker recovery](https://support.microsoft.com/en-us/help/15555) + Here are some things to try if the HoloLens clicker is unresponsive or isn’t working well. ## Restart the clicker diff --git a/devices/hololens/hololens-connect-devices.md b/devices/hololens/hololens-connect-devices.md new file mode 100644 index 0000000000..c702921e14 --- /dev/null +++ b/devices/hololens/hololens-connect-devices.md @@ -0,0 +1,46 @@ +--- +title: Connect to Bluetooth and USB-C devices +description: This guide walks through connecting to Bluetooth and USB-C devices and accessories. +ms.assetid: 01af0848-3b36-4c13-b797-f38ad3977e30 +ms.prod: hololens +ms.sitesec: library +author: Teresa-Motiv +ms.author: v-tea +ms.topic: article +ms.localizationpriority: medium +ms.date: 8/12/19 +manager: jarrettr +appliesto: +- HoloLens (1st gen) +- HoloLens 2 +--- + +# Connect devices and accessories + +## Pair Bluetooth devices + +Pair a Bluetooth mouse and keyboard with HoloLens, then use them to interact with holograms and to type anywhere you'd use the holographic keyboard. Pair the HoloLens [clicker](hololens-clicker.md) for a different way to interact with HoloLens. + +> [!NOTE] +> Other types of Bluetooth devices, such as speakers, headsets, smartphones, and game pads, may appear as available in HoloLens settings, but aren't supported. [Learn more](http://go.microsoft.com/fwlink/p/?LinkId=746660). + +### Pair a Bluetooth keyboard or mouse + +1. Turn on your keyboard or mouse and make it discoverable. The way you make it discoverable depends on the device. Check the device or visit the manufacturer's website to learn how. + +1. Go to **Start**, then select **Settings**. +1. Select **Devices** and make sure Bluetooth is on. When you see the device name, select **Pair** and follow the instructions. + +### Pair the clicker + +1. Use the bloom gesture to go to **Start**, then select **Settings**. + +1. Select **Devices** and make sure Bluetooth is on. +1. Use the tip of a pen to press and hold the clicker's pairing button until the status light blinks white. Make sure to hold the button down until the light starts blinking. [Where's the pairing button?](hololens-clicker.md) +1. On the pairing screen, select **Clicker** > **Pair**. + +## Connect USB-C devices + +## Connect to Miracast + +> Applies to HoloLens 2 only. diff --git a/devices/hololens/hololens-cortana.md b/devices/hololens/hololens-cortana.md index dfe9539b1b..03ad75f637 100644 --- a/devices/hololens/hololens-cortana.md +++ b/devices/hololens/hololens-cortana.md @@ -2,26 +2,63 @@ title: Cortana on HoloLens description: Cortana can help you do all kinds of things on your HoloLens ms.assetid: fd96fb0e-6759-4dbe-be1f-58bedad66fed -ms.reviewer: jarrettrenshaw -ms.date: 07/01/2019 -manager: v-miegge +ms.date: 08/14/2019 keywords: hololens ms.prod: hololens ms.sitesec: library author: v-miegge ms.author: v-miegge ms.topic: article +manager: jarrettr ms.localizationpriority: medium --- -# Cortana on HoloLens +# Use your voice with HoloLens + +You can use your voice to do many of the same things you do with gestures on HoloLens, like taking a quick photo or opening an app. + +## Voice commands + +Get around HoloLens faster with these basic commands. If you turn Cortana off, "Hey Cortana" voice commands won't be available, but you'll still be able to use the following built-in voice commands. + +**Select**. Use this instead of air tap. Gaze at a hologram, then say "Select." + +**Go to start**. Say "Go to Start" anytime to bring up the **Start** menu. Or when you're in an immersive app, say "Go to Start" to get to the quick actions menu. + +**Move this**. Instead of air tapping and dragging an app, say "Move this" and use gaze to move it. + +**Face me**. Gaze at a hologram, and then say "Face me" to turn it your way. + +**Bigger/Smaller**. Gaze at a hologram, and then say "Bigger" or "Smaller" to resize it. + +Many buttons and other elements on HoloLens also respond to your voice—for example, **Adjust** and **Close** on the app bar. To find out if a button is voice-enabled, rest your gaze on it for a moment. If it is, you'll see a voice tip. + +## Dictation mode + +Tired of typing? Switch to dictation mode any time the holographic keyboard is active. Select the microphone icon to get started, or say "Start dictating." To stop dictating, select **Done** or say "Stop dictating." To delete what you just dictated, say "Delete that." + +> [!NOTE] +> You need an Internet connection to use dictation mode. + +HoloLens dictation uses explicit punctuation, meaning that you say the name of the punctuation you want to use. For instance, you might say "Hey **comma** what are you up to **question mark**." + +Here are the punctuation keywords you can use: + +- Period, comma, question mark, exclamation point/exclamation mark +- New line/new paragraph +- Semicolon, colon +- Open quote(s), close quote(s) +- Hashtag, smiley/smiley face, frowny, winky +- Dollar, percent + +Sometimes it's helpful to spell out things like email addresses. For instance, to dictate example@outlook.com, you'd say "E X A M P L E at outlook dot com." + +## Do more with Cortana Cortana can help you do all kinds of things on your HoloLens, from searching the web to shutting down your device. To get her attention, select Cortana on Start or say "Hey Cortana" anytime. ![Hey Cortana!](images/cortana-on-hololens.png) -## What do I say to Cortana - Here are some things you can try saying (remember to say "Hey Cortana" first): - What can I say? @@ -44,7 +81,8 @@ Here are some things you can try saying (remember to say "Hey Cortana" first): - Tell me a joke. >[!NOTE] ->- Some Cortana features you're used to from Windows on your PC or phone (for example, reminders and notifications) aren't supported in Microsoft HoloLens Development Edition. Cortana on HoloLens is English only, and the Cortana experience may vary among regions. ->- Cortana is on the first time you use HoloLens. You can turn her off in Cortana's settings. In the All apps list, select Cortana > Settings. Then turn off Cortana can give you suggestions, ideas, reminders, alerts, and more. +> +>- Some Cortana features you're used to from Windows on your PC or phone (for example, reminders and notifications) aren't supported in Microsoft HoloLens Development Edition. Cortana on HoloLens is English-only, and the Cortana experience may vary among regions. +>- Cortana is on the first time you use HoloLens. You can turn her off in Cortana's settings. In the **All apps** list, select **Cortana > Settings**. Then turn off Cortana can give you suggestions, ideas, reminders, alerts, and more. >- If Cortana isn't responding to "Hey Cortana," go to Cortana's settings and check to make sure she's on. ->- If you turn Cortana off, "Hey Cortana" voice commands won't be available, but you'll still be able to use other commands (like "Select" and "Place"). +>- If you turn Cortana off, "Hey Cortana" voice commands won't be available, but you'll still be able to use other commands (such as "Select" and "Place"). diff --git a/devices/hololens/hololens-encryption.md b/devices/hololens/hololens-encryption.md index 8cbeaf26eb..838674f0dc 100644 --- a/devices/hololens/hololens-encryption.md +++ b/devices/hololens/hololens-encryption.md @@ -102,6 +102,6 @@ Provisioning packages are files created by the Windows Configuration Designer to Encryption is silent on HoloLens. To verify the device encryption status: -- On HoloLens, go to **Settings** > **System** > **About**. **BitLocker** is **enabled** if the device is encrypted. +- On HoloLens, go to **Settings** > **System** > **About**. **BitLocker** is **enabled** if the device is encrypted. ![About screen showing BitLocker enabled](images/about-encryption.png) diff --git a/devices/hololens/hololens-find-and-save-files.md b/devices/hololens/hololens-find-and-save-files.md index ba459eff13..e147ac2845 100644 --- a/devices/hololens/hololens-find-and-save-files.md +++ b/devices/hololens/hololens-find-and-save-files.md @@ -16,6 +16,9 @@ ms.localizationpriority: medium # Find and save files on HoloLens +Add content from [Find and save files](https://docs.microsoft.com/en-us/windows/mixed-reality/saving-and-finding-your-files) + + Files you create on HoloLens, including Office documents, photos, and videos, are saved to your HoloLens. To view and manage them, you can use the File Explorer app on HoloLens or File Explorer on your PC. To sync photos and other files to the cloud, use the OneDrive app on HoloLens. ## View files on HoloLens diff --git a/devices/hololens/hololens-install-apps.md b/devices/hololens/hololens-install-apps.md index c4f9c80521..7ff737a027 100644 --- a/devices/hololens/hololens-install-apps.md +++ b/devices/hololens/hololens-install-apps.md @@ -1,16 +1,15 @@ --- -title: Install apps on HoloLens (HoloLens) +title: Install apps on HoloLens description: The recommended way to install apps on HoloLens is to use Microsoft Store for Business. ms.prod: hololens ms.mktglfcycl: manage ms.sitesec: library -author: dansimp -ms.author: dansimp +author: scooley +ms.author: scooley ms.topic: article ms.localizationpriority: medium ms.date: 10/23/2018 ms.reviewer: -manager: dansimp --- # Install apps on HoloLens @@ -72,9 +71,9 @@ Using Intune, you can also [monitor your app deployment](https://docs.microsoft. >[!IMPORTANT] >When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode) -1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. +1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. -2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb). +2. On a PC, connect to the HoloLens using [Wi-Fi](https://docs.microsoft.com/windows/mixed-reality/connecting-to-wi-fi-on-hololens) or USB. 3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up. @@ -84,13 +83,7 @@ Using Intune, you can also [monitor your app deployment](https://docs.microsoft. 4. In the Windows Device Portal, click **Apps**. ![App Manager](images/apps.png) - + 5. In **Install app**, select an **app package** from a folder on your computer or network. If the app package requires additional software, such as dependency frameworks, select **I want to specify framework packages**. 6. In **Deploy**, click **Go** to deploy the app package and added dependencies to the connected HoloLens. - - - - - - diff --git a/devices/hololens/hololens-network.md b/devices/hololens/hololens-network.md new file mode 100644 index 0000000000..6f7cb43370 --- /dev/null +++ b/devices/hololens/hololens-network.md @@ -0,0 +1,40 @@ +--- +title: Connect to a network +description: Connect to a wi-fi or ethernet network with HoloLens. +ms.assetid: 0895606e-96c0-491e-8b1c-52e56b00365d +ms.prod: hololens +ms.sitesec: library +author: Teresa-Motiv +ms.author: v-tea +ms.topic: article +ms.localizationpriority: medium +ms.date: 8/12/19 +manager: jarrettr +ms.reviewer: +appliesto: +- Hololens +- HoloLens (1st gen) +- HoloLens 2 +--- + +# Connect to a network + +You'll need to be connected to a network to do most things on your HoloLens. [What can I do offline](hololens-offline.md)? + +## Connecting for the first time + +The first time you use your HoloLens, you'll be guided through connecting to a Wi-Fi network. If you have trouble connecting to Wi-Fi during setup, make sure your network is either open, password protected, or a captive portal network and doesn't require using certificates to connect. After setup, you can connect to other types of Wi-Fi networks. + +## Connecting to Wi-Fi after setup + +1. Go to **Start**, then select **Settings**. + +1. _HoloLens (1st gen) only_ - Use your gaze to position the Settings app, then air tap to place it, or say "Place." + +1. Select **Network & Internet** > **Wi-Fi**. If you don't see your network, scroll down the list. + +1. Select a network > **Connect**. + +1. Type the network password if asked for one, then select **Next**. + +Also see [Connect to Wifi](https://docs.microsoft.com/en-us/windows/mixed-reality/connecting-to-wi-fi-on-hololens) diff --git a/devices/hololens/hololens-offline.md b/devices/hololens/hololens-offline.md index 49190e6907..7de0cc1381 100644 --- a/devices/hololens/hololens-offline.md +++ b/devices/hololens/hololens-offline.md @@ -16,6 +16,9 @@ ms.localizationpriority: medium # Use HoloLens offline +[Use offline](https://support.microsoft.com/en-us/help/12645) + + To set up HoloLens, you'll need to connect to a Wi-Fi network—the setup tutorial will show you how. ## HoloLens limitations diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md index 6cb247c60b..f2d6ca4c03 100644 --- a/devices/hololens/hololens-requirements.md +++ b/devices/hololens/hololens-requirements.md @@ -1,88 +1,147 @@ --- -title: HoloLens in the enterprise requirements and FAQ (HoloLens) -description: Requirements and FAQ for general use, Wi-Fi, and device management for HoloLens in the enterprise. +title: Set up HoloLens in a commercial environment +description: Learn more about deploying and managing HoloLens in enterprise environments. ms.prod: hololens ms.sitesec: library -author: dansimp -ms.author: dansimp +ms.assetid: 88bf50aa-0bac-4142-afa4-20b37c013001 +author: scooley +ms.author: scooley ms.topic: article ms.localizationpriority: medium -ms.date: 06/04/2018 -ms.reviewer: -manager: dansimp +ms.date: 07/15/2019 --- -# Microsoft HoloLens in the enterprise: requirements and FAQ +# Deploy HoloLens in a commercial environment -When you develop for HoloLens, there are [system requirements and tools](https://developer.microsoft.com/windows/mixed-reality/install_the_tools) that you need. In an enterprise environment, there are also a few requirements to use and manage HoloLens which are listed below. +TODO - [Commercial features](https://docs.microsoft.com/en-us/windows/mixed-reality/commercial-features) -## Requirements +Deploy and configure HoloLens at scale in a commercial setting. -### General use -- Microsoft account or Azure Active Directory (Azure AD) account -- Wi-Fi network to set up HoloLens +This article includes: ->[!NOTE] ->After you set up HoloLens, you can use it offline [with some limitations](https://support.microsoft.com/help/12645/hololens-use-hololens-offline). +- infrastructure requirements and recommendations for HoloLens management +- tools for provisioning HoloLens +- instructions for remote device management +- options for application deployment +This guide assumes basic familiarity with HoloLens. Follow the [get started guide](./hololens-setup.md) to set up HoloLens for the first time. + +## Infrastructure for managing HoloLens + +HoloLens are, at their core, a Windows mobile device integrated with Azure. They work best in commercial environments with wireless network availability (wi-fi) and access to Microsoft services. + +Critical cloud services include: + +- Azure active directory (AAD) +- Windows Update (WU) + +Commercial customers will need enterprise mobility management (EMM) or mobile device management (MDM) infrastructure in order to manage HoloLens devices at scale. This guide uses [Microsoft Intune](https://www.microsoft.com/enterprise-mobility-security/microsoft-intune) as an example though any provider with full support for Microsoft Policy can support HoloLens. Ask your mobile device management provider if they support HoloLens 2. + +HoloLens does support a limited set of cloud disconnected experiences. + +## Initial set up at scale + +The HoloLens out of box experience is great for setting up one or two devices or for experiencing HoloLens for the first time. If you're provisioning many HoloLens devices, however, picking your language and settings manually for each device gets tedious and limits scale. + +This section: + +1. introduces Windows provisioning using provisioning packages +1. walks through applying a provisioning package during first setup + +### Create and apply a provisioning package + +The best way to configure many new HoloLens devices is with Windows provisioning. Using Windows provisioning, you can specify desired configuration and settings required to enroll the devices into management and then apply that configuration to target devices in minutes. + +A [provisioning package](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages) (.ppkg) is a collection of configuration settings. With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device. + +### Upgrade to Windows Holographic for Business + +- HoloLens Enterprise license XML file + +Some of the HoloLens configurations that you can apply in a provisioning package: + +- Apply certificates to the device +- Set up a Wi-Fi connection +- Pre-configure out of box questions like language and locale. +- (HoloLens 2) bulk enroll in mobile device management +- (HoloLens v1) Apply key to enable Windows Holographic for Business + +Follow [this guide](https://docs.microsoft.com/hololens/hololens-provisioning) to create and apply a provisioning package to HoloLens. + +### Set up user identity and enroll in device management + +The last step setting up HoloLens for management at scale is to enroll devices with mobile device management infrastructure. There are several ways to enroll: + +1. Bulk enrollment with a security token in a provisioning package. + Pros: this is the most automated approach + Cons: takes initial server-side setup +1. Auto-enroll on user sign in + Pros: easiest approach + Cons: users will need to complete set up after the provisioning package has been applied +1. _not recommended_ - Manually enroll post-setup + Pros: possible to enroll after set up + Cons: most manual approach and devices aren't centrally manageable until they're manually enrolled. + +Learn more about MDM enrollment [here](hololens-enroll-mdm.md). + +## Ongoing device management + +Ongoing device management will depend on your mobile device management infrastructure. Most have the same general functionality but the user interface may vary widely. + +This article outlines [policies and capabilities HoloLens supports](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference#hololens). + +[This article](https://docs.microsoft.com/intune/windows-holographic-for-business) talks about Intune's management tools for HoloLens. + +### Push compliance policy via Intune + +[Compliance policies](https://docs.microsoft.com/intune/device-compliance-get-started) are rules and settings that devices must meet to be compliant in your corporate infrastructure. Use these policies with Conditional Access to block access to company resources for devices that are not-compliant. + +For example, you can create a policy that requires Bitlocker be enabled. + +[Create compliance policies with Intune](https://docs.microsoft.com/intune/compliance-policy-create-windows). + +### Manage updates + +Intune includes a feature called update rings for Windows 10 devices, including HoloLens 2 and HoloLens v1 (with Holographic for Business). Update rings include a group of settings that determine how and when updates are installed. + +For example, you can create a maintenance window to install updates, or choose to restart after updates are installed. You can also choose to pause updates indefinitely until you're ready to update. + +Read more about [configuring update rings with Intune](https://docs.microsoft.com/en-us/intune/windows-update-for-business-configure). + +## Application management + +Manage holoLens applications through: + +1. Microsoft Store + The Microsoft Store is the best way to distribute and consume application on HoloLens. There is a great set of core HoloLens applications already available in the store or you can [publish your own](https://docs.microsoft.com/en-us/windows/uwp/publish/). + All applications in the store are available publicly to everyone, if that isn't acceptable, checkout the Microsoft Store for Business. + +1. [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/) + Microsoft Store for Business and Education is a custom store for your corporate environment. It lets you use the Microsoft Store built into Windows 10 and HoloLens to find, acquire, distribute, and manage apps for your organization. It lets you deploy apps that are specific to your commercial environment but not to the world. + +1. Application deployment and management via Intune or another mobile device management solution + Most mobile device management solutions, including Intune, provide a way to deploy line of business applications directly to a set of enrolled devices. See this article for [Intune app install](https://docs.microsoft.com/intune/apps-deploy). + +1. _not recommended_ Device Portal + Applications can also be installed on HoloLens directly using the Windows Device Portal. This isn't recommended since Developer Mode has to be enabled to use device portal. + +Read more about [installing apps on HoloLens](https://docs.microsoft.com/hololens/hololens-install-apps). + +## Get support + +Get support through the Microsoft support site. + +[File a support request](https://support.microsoft.com/en-us/supportforbusiness/productselection?sapid=e9391227-fa6d-927b-0fff-f96288631b8f). + +## Technical Reference + +### Wireless network EAP support -### Supported wireless network EAP methods - PEAP-MS-CHAPv2 - PEAP-TLS -- TLS +- TLS - TTLS-CHAP - TTLS-CHAPv2 - TTLS-MS-CHAPv2 - TTLS-PAP - TTLS-TLS - -### Device management - - Users have Azure AD accounts with [Intune license assigned](https://docs.microsoft.com/intune/get-started/start-with-a-paid-subscription-to-microsoft-intune-step-4) - - Wi-Fi network - - Intune or a 3rd party mobile device management (MDM) provider that uses Microsoft MDM APIs - -### Upgrade to Windows Holographic for Business -- HoloLens Enterprise license XML file - - -## FAQ for HoloLens - - -#### Is Windows Hello for Business supported on HoloLens? - -Windows Hello for Business (using a PIN to sign in) is supported for HoloLens. To allow Windows Hello for Business PIN sign-in on HoloLens: - -1. The HoloLens device must be [managed by MDM](hololens-enroll-mdm.md). -2. You must enable Windows Hello for Business for the device. ([See instructions for Microsoft Intune.](https://docs.microsoft.com/intune/windows-hello)) -3. On HoloLens, the user can then set up a PIN from **Settings** > **Sign-in Options** > **Add PIN**. - ->[!NOTE] ->Users who sign in with a Microsoft account can also set up a PIN in **Settings** > **Sign-in Options** > **Add PIN**. This PIN is associated with [Windows Hello](https://support.microsoft.com/help/17215/windows-10-what-is-hello), rather than [Windows Hello for Business](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-overview). - -#### Does the type of account change the sign-in behavior? - -Yes, the behavior for the type of account impacts the sign-in behavior. If you apply policies for sign-in, the policy is always respected. If no policy for sign-in is applied, these are the default behaviors for each account type. - -- Microsoft account: signs in automatically -- Local account: always asks for password, not configurable in **Settings** -- Azure AD: asks for password by default; configurable by **Settings** to no longer ask for password. - ->[!NOTE] ->Inactivity timers are currently not supported, which means that the **AllowIdleReturnWithoutPassword** policy is respected only when the device goes into StandBy. - - -#### How do I remove a HoloLens device from the Intune dashboard? - -You cannot [unenroll](https://docs.microsoft.com/intune-user-help/unenroll-your-device-from-intune-windows) HoloLens from Intune remotely. If the administrator unenrolls the device using MDM, the device will age out of the Intune dashboard. - - -## Related resources - -[Getting started with Azure Active Directory Premium](https://azure.microsoft.com/documentation/articles/active-directory-get-started-premium/) - -[Get started with Intune](https://docs.microsoft.com/intune/understand-explore/get-started-with-a-30-day-trial-of-microsoft-intune) - -[Enroll devices for management in Intune](https://docs.microsoft.com/intune/deploy-use/enroll-devices-in-microsoft-intune#supported-device-platforms) - -[Azure AD editions](https://azure.microsoft.com/documentation/articles/active-directory-editions/) - diff --git a/devices/hololens/hololens-start.md b/devices/hololens/hololens-start.md new file mode 100644 index 0000000000..d303ee0c44 --- /dev/null +++ b/devices/hololens/hololens-start.md @@ -0,0 +1,57 @@ +--- +title: HoloLens (1st gen) first start +description: Go through the first start experience for HoloLens (1st gen). +ms.assetid: 0136188e-1305-43be-906e-151d70292e87 +ms.prod: hololens +author: Teresa-Motiv +ms.author: v-tea +ms.topic: article +ms.date: 8/12/19 +manager: jarrettr +ms.topic: article +ms.localizationpriority: medium +--- + +# Set up HoloLens for the first time + +The first time you turn on your HoloLens, you'll be guided through calibrating your device, setting up your device, and signing in. This section walks through the HoloLens (1st gen) first start experience. + +In the next section, you'll learn how to work with HoloLens and interact with holograms. Skip ahead to [Get started with HoloLens (1st gen)](holographic-home.md) + +## Before you start + +Before you get started, make sure you have the following available: + +**A Wi-Fi connection**. You'll need to connect your HoloLens to a Wi-Fi network to set it up. The first time you connect, you'll need an open or password-protected network that doesn't require navigating to a website or using certificates to connect. After setup, you can [use your device offline](hololens-offline.md). + +**A Microsoft account**. You'll also need to sign in to HoloLens with a Microsoft account (or with your work account, if your organization owns the device). If you don't have a Microsoft account, go to [account.microsoft.com](http://account.microsoft.com) and set one up for free. + +**A safe, well-lit space with no tripping hazards**. [Health and safety info](http://go.microsoft.com/fwlink/p/?LinkId=746661). + +**The optional comfort accessories** that came with your HoloLens, to help you get the most comfortable fit. [More on fit and comfort](https://support.microsoft.com/help/12632/hololens-fit-your-hololens). + +> [!NOTE] +> [Cortana](hololens-cortana.md) is already on and ready to guide you the first time you use your HoloLens (though she won't be able to respond to your questions until after you set up your device). You can turn Cortana off at any time in Cortana's settings. + +## Set up your HoloLens + +Set up your HoloLens and your user account. + +1. The first time you use your HoloLens, you'll be guided through connecting to a Wi-Fi network. If you have trouble connecting to Wi-Fi during setup, make sure your network is either open, password protected, or a captive portal network and doesn't require using certificates to connect. After setup, you can connect to other types of Wi-Fi networks. +1. Sign in to your user account. You'll choose between **My work or school owns it** and **I own it**. + - When you choose **My work or school owns it**, you sign in by using an Azure AD account. If your organization uses Azure AD Premium and has configured automatic MDM enrollment, HoloLens will be enrolled in MDM. If your organization does not use Azure AD Premium, automatic MDM enrollment isn't available, so you will need to [enroll HoloLens in device management manually](hololens-enroll-mdm.md#enroll-through-settings-app). + 1. Enter your organizational account information. + 1. Accept the privacy statement. + 1. Sign in by using your Azure AD credentials. This may redirect to your organization's sign-in page. + 1. Continue with device setup. + - When you choose **I own it**, you sign in by using a Microsoft account. After setup is complete, you can [enroll HoloLens in device management manually](hololens-enroll-mdm.md#enroll-through-settings-app). + 1. Enter your Microsoft account information. + 1. Enter your password. If your Microsoft account requires [two-step verification (2FA)](https://blogs.technet.microsoft.com/microsoft_blog/2013/04/17/microsoft-account-gets-more-secure/), complete the verification process. +1. The device sets your time zone based on information obtained from the Wi-Fi network. +1. Follow the first-start guides to learn how to interact with holograms, control the HoloLens with your voice, and access the start menu. + +Congratulations! Setup is complete and you can begin using HoloLens. + +## Next steps + +- [Get started with HoloLens (1st gen)](holographic-home.md) diff --git a/devices/hololens/hololens-status.md b/devices/hololens/hololens-status.md new file mode 100644 index 0000000000..60289bad05 --- /dev/null +++ b/devices/hololens/hololens-status.md @@ -0,0 +1,36 @@ +--- +title: HoloLens status +description: Shows the status of HoloLens online services. +author: todmccoy +ms.author: v-todmc +ms.reviewer: luoreill +manager: jarrettr +audience: Admin +ms.topic: article +ms.prod: hololens +localization_priority: Medium +ms.sitesec: library +--- + +# HoloLens status + +✔️ **All services are active** + +**Key** ✔️ Good, ⓘ Information, ⚠ Warning, ❌ Critical + +Area|HoloLens (1st gen)|HoloLens 2 +----|:----:|:----: +[Azure services](https://status.azure.com/en-us/status)|✔️|✔️ +[Store app](https://www.microsoft.com/store/collections/hlgettingstarted/hololens)|✔️|✔️ +[Apps](https://www.microsoft.com/hololens/apps)|✔️|✔️ +[MDM](https://docs.microsoft.com/en-us/hololens/hololens-enroll-mdm)|✔️|✔️ + +## Notes and related topics + +[Frequently asked questions about using Skype for HoloLens](https://support.skype.com/en/faq/FA34641/frequently-asked-questions-about-using-skype-for-hololens) + +For more details about the status of the myriad Azure Services that can connect to HoloLens, see [Azure status](https://azure.microsoft.com/en-us/status/). + +For more details about current known issues, see [HoloLens known issues](https://docs.microsoft.com/en-us/windows/mixed-reality/hololens-known-issues). + +Follow HoloLens on [Twitter](https://twitter.com/HoloLens) and subscribe on [Reddit](https://www.reddit.com/r/HoloLens/). diff --git a/devices/hololens/hololens-updates.md b/devices/hololens/hololens-updates.md index ef830c3525..418cfce2d9 100644 --- a/devices/hololens/hololens-updates.md +++ b/devices/hololens/hololens-updates.md @@ -22,9 +22,9 @@ manager: dansimp For a complete list of Update policies, see [Policies supported by Windows Holographic for Business](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#a-href-idhololenspoliciesapolicies-supported-by-windows-holographic-for-business). To configure how and when updates are applied, use the following policies: -- [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) -- [Update/ScheduledInstallDay](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-scheduledinstallday) -- [Update/ScheduledInstallTime](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-scheduledinstalltime) +- [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) +- [Update/ScheduledInstallDay](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-scheduledinstallday) +- [Update/ScheduledInstallTime](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-scheduledinstalltime) To turn off the automatic check for updates, set the following policy to value **5** – Turn off Automatic Updates: - [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) diff --git a/devices/hololens/images/hololens2-side-render-medium.png b/devices/hololens/images/hololens2-side-render-medium.png new file mode 100644 index 0000000000..d4650c05e2 Binary files /dev/null and b/devices/hololens/images/hololens2-side-render-medium.png differ diff --git a/devices/hololens/images/hololens2-side-render-small.png b/devices/hololens/images/hololens2-side-render-small.png new file mode 100644 index 0000000000..a1a612e05a Binary files /dev/null and b/devices/hololens/images/hololens2-side-render-small.png differ diff --git a/devices/hololens/images/hololens2-side-render-xs.png b/devices/hololens/images/hololens2-side-render-xs.png new file mode 100644 index 0000000000..08d5f966cd Binary files /dev/null and b/devices/hololens/images/hololens2-side-render-xs.png differ diff --git a/devices/hololens/index.md b/devices/hololens/index.md index abb50c076e..5aee70afdb 100644 --- a/devices/hololens/index.md +++ b/devices/hololens/index.md @@ -3,6 +3,7 @@ title: Microsoft HoloLens (HoloLens) description: Landing page for HoloLens commercial and enterprise management. ms.prod: hololens ms.sitesec: library +ms.assetid: 0947f5b3-8f0f-42f0-aa27-6d2cad51d040 author: scooley ms.author: scooley ms.topic: article @@ -18,7 +19,9 @@ ms.date: 07/14/2019

Now, with the introduction of HoloLens 2, every device provides commercial ready management enhanced by the reliability, security, and scalability of cloud and AI services from Microsoft.

-HoloLens 2 side view +

To learn more about HoloLens 2 for developers, check out the mixed reality developer documentation.

+ +HoloLens 2 side view ## Guides in this section @@ -26,7 +29,7 @@ ms.date: 07/14/2019 | Guide | Description | | --- | --- | | [Get started with HoloLens](hololens-setup.md) | Set up HoloLens for the first time. | -| [Set up HoloLens in the enterprise](hololens-requirements.md) | Configure HoloLens for scale enterprise deployment and ongoing device management. | +| [Deploy HoloLens in a commercial environment](hololens-requirements.md) | Configure HoloLens for scale enterprise deployment and ongoing device management. | | [Install and manage applications on HoloLens](hololens-install-apps.md) |Install and manage important applications on HoloLens at scale. | | [Recover and troubleshoot HoloLens issues](https://support.microsoft.com/products/hololens) | Learn how to gather logs from HoloLens, recover a misbehaving device, or reset HoloLens when necessary. | | [Get support](https://support.microsoft.com/products/hololens) |Connect with Microsoft support resources for HoloLens in enterprise. | diff --git a/devices/surface-hub/General-Data-Privacy-Regulation-and-Surface-Hub.md b/devices/surface-hub/General-Data-Privacy-Regulation-and-Surface-Hub.md index 3254e13d6c..e499178078 100644 --- a/devices/surface-hub/General-Data-Privacy-Regulation-and-Surface-Hub.md +++ b/devices/surface-hub/General-Data-Privacy-Regulation-and-Surface-Hub.md @@ -2,8 +2,6 @@ title: General Data Privacy Regulation and Surface Hub description: Informs users who are subject to EU data protection laws of their options regarding how to delete or restrict diagnostic data produced by Surface Hub. ms.assetid: 087713CF-631D-477B-9CC6-EFF939DE0186 -ms.reviewer: -manager: keywords: GDPR ms.prod: surface-hub ms.sitesec: library diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md index cc71b5adf8..2f7fc9fd1f 100644 --- a/devices/surface-hub/TOC.md +++ b/devices/surface-hub/TOC.md @@ -21,10 +21,10 @@ ### [Configure Easy Authentication for Surface Hub 2S](surface-hub-2s-phone-authenticate.md) ## Deploy +### [Surface Hub 2S adoption and training](surface-hub-2s-adoption-kit.md) ### [First time setup for Surface Hub 2S](surface-hub-2s-setup.md) ### [Connect devices to Surface Hub 2S](surface-hub-2s-connect.md) ### [Surface Hub 2S deployment checklist](surface-hub-2s-deploy-checklist.md) -### [Surface Hub 2S adoption toolkit](surface-hub-2s-adoption-kit.md) ### [Create Surface Hub 2S device account](surface-hub-2s-account.md) ### [Create provisioning packages for Surface Hub 2S](surface-hub-2s-deploy.md) ### [Deploy apps to Surface Hub 2S using Intune](surface-hub-2s-deploy-apps-intune.md) @@ -44,7 +44,7 @@ ### [Secure and manage Surface Hub 2S with SEMM and UEFI](surface-hub-2s-secure-with-uefi-semm.md) ### [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) -## Support +## Troubleshoot ### [Recover and reset Surface Hub 2S](surface-hub-2s-recover-reset.md) ### [Troubleshoot Miracast on Surface Hub](miracast-troubleshooting.md) ### [How to pack and ship your Surface Hub 2S for service](surface-hub-2s-pack-components.md) @@ -106,7 +106,7 @@ ### [Save your BitLocker key](save-bitlocker-key-surface-hub.md) ### [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) -## Support +## Troubleshoot ### [Using the Surface Hub Recovery Tool](surface-hub-recovery-tool.md) ### [Surface Hub SSD replacement](surface-hub-ssd-replacement.md) diff --git a/devices/surface-hub/connect-app-in-surface-hub-unexpectedly-exits.md b/devices/surface-hub/connect-app-in-surface-hub-unexpectedly-exits.md index 9e70a8755c..439d3c68d7 100644 --- a/devices/surface-hub/connect-app-in-surface-hub-unexpectedly-exits.md +++ b/devices/surface-hub/connect-app-in-surface-hub-unexpectedly-exits.md @@ -2,8 +2,6 @@ title: What to do if the Connect app in Surface Hub exits unexpectedly description: Describes how to resolve an issue where the Connect app in Surface Hub exits to the Welcome screen after cycling through inputs. ms.assetid: 9576f4e4-d936-4235-8a03-d8a6fe9e8fec -ms.reviewer: -manager: keywords: surface, hub, connect, input, displayport ms.prod: surface-hub ms.sitesec: library diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md index 20f13c7d1b..a834e039ee 100644 --- a/devices/surface-hub/create-a-device-account-using-office-365.md +++ b/devices/surface-hub/create-a-device-account-using-office-365.md @@ -77,7 +77,7 @@ From here on, you'll need to finish the account creation process using PowerShel In order to run cmdlets used by these PowerShell scripts, the following must be installed for the admin PowerShell console: -- [Microsoft Online Services Sign-In Assistant for IT Professionals RTW](https://www.microsoft.com/en-us/download/details.aspx?id=41950) +- [Microsoft Online Services Sign-In Assistant for IT Professionals RTW](https://www.microsoft.com/download/details.aspx?id=41950) - [Windows Azure Active Directory Module for Windows PowerShell](https://www.microsoft.com/web/handlers/webpi.ashx/getinstaller/WindowsAzurePowershellGet.3f.3f.3fnew.appids) - [Skype for Business Online, Windows PowerShell Module](https://www.microsoft.com/download/details.aspx?id=39366) diff --git a/devices/surface-hub/docfx.json b/devices/surface-hub/docfx.json index 5f16f8d171..2ab787b803 100644 --- a/devices/surface-hub/docfx.json +++ b/devices/surface-hub/docfx.json @@ -27,7 +27,9 @@ "breadcrumb_path": "/surface-hub/breadcrumb/toc.json", "ROBOTS": "INDEX, FOLLOW", "ms.technology": "windows", + "audience": "ITPro", "ms.topic": "article", + "manager": "laurawi", "ms.mktglfcycl": "manage", "ms.sitesec": "library", "ms.date": "05/23/2017", diff --git a/devices/surface-hub/index.md b/devices/surface-hub/index.md index d9a7bc204f..6d0b532210 100644 --- a/devices/surface-hub/index.md +++ b/devices/surface-hub/index.md @@ -65,9 +65,9 @@ Surface Hub 2S is an all-in-one digital interactive whiteboard, meetings platfor

Deploy

-

Surface Hub 2S deployment checklist

-

Create device account

-

Deploy with provisioning package

+

Surface Hub 2S adoption and training

+

Surface Hub 2S deployment checklist

+

Create device account

diff --git a/devices/surface-hub/known-issues-and-additional-info-about-surface-hub.md b/devices/surface-hub/known-issues-and-additional-info-about-surface-hub.md index 93c56d4e28..003795ec22 100644 --- a/devices/surface-hub/known-issues-and-additional-info-about-surface-hub.md +++ b/devices/surface-hub/known-issues-and-additional-info-about-surface-hub.md @@ -2,8 +2,6 @@ title: Known issues and additional information about Microsoft Surface Hub description: Outlines known issues with Microsoft Surface Hub. ms.assetid: aee90a0c-fb05-466e-a2b1-92de89d0f2b7 -ms.reviewer: -manager: keywords: surface, hub, issues ms.prod: surface-hub ms.sitesec: library diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index 01c378c14a..4535bd1f1b 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -10,7 +10,6 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 06/20/2019 ms.localizationpriority: medium --- @@ -69,7 +68,7 @@ This table gives examples of deployment rings. | Deployment ring | Ring size | Servicing branch | Deferral for feature updates | Deferral for quality updates (security fixes, drivers, and other updates) | Validation step | | --------- | --------- | --------- | --------- | --------- | --------- | -| Preview (e.g. non-critical or test devices) | Small | Semi-annual channel (Targeted) | None. | None. | Manually test and evaluate new functionality. Pause updates if there are issues. | +| Preview (e.g. non-critical or test devices) | Small | Windows Insider Preview | None. | None. | Manually test and evaluate new functionality. Pause updates if there are issues. | | Release (e.g. devices used by select teams) | Medium | Semi-annual channel | None. | None. | Monitor device usage and user feedback. Pause updates if there are issues. | | Broad deployment (e.g. most of the devices in your organization) | Large | Semi-annual channel | 120 days after release. | 7-14 days after release. | Monitor device usage and user feedback. Pause updates if there are issues. | | Mission critical (e.g. devices in executive boardrooms) | Small | Semi-annual channel | 180 days after release (maximum deferral for feature updates). | 30 days after release (maximum deferral for quality updates). | Monitor device usage and user feedback. | diff --git a/devices/surface-hub/monitor-surface-hub.md b/devices/surface-hub/monitor-surface-hub.md index e90e7d8f95..262c565327 100644 --- a/devices/surface-hub/monitor-surface-hub.md +++ b/devices/surface-hub/monitor-surface-hub.md @@ -7,8 +7,8 @@ manager: dansimp keywords: monitor Surface Hub, Microsoft Operations Management Suite, OMS ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 07/27/2017 ms.localizationpriority: medium diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md index 5bea64a216..d3fdb628ab 100644 --- a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md @@ -7,8 +7,8 @@ manager: dansimp keywords: single forest deployment, on prem deployment, device account, Surface Hub ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 08/28/2018 ms.localizationpriority: medium --- @@ -63,10 +63,12 @@ If you have a single-forest on-premises deployment with Microsoft Exchange 2013 Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too. ```PowerShell + $acctUpn = Get-Mailbox -Identity "" + $credNewAccount.Password = ConvertTo-SecureString -String -AsPlainText -Force Set-Mailbox $acctUpn -Type Regular Set-CASMailbox $acctUpn -ActiveSyncMailboxPolicy $easPolicy Set-Mailbox $acctUpn -Type Room - Set-Mailbox $credNewAccount.UserName -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true + Set-Mailbox $acctUpn -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true ``` 4. Various Exchange properties can be set on the device account to improve the meeting experience for people. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md b/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md index e3754d3e15..f643e4cfe6 100644 --- a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md +++ b/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md @@ -4,8 +4,8 @@ description: This topic explains how you add a device account for your Microsoft keywords: multi forest deployment, on prem deployment, device account, Surface Hub ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 08/28/2018 ms.reviewer: manager: dansimp diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md index df1bf821b4..a072d4d7b4 100644 --- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md @@ -7,8 +7,8 @@ manager: dansimp keywords: device account for Surface Hub, online deployment ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 02/21/2018 ms.localizationpriority: medium diff --git a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md b/devices/surface-hub/password-management-for-surface-hub-device-accounts.md index 283520ee40..22e7e1284c 100644 --- a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md +++ b/devices/surface-hub/password-management-for-surface-hub-device-accounts.md @@ -7,8 +7,8 @@ manager: dansimp keywords: password, password management, password rotation, device account ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 07/27/2017 ms.localizationpriority: medium diff --git a/devices/surface-hub/physically-install-your-surface-hub-device.md b/devices/surface-hub/physically-install-your-surface-hub-device.md index 32a8f0f5ff..6d06a9ac69 100644 --- a/devices/surface-hub/physically-install-your-surface-hub-device.md +++ b/devices/surface-hub/physically-install-your-surface-hub-device.md @@ -7,8 +7,8 @@ manager: dansimp keywords: Surface Hub, readiness guide, installation location, mounting options ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 07/27/2017 ms.localizationpriority: medium diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md index d5c4c22cea..a6eb33d8f4 100644 --- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md +++ b/devices/surface-hub/prepare-your-environment-for-surface-hub.md @@ -7,8 +7,8 @@ manager: dansimp keywords: prepare environment, features of Surface Hub, create and test device account, check network availability ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 12/04/2017 ms.localizationpriority: medium diff --git a/devices/surface-hub/provisioning-packages-for-surface-hub.md b/devices/surface-hub/provisioning-packages-for-surface-hub.md index 2f47ffd5f8..607c66829e 100644 --- a/devices/surface-hub/provisioning-packages-for-surface-hub.md +++ b/devices/surface-hub/provisioning-packages-for-surface-hub.md @@ -1,14 +1,14 @@ --- title: Create provisioning packages (Surface Hub) -description: For Windows 10, settings that use the registry or a configuration service provider (CSP) can be configured using provisioning packages. +description: For Windows 10, settings that use the registry or a configuration service provider (CSP) can be configured using provisioning packages. ms.assetid: 8AA25BD4-8A8F-4B95-9268-504A49BA5345 ms.reviewer: manager: dansimp keywords: add certificate, provisioning package ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 03/16/2019 ms.localizationpriority: medium diff --git a/devices/surface-hub/remote-surface-hub-management.md b/devices/surface-hub/remote-surface-hub-management.md index 9d435f4650..7a9acbe0fd 100644 --- a/devices/surface-hub/remote-surface-hub-management.md +++ b/devices/surface-hub/remote-surface-hub-management.md @@ -4,8 +4,8 @@ description: This section lists topics for managing Surface Hub. keywords: remote management, MDM, install apps, monitor Surface Hub, Operations Management Suite, OMS ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 07/27/2017 ms.reviewer: diff --git a/devices/surface-hub/save-bitlocker-key-surface-hub.md b/devices/surface-hub/save-bitlocker-key-surface-hub.md index acd4207515..6bbfd1532a 100644 --- a/devices/surface-hub/save-bitlocker-key-surface-hub.md +++ b/devices/surface-hub/save-bitlocker-key-surface-hub.md @@ -7,8 +7,8 @@ manager: dansimp keywords: Surface Hub, BitLocker, Bitlocker recovery keys ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 07/08/2019 ms.localizationpriority: medium diff --git a/devices/surface-hub/set-up-your-surface-hub.md b/devices/surface-hub/set-up-your-surface-hub.md index d329156bb0..96f42c3df1 100644 --- a/devices/surface-hub/set-up-your-surface-hub.md +++ b/devices/surface-hub/set-up-your-surface-hub.md @@ -7,8 +7,8 @@ manager: dansimp keywords: set up instructions, Surface Hub, setup worksheet, first-run program ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 07/27/2017 ms.localizationpriority: medium diff --git a/devices/surface-hub/setup-worksheet-surface-hub.md b/devices/surface-hub/setup-worksheet-surface-hub.md index 46479063ed..6043d88f1d 100644 --- a/devices/surface-hub/setup-worksheet-surface-hub.md +++ b/devices/surface-hub/setup-worksheet-surface-hub.md @@ -7,8 +7,8 @@ manager: dansimp keywords: Setup worksheet, pre-setup, first-time setup ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 06/20/2019 ms.localizationpriority: medium diff --git a/devices/surface-hub/skype-hybrid-voice.md b/devices/surface-hub/skype-hybrid-voice.md index c60e7826dc..c805fb9005 100644 --- a/devices/surface-hub/skype-hybrid-voice.md +++ b/devices/surface-hub/skype-hybrid-voice.md @@ -1,11 +1,11 @@ --- title: Online or hybrid deployment using Skype Hybrid Voice environment (Surface Hub) description: This topic explains how to enable Skype for Business Cloud PBX with on premises PSTN connectivity via Cloud Connector Edition or Skype for Business 2015 pool. -keywords: hybrid deployment, Skype Hybrid Voice +keywords: hybrid deployment, Skype Hybrid Voice ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 07/27/2017 ms.reviewer: diff --git a/devices/surface-hub/support-solutions-surface-hub.md b/devices/surface-hub/support-solutions-surface-hub.md index 81eba249eb..b683f85daf 100644 --- a/devices/surface-hub/support-solutions-surface-hub.md +++ b/devices/surface-hub/support-solutions-surface-hub.md @@ -7,8 +7,8 @@ manager: dansimp keywords: Troubleshoot common problems, setup issues ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 10/24/2017 ms.localizationpriority: medium diff --git a/devices/surface-hub/surface-Hub-installs-updates-and-restarts-outside-maintenance-hours.md b/devices/surface-hub/surface-Hub-installs-updates-and-restarts-outside-maintenance-hours.md index 1ec6740c76..98ad30890e 100644 --- a/devices/surface-hub/surface-Hub-installs-updates-and-restarts-outside-maintenance-hours.md +++ b/devices/surface-hub/surface-Hub-installs-updates-and-restarts-outside-maintenance-hours.md @@ -2,8 +2,6 @@ title: Surface Hub may install updates and restart outside maintenance hours description: troubleshooting information for Surface Hub regarding automatic updates ms.assetid: 6C09A9F8-F9CF-4491-BBFB-67A1A1DED0AA -ms.reviewer: -manager: keywords: surface hub, maintenance window, update ms.prod: surface-hub ms.sitesec: library diff --git a/devices/surface-hub/surface-hub-2s-account.md b/devices/surface-hub/surface-hub-2s-account.md index 025b2b8320..1b73cf6980 100644 --- a/devices/surface-hub/surface-hub-2s-account.md +++ b/devices/surface-hub/surface-hub-2s-account.md @@ -83,12 +83,12 @@ Set-MsolUserLicense -UserPrincipalName "account@YourDomain.com" -AddLicenses "co ### Install prerequisites - [Visual C++ 2017 Redistributable](https://aka.ms/vs/15/release/vc_redist.x64.exe) -- [Skype for Business Online PowerShell Module](https://www.microsoft.com/en-us/download/confirmation.aspx?id=39366) +- [Skype for Business Online PowerShell Module](https://www.microsoft.com/download/confirmation.aspx?id=39366) ``` Import-Module LyncOnlineConnector $SfBSession = New-CsOnlineSession -Credential (Get-Credential) Import-PSSession $SfBSession -AllowClobber Enable the Skype for Business meeting room -Enable-CsMeetingRoom -Identity account@YourDomain.com -RegistrarPoo(Get-CsTenant).Registrarpool -SipAddressType EmailAddress +Enable-CsMeetingRoom -Identity account@YourDomain.com -RegistrarPool(Get-CsTenant).Registrarpool -SipAddressType EmailAddress ``` diff --git a/devices/surface-hub/surface-hub-2s-adoption-kit.md b/devices/surface-hub/surface-hub-2s-adoption-kit.md index 119b93ff02..de75086db3 100644 --- a/devices/surface-hub/surface-hub-2s-adoption-kit.md +++ b/devices/surface-hub/surface-hub-2s-adoption-kit.md @@ -1,5 +1,5 @@ --- -title: "Surface Hub 2S adoption toolkit" +title: "Surface Hub 2S Adoption and training guides" description: "Microsoft has developed downloadable materials that you can make available for your users to aid in adoption of Surface Hub 2S." keywords: separate values with commas ms.prod: surface-hub @@ -9,17 +9,20 @@ ms.author: robmazz manager: laurawi audience: Admin ms.topic: article -ms.date: 07/18/2019 +ms.date: 08/22/2019 ms.localizationpriority: Medium --- -# Surface Hub 2S adoption toolkit +# Surface Hub 2S adoption and training guides -Microsoft has developed downloadable materials that you can make available for your users to aid in adoption of Surface Hub 2S. +Whether you are a small or large business, a Surface Hub adoption plan is critical in generating the right use cases and helping your users become comfortable with the device. Check out these downloadable guides designed to help you deliver training across your organization. + +## Adoption toolkit + +- [Surface Hub adoption toolkit](downloads/SurfaceHubAdoptionToolKit.pdf) ## Training guides -- [Surface Hub adoption toolkit](downloads/SurfaceHubAdoptionToolKit.pdf) - [Training guide – end user](downloads/TrainingGuide-SurfaceHub2S-EndUser.pdf) - [Training guide – power user](downloads/TrainingGuide-SurfaceHub2S-PowerUser.pdf) - [Training guide – help desk](downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf) @@ -27,8 +30,6 @@ Microsoft has developed downloadable materials that you can make available for y [Download all training guides](http://download.microsoft.com/download/2/2/3/2234F70E-E65A-4790-93DF-F4C373A75B8E/SurfaceHub2S-TrainerGuides-July2019.zip) -[Download all training guides](http://download.microsoft.com/download/2/2/3/2234F70E-E65A-4790-93DF-F4C373A75B8E/SurfaceHub2S-TrainerGuides-July2019.zip) - ## End user guides - [Guide to Navigation on Surface Hub](downloads/Guide-SurfaceHub2S-Navigation.pptx) @@ -36,6 +37,8 @@ Microsoft has developed downloadable materials that you can make available for y - [Guide to Microsoft Whiteboard on Surface Hub](downloads/Guide-SurfaceHub2S-Whiteboard.pptx) - [Guide to Microsoft Teams on Surface Hub](downloads/Guide-SurfaceHub2S-Teams.pptx) +[Download all end user guides](http://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) + ## Quick reference cards - [Connect your PC](downloads/QRCConnectYourPC.pdf) @@ -49,4 +52,4 @@ Microsoft has developed downloadable materials that you can make available for y - [Whiteboard advanced](downloads/QRCWhiteboardAdvanced.pdf) - [Whiteboard tools](downloads/QRCWhiteboardTools.pdf) -[Download all user guides and quick reference cards](http://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) +[Download all quick reference cards](http://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip) diff --git a/devices/surface-hub/surface-hub-2s-connect.md b/devices/surface-hub/surface-hub-2s-connect.md index d3a17d2848..312c9d3d2e 100644 --- a/devices/surface-hub/surface-hub-2s-connect.md +++ b/devices/surface-hub/surface-hub-2s-connect.md @@ -14,7 +14,7 @@ ms.localizationpriority: Medium --- # Connect devices to Surface Hub 2S -Surface Hub 2S lets you connect external devices, mirror the display on Surface Hub 2S to another device, and connect a wide variety of third-party peripherals including video conference cameras, conference phones, and room system devices. +Surface Hub 2S enables you to connect external devices, mirror the display on Surface Hub 2S to another device, and connect multiple third-party peripherals including video conference cameras, conference phones, and room system devices. You can display content from your devices to Surface Hub 2S. If the source device is Windows-based, that device can also provide TouchBack and InkBack, which takes video and audio from the connected device and presents them on Surface Hub 2S. If Surface Hub 2S encounters a High-Bandwidth Digital Content Protection (HDCP) signal, such as a Blu-ray DVD player, the source is displayed as a black image. @@ -23,11 +23,10 @@ You can display content from your devices to Surface Hub 2S. If the source devic ## Recommended wired configurations -In general, it’s recommended to use native cable connections whenever possible such as USB-C to USB-C or HDMI to HDMI. Other combinations such as MiniDP to HDMI or MiniDP to USB-C will also work. +In general, it’s recommended to use native cable connections whenever possible such as USB-C to USB-C or HDMI to HDMI. Other combinations such as MiniDP to HDMI or MiniDP to USB-C will also work. Some additional configuration may be required to optimize the video-out experience, as described on this page. | **Connection** | **Functionality** | **Description**| | --- | --- | ---| -| USB-C
(via compute module) | Video-in
Video-out
Audio-in
Audio-out

TouchBack and InkBack | Provides video, audio, and TouchBack/InkBack on a single cable.

**NOTE:** Some configuration is required to optimize the video-out experience. Refer to the section below: [Mirroring Surface Hub 2S display on another device](#). | | HDMI + USB-C | HDMI-in for audio and video

USB-C for TouchBack and InkBack | USB-C supports TouchBack and InkBack with the HDMI A/V connection.

Use USB-C to USB-A to connect to legacy computers.

**NOTE:** For best results, connect HDMI before connecting a USB-C cable. If the computer you're using for HDMI is not compatible with TouchBack and InkBack, you won't need a USB-C cable. | | USB-C
(via compute module) | Video-in
Audio-in | Single cable needed for A/V

TouchBack and InkBack not supported

HDCP enabled | | HDMI (in port) | Video, Audio into Surface Hub 2S | Single cable needed for A/V

TouchBack and InkBack not supported

HDCP enabled | @@ -68,7 +67,7 @@ You can input video to Surface Hub 2S using USB-C or HDMI, as indicated in the f ## Mirroring Surface Hub 2S display on another device -You can output video to another display using either USB-C or MiniDP, as indicated in the following table. +You can output video to another display using MiniDP, as indicated in the following table. ### Surface Hub 2S video-out settings diff --git a/devices/surface-hub/surface-hub-2s-phone-authenticate.md b/devices/surface-hub/surface-hub-2s-phone-authenticate.md index ae82ccdf36..53b8395f63 100644 --- a/devices/surface-hub/surface-hub-2s-phone-authenticate.md +++ b/devices/surface-hub/surface-hub-2s-phone-authenticate.md @@ -22,7 +22,7 @@ Password-less phone sign-in simplifies signing-in to your meetings and files on ## To set up password-less phone sign-in -1. Download the [Microsoft Authenticator](https://www.microsoft.com/en-us/account/authenticator) app for iPhone or Android to your phone. +1. Download the [Microsoft Authenticator](https://www.microsoft.com/account/authenticator) app for iPhone or Android to your phone. 2. From your PC, go to [https://aka.ms/MFASetup](https://aka.ms/MFASetup) , sign in with your account, and select **Next.** 3. In the Additional security verification screen, select Mobile App and Use verification code, and then select **Setup**. diff --git a/devices/surface-hub/surface-hub-2s-setup.md b/devices/surface-hub/surface-hub-2s-setup.md index 7df7a694dc..76e5ac1055 100644 --- a/devices/surface-hub/surface-hub-2s-setup.md +++ b/devices/surface-hub/surface-hub-2s-setup.md @@ -97,4 +97,4 @@ If you insert a USB thumb drive with a provisioning package into one of the USB ![* Select a device account and friendly name from your configuration file*](images/sh2-run14.png)
- 4. Follow the instructions to complete first time Setup. +4. Follow the instructions to complete first time Setup. diff --git a/devices/surface-hub/surface-hub-authenticator-app.md b/devices/surface-hub/surface-hub-authenticator-app.md index 2ffa84dd12..9ad0606641 100644 --- a/devices/surface-hub/surface-hub-authenticator-app.md +++ b/devices/surface-hub/surface-hub-authenticator-app.md @@ -3,8 +3,8 @@ title: Sign in to Surface Hub with Microsoft Authenticator description: Use Microsoft Authenticator on your mobile device to sign in to Surface Hub. ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 08/28/2017 ms.reviewer: diff --git a/devices/surface-hub/surface-hub-downloads.md b/devices/surface-hub/surface-hub-downloads.md index 8f92a6b3a0..5e5073588a 100644 --- a/devices/surface-hub/surface-hub-downloads.md +++ b/devices/surface-hub/surface-hub-downloads.md @@ -3,8 +3,8 @@ title: Useful downloads for Microsoft Surface Hub description: Downloads related to the Microsoft Surface Hub. ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 08/22/2017 ms.reviewer: diff --git a/devices/surface-hub/surface-hub-qos.md b/devices/surface-hub/surface-hub-qos.md index 589cfcfcdf..105a188ae1 100644 --- a/devices/surface-hub/surface-hub-qos.md +++ b/devices/surface-hub/surface-hub-qos.md @@ -1,12 +1,12 @@ --- -title: Implement Quality of Service on Surface Hub +title: Implement Quality of Service on Surface Hub ms.reviewer: manager: dansimp description: Learn how to configure QoS on Surface Hub. ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium --- diff --git a/devices/surface-hub/surface-hub-recovery-tool.md b/devices/surface-hub/surface-hub-recovery-tool.md index f1f6a52a05..7d21b8c921 100644 --- a/devices/surface-hub/surface-hub-recovery-tool.md +++ b/devices/surface-hub/surface-hub-recovery-tool.md @@ -7,8 +7,8 @@ manager: dansimp keywords: manage Surface Hub ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 05/22/2018 ms.localizationpriority: medium diff --git a/devices/surface-hub/surface-hub-site-readiness-guide.md b/devices/surface-hub/surface-hub-site-readiness-guide.md index 44e8717278..cf21867432 100644 --- a/devices/surface-hub/surface-hub-site-readiness-guide.md +++ b/devices/surface-hub/surface-hub-site-readiness-guide.md @@ -1,12 +1,12 @@ --- -title: Surface Hub Site Readiness Guide +title: Surface Hub Site Readiness Guide ms.reviewer: manager: dansimp -description: Use this Site Readiness Guide to help plan your Surface Hub installation. +description: Use this Site Readiness Guide to help plan your Surface Hub installation. ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium --- diff --git a/devices/surface-hub/surface-hub-ssd-replacement.md b/devices/surface-hub/surface-hub-ssd-replacement.md index 363f1e6e81..7896a7d634 100644 --- a/devices/surface-hub/surface-hub-ssd-replacement.md +++ b/devices/surface-hub/surface-hub-ssd-replacement.md @@ -5,8 +5,8 @@ manager: dansimp description: Learn how to replace the solid state drive in a Surface Hub. ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium --- diff --git a/devices/surface-hub/surface-hub-start-menu.md b/devices/surface-hub/surface-hub-start-menu.md index 9ddfa628e6..9c1f451f63 100644 --- a/devices/surface-hub/surface-hub-start-menu.md +++ b/devices/surface-hub/surface-hub-start-menu.md @@ -3,12 +3,12 @@ title: Configure Surface Hub Start menu description: Use MDM to customize the Start menu on Surface Hub. ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: robmazz +ms.author: robmazz ms.topic: article -ms.date: 01/17/2018 +ms.date: 08/15/2018 ms.reviewer: -manager: dansimp +manager: laurawi ms.localizationpriority: medium --- @@ -107,7 +107,7 @@ There are a few key differences between Start menu customization for Surface Hub ## Example: Start layout that includes a Microsoft Edge link -This example shows a link to a website and a link to a .pdf file. +This example shows a link to a website and a link to a .pdf file. The secondary tile for Microsoft Edge uses a 150 x 150 pixel icon. ```xml @@ -165,10 +165,10 @@ This example shows a link to a website and a link to a .pdf file. TileID="6153963000" DisplayName="cstrtqbiology.pdf" Arguments="-contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x45b7376e -pinnedTimeHigh 0x01d2356c -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000003a https://www.ada.gov/regs2010/2010ADAStandards/Guidance_2010ADAStandards.pdf" - Square150x150LogoUri="ms-appx:///" + Square150x150LogoUri="ms-appx:///Assets/MicrosoftEdgeSquare150x150.png" Wide310x150LogoUri="ms-appx:///" - ShowNameOnSquare150x150Logo="true" - ShowNameOnWide310x150Logo="true" + ShowNameOnSquare150x150Logo="true" + ShowNameOnWide310x150Logo="false" BackgroundColor="#ff4e4248" Size="4x2" Row="4" @@ -181,8 +181,6 @@ This example shows a link to a website and a link to a .pdf file. ``` >[!NOTE] ->Microsoft Edge tile logos won't appear on secondary tiles because they aren't stored in Surface Hub. -> >The default value for `ForegroundText` is light; you don't need to include `ForegroundText` in your XML unless you're changing the value to dark. ## More information diff --git a/devices/surface-hub/surface-hub-technical-55.md b/devices/surface-hub/surface-hub-technical-55.md index 353347476f..6abc46e411 100644 --- a/devices/surface-hub/surface-hub-technical-55.md +++ b/devices/surface-hub/surface-hub-technical-55.md @@ -1,12 +1,12 @@ --- -title: Technical information for 55" Surface Hub +title: Technical information for 55" Surface Hub ms.reviewer: manager: dansimp description: Specifications for the 55" Surface Hub ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium --- diff --git a/devices/surface-hub/surface-hub-technical-84.md b/devices/surface-hub/surface-hub-technical-84.md index fb52cf8797..0ba7d45aa1 100644 --- a/devices/surface-hub/surface-hub-technical-84.md +++ b/devices/surface-hub/surface-hub-technical-84.md @@ -1,12 +1,12 @@ --- -title: Technical information for 84" Surface Hub +title: Technical information for 84" Surface Hub ms.reviewer: manager: dansimp description: Specifications for the 84" Surface Hub ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium --- diff --git a/devices/surface-hub/surface-hub-update-history.md b/devices/surface-hub/surface-hub-update-history.md index 881dfa5e4b..f88eb20479 100644 --- a/devices/surface-hub/surface-hub-update-history.md +++ b/devices/surface-hub/surface-hub-update-history.md @@ -2,8 +2,6 @@ title: Surface Hub update history description: Surface Hub update history ms.assetid: d66a9392-2b14-4cb2-95c3-92db0ae2de34 -ms.reviewer: -manager: keywords: ms.prod: surface-hub ms.sitesec: library @@ -26,6 +24,32 @@ Please refer to the “[Surface Hub Important Information](https://support.micro ## Windows 10 Team Creators Update 1703 +
+August 17, 2019—update for Team edition based on KB4512474* (OS Build 15063.2021) + +This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: + + * Ensures that Video Out on Hub 2S defaults to "Duplicate" mode. + +Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. +*[KB4503289](https://support.microsoft.com/help/4503289) +
+ +
+June 18, 2019—update for Team edition based on KB4503289* (OS Build 15063.1897) + +This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include: + +* Addresses an issue with log collection for Microsoft Surface Hub 2S. +* Addresses an issue preventing a user from signing in to a Microsoft Surface Hub device with an Azure Active Directory account. This issue occurs because a previous session did not end successfully. +* Adds support for TLS 1.2 connections to identity providers and Exchange in device account setup scenarios. +* Fixes to improve reliability of Hardware Diagnostic App on Hub 2S. +* Fix to improve consistency of first-run setup experience on Hub 2S. + +Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services. +*[KB4503289](https://support.microsoft.com/help/4503289) +
+
May 28, 2019—update for Team edition based on KB4499162* (OS Build 15063.1835) @@ -484,4 +508,4 @@ This update to the Surface Hub includes quality improvements and security fixes. * [Windows 10 November update: FAQ](http://windows.microsoft.com/windows-10/windows-update-faq) * [Microsoft Surface update history](http://go.microsoft.com/fwlink/p/?LinkId=724327) * [Microsoft Lumia update history](http://go.microsoft.com/fwlink/p/?LinkId=785968) -* [Get Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=616447) \ No newline at end of file +* [Get Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=616447) diff --git a/devices/surface-hub/surface-hub-wifi-direct.md b/devices/surface-hub/surface-hub-wifi-direct.md index 5d8fad351d..5120dc9b9c 100644 --- a/devices/surface-hub/surface-hub-wifi-direct.md +++ b/devices/surface-hub/surface-hub-wifi-direct.md @@ -4,8 +4,8 @@ description: This topic provides guidance on Wi-Fi Direct security risks. keywords: change history ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 06/20/2019 ms.reviewer: diff --git a/devices/surface-hub/surfacehub-miracast-not-supported-europe-japan-israel.md b/devices/surface-hub/surfacehub-miracast-not-supported-europe-japan-israel.md index 12678d2a9c..7a30ff1e37 100644 --- a/devices/surface-hub/surfacehub-miracast-not-supported-europe-japan-israel.md +++ b/devices/surface-hub/surfacehub-miracast-not-supported-europe-japan-israel.md @@ -2,8 +2,6 @@ title: Surface Hub Miracast channels 149-165 not supported in Europe, Japan, Israel description: Surface Hub Miracast channels 149-165 not supported in Europe, Japan, Israel ms.assetid: 8af3a832-0537-403b-823b-12eaa7a1af1f -ms.reviewer: -manager: keywords: ms.prod: surface-hub ms.sitesec: library diff --git a/devices/surface-hub/surfacehub-whats-new-1703.md b/devices/surface-hub/surfacehub-whats-new-1703.md index 1f9447ff87..0626c4a0d7 100644 --- a/devices/surface-hub/surfacehub-whats-new-1703.md +++ b/devices/surface-hub/surfacehub-whats-new-1703.md @@ -1,10 +1,10 @@ --- -title: What's new in Windows 10, version 1703 for Surface Hub +title: What's new in Windows 10, version 1703 for Surface Hub description: Windows 10, version 1703 (Creators Update) brings new features to Microsoft Surface Hub. ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 01/18/2018 ms.reviewer: diff --git a/devices/surface-hub/troubleshoot-surface-hub.md b/devices/surface-hub/troubleshoot-surface-hub.md index c67203853d..af6809a477 100644 --- a/devices/surface-hub/troubleshoot-surface-hub.md +++ b/devices/surface-hub/troubleshoot-surface-hub.md @@ -7,8 +7,8 @@ manager: dansimp keywords: Troubleshoot common problems, setup issues, Exchange ActiveSync errors ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 03/16/2018 ms.localizationpriority: medium diff --git a/devices/surface-hub/use-cloud-recovery-for-bitlocker-on-surfacehub.md b/devices/surface-hub/use-cloud-recovery-for-bitlocker-on-surfacehub.md index 2cb3ab2414..d03cfe3055 100644 --- a/devices/surface-hub/use-cloud-recovery-for-bitlocker-on-surfacehub.md +++ b/devices/surface-hub/use-cloud-recovery-for-bitlocker-on-surfacehub.md @@ -2,8 +2,6 @@ title: How to use cloud recovery for BitLocker on a Surface Hub description: How to use cloud recovery for BitLocker on a Surface Hub ms.assetid: c0bde23a-49de-40f3-a675-701e3576d44d -ms.reviewer: -manager: keywords: Accessibility settings, Settings app, Ease of Access ms.prod: surface-hub ms.sitesec: library diff --git a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md index 57f4f3faa0..33233a023b 100644 --- a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md +++ b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md @@ -2,8 +2,8 @@ title: Use fully qualified domain name with Surface Hub description: Troubleshoot common problems, including setup issues, Exchange ActiveSync errors. keywords: ["Troubleshoot common problems", "setup issues", "Exchange ActiveSync errors"] -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 07/27/2017 ms.reviewer: diff --git a/devices/surface-hub/use-room-control-system-with-surface-hub.md b/devices/surface-hub/use-room-control-system-with-surface-hub.md index e18ca0fcd5..cbc437e783 100644 --- a/devices/surface-hub/use-room-control-system-with-surface-hub.md +++ b/devices/surface-hub/use-room-control-system-with-surface-hub.md @@ -7,8 +7,8 @@ manager: dansimp keywords: room control system, Surface Hub ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 07/27/2017 ms.localizationpriority: medium diff --git a/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md b/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md index eedbfe9ae5..40a5768d27 100644 --- a/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md +++ b/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md @@ -2,8 +2,6 @@ title: Using the Surface Hub Hardware Diagnostic Tool to test a device account description: Using the Surface Hub Hardware Diagnostic Tool to test a device account ms.assetid: a87b7d41-d0a7-4acc-bfa6-b9070f99bc9c -ms.reviewer: -manager: keywords: Accessibility settings, Settings app, Ease of Access ms.prod: surface-hub ms.sitesec: library diff --git a/devices/surface-hub/whiteboard-collaboration.md b/devices/surface-hub/whiteboard-collaboration.md index 2c8a3793a6..a6e9524cd2 100644 --- a/devices/surface-hub/whiteboard-collaboration.md +++ b/devices/surface-hub/whiteboard-collaboration.md @@ -1,10 +1,10 @@ --- -title: Set up and use Microsoft Whiteboard +title: Set up and use Microsoft Whiteboard description: Microsoft Whiteboard’s latest update includes the capability for two Surface Hubs to collaborate in real time on the same board. ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 03/18/2019 ms.reviewer: @@ -12,60 +12,59 @@ manager: dansimp ms.localizationpriority: medium --- -# Set up and use Microsoft Whiteboard +# Set up and use Microsoft Whiteboard +The Microsoft Whiteboard app includes the capability for Surface Hubs and other devices to collaborate in real time on the same board. +## Prerequisites ->[!IMPORTANT] ->A new Microsoft Whiteboard app was released on July 12, 2018. The existing Whiteboard app that comes installed on Surface Hub and is pinned to the Welcome screen has been renamed **Microsoft Whiteboard 2016**. Microsoft Whiteboard 2016 will be automatically upgraded by May 21, 2019, and the collaboration service for the legacy app will stop functioning after June 7, 2019. For more details, see [Enable Microsoft Whiteboard on Surface Hub](https://support.office.com/article/enable-microsoft-whiteboard-on-surface-hub-b5df4539-f735-42ff-b22a-0f5e21be7627?ui=en-US&rs=en-US&ad=US). +To use whiteboard collaboration complete the following actions: -The Microsoft Whiteboard app includes the capability for two Surface Hubs to collaborate in real time on the same board. +- Add Whiteboard.ms, whiteboard.microsoft.com, and wbd.ms to your list of allowed sites. +- Open port: **HTTPS: 443** (normally configured when you first run Surface Hub.) -By ensuring that your organization meets the prerequisites, users can then ink, collaborate, and ideate together. +## Office 365 requirements -![example of a whiteboard with collaborative inking](images/wb-collab-example.png) +- Whiteboard collaboration is only supported in the Office 365 commercial environment and requires Office 365 with cloud-based Azure Active Directory (Azure AD). +- You can only run collaborative sessions among users belonging to the same Office 365 tenant. +- Office 365 Germany or Office 365 operated by 21Vianet do not support whiteboard collaboration. -## Prerequisites for Whiteboard to Whiteboard collaboration (Microsoft Whiteboard 2016) - -To get Whiteboard to Whiteboard collaboration up and running, you’ll need to make sure your organization meets the following requirements: - -- Office 365 with cloud-based Azure Active Directory (Azure AD) for all users -- OneDrive for Business deployed for all users who intend to collaborate -- Currently not utilizing Office 365 Germany or Office 365 operated by 21Vianet -- Surface Hub needs to be updated to Windows 10, version 1607 or newer -- Port 443 needs to be open since Whiteboard makes standard https requests -- Whiteboard.ms, wbd.ms, \*.onenote.com, and your company's SharePoint tenant domain URLs need to be whitelisted for proxies - - ->[!NOTE] ->Collaborative sessions can only take place between users within the same tenant, so users outside of your organization won’t be able to join even if they have a Surface Hub. - -## Using Whiteboard to Whiteboard collaboration (Microsoft Whiteboard 2016) +## Collaborating with whiteboards To start a collaboration session: 1. In the Whiteboard app, tap the **Sign in** button. 2. Sign in with your organization ID. 3. Tap the **Invite** button next to your name at the top of the app. -4. Tap **Start session**. Whiteboard will generate a link that you can share. +4. Write or type the names of the colleagues you wish to collaborate with. - ![screenshot of the link dialog box on whiteboard](images/wb-collab-link.png) - -5. Copy and paste this link into a Skype chat with another Surface Hub +On the other device, such as a Surface Hub, when you are signed in, the shared board will now appear in the board gallery. -When the other Surface Hub receives the link, the recipient can tap on the link, sign in to Whiteboard, and then begin collaborating. You can copy and paste other content, use smart ink features like Ink to Shape, and co-author together. - -After you’re done, you can export a copy of the Whiteboard collaboration for yourself through the Share charm and leave the board for others to continue working. - ->[!TIP] ->When you start a collaboration session, Whiteboard creates a folder named **Whiteboard App Data** in your OneDrive for Business to store your shared whiteboards. After some collaboration sessions, this folder may continue to sync or process changes indefinitely. You can fix this by choosing to not sync the **Whiteboard App Data** folder to your device. Disabling sync for this folder won't limit your ability to use Whiteboard for collaboration sessions. +### User tips +- Log in to access your whiteboards. As you work, changes are saved automatically. +- Name your whiteboards to help organize your content and find it quickly. Select the … to open the menu. Select the **Options** gear icon to access more tools and features of the Whiteboard. +- Use **Ink to shape** to turn drawing into actual shapes like circles, squares, and triangles. +- Use **Ink to table** to turn a drawn grid into a table with rows and columns. +- You can also change the background color and design from solid to grid or dots. Pick the background, then choose the color from the wheel around it. +- You can export a copy of the Whiteboard collaboration for yourself through the Share charm and leave the board for others to continue working. +> [!NOTE] +> If you are using Whiteboard and cannot sign in, you can collaborate by joining a Teams or Skype for Business meeting, and then sharing your screen. After you’re done, tap **Settings** > **Export to email** or save a copy of the board. The SVG export provides higher resolution than PNG and can be opened in a web browser. +## New features in Whiteboard +The Microsoft Whiteboard app, updated for Surface Hub on July 1, 2019 includes a host of new features including: +- **Automatic Saving** - Boards are saved to the cloud automatically when you sign in, and can be found in the board gallery. +- **Extended collaboration across devices** - You can collaborate using new apps for Windows 10 PC and iOS, and a web version for other devices. +- **Richer canvas** - In addition to ink and images, Whiteboard now includes sticky notes, text and GIFs, with more objects coming soon. +- **Intelligence** – In addition to ink to shape and table, Whiteboard now includes ink beautification to improve handwriting and ink grab to convert images to ink. +- **More color and background options** - Whiteboard now includes more pen colors and thickness options along with additional background colors and designs. +- **Teams Integration** – You can automatically launch Whiteboard from a Teams meeting and share with participants (currently in preview). ## Related topics - [Windows 10 Creators Update for Surface Hub](https://www.microsoft.com/surface/support/surface-hub/windows-10-creators-update-surface-hub) -- [Support documentation for Microsoft Whiteboard](https://support.office.com/en-us/article/Whiteboard-Help-0c0f2aa0-b1bb-491c-b814-fd22de4d7c01) + +- [Support documentation for Microsoft Whiteboard](https://support.office.com/article/Whiteboard-Help-0c0f2aa0-b1bb-491c-b814-fd22de4d7c01) diff --git a/devices/surface-hub/wireless-network-management-for-surface-hub.md b/devices/surface-hub/wireless-network-management-for-surface-hub.md index 5e17e464a9..0a314fe596 100644 --- a/devices/surface-hub/wireless-network-management-for-surface-hub.md +++ b/devices/surface-hub/wireless-network-management-for-surface-hub.md @@ -7,8 +7,8 @@ manager: dansimp keywords: network connectivity, wired connection ms.prod: surface-hub ms.sitesec: library -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 07/27/2017 ms.localizationpriority: medium diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md index 15a51ed349..665c1bd9c4 100644 --- a/devices/surface/TOC.md +++ b/devices/surface/TOC.md @@ -1,6 +1,6 @@ # [Surface](index.md) -## Get started +## [Get started](get-started.md) ## Overview ### [Surface Pro Tech specs](https://www.microsoft.com/surface/devices/surface-pro/tech-specs) @@ -30,15 +30,16 @@ ### [Surface System SKU reference](surface-system-sku-reference.md) ## Manage +### [Optimizing wireless connectivity for Surface devices](surface-wireless-connect.md) ### [Best practice power settings for Surface devices](maintain-optimal-power-settings-on-Surface-devices.md) ### [Battery Limit setting](battery-limit.md) ### [Surface Brightness Control](microsoft-surface-brightness-control.md) ### [Surface Asset Tag](assettag.md) ### [Surface firmware and driver updates](update.md) -### [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) +### [Deploy the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) ### [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md) ### [Surface Dock Updater](surface-dock-updater.md) -### [Use System Center Configuration Manager to manage devices with SEMM](use-system-center-configuration-manager-to-manage-devices-with-semm.md) + ## Secure ### [Manage Surface UEFI settings](manage-surface-uefi-settings.md) @@ -46,12 +47,14 @@ ### [Surface Enterprise Management Mode](surface-enterprise-management-mode.md) ### [Enroll and configure Surface devices with SEMM](enroll-and-configure-surface-devices-with-semm.md) ### [Unenroll Surface devices from SEMM](unenroll-surface-devices-from-semm.md) - -## Support -### [Fix common Surface problems using the Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-for-business-intro.md) -### [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md) -### [Use Surface Diagnostic Toolkit for Business in desktop mode](surface-diagnostic-toolkit-desktop-mode.md) -### [Run Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md) +### [Use System Center Configuration Manager to manage devices with SEMM](use-system-center-configuration-manager-to-manage-devices-with-semm.md) ### [Surface Data Eraser](microsoft-surface-data-eraser.md) + +## Troubleshoot ### [Top support solutions for Surface devices](support-solutions-surface.md) +### [Fix common Surface problems using the Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-for-business-intro.md) +#### [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md) +#### [Use Surface Diagnostic Toolkit for Business in desktop mode](surface-diagnostic-toolkit-desktop-mode.md) +#### [Run Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md) + ### [Change history for Surface documentation](change-history-for-surface.md) diff --git a/devices/surface/assettag.md b/devices/surface/assettag.md index 60ff9078bd..7ccc8ed708 100644 --- a/devices/surface/assettag.md +++ b/devices/surface/assettag.md @@ -20,16 +20,16 @@ for Surface devices. It works on Surface Pro 3 and all newer Surface devices. ## System requirements - - Surface Pro 3 or later +- Surface Pro 3 or later - - UEFI firmware version 3.9.150.0 or later +- UEFI firmware version 3.9.150.0 or later ## Using Surface Asset Tag To run Surface Asset Tag: 1. On the Surface device, download **Surface Asset Tag.zip** from the [Microsoft Download - Center](https://www.microsoft.com/en-us/download/details.aspx?id=46703), + Center](https://www.microsoft.com/download/details.aspx?id=46703), extract the zip file, and save AssetTag.exe in desired folder (in this example, C:\\assets). diff --git a/devices/surface/change-history-for-surface.md b/devices/surface/change-history-for-surface.md index 14eea5c91d..ea290fea58 100644 --- a/devices/surface/change-history-for-surface.md +++ b/devices/surface/change-history-for-surface.md @@ -15,6 +15,14 @@ ms.topic: article This topic lists new and updated topics in the Surface documentation library. +## August 2019 + +| **New or changed topic** | **Description** | +| ------------------------ | --------------- | +| [Optimizing wireless connectivity for Surface devices](surface-wireless-connect.md) | New document highlights key wireless connectivity considerations for Surface devices in mobile scenarios. | +| [Deploy the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) | Updated to reflect minor changes in the file naming convention for Surface MSI files. | + + ## July 2019 | **New or changed topic** | **Description** | diff --git a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md index 76e1c293cc..94094f2b60 100644 --- a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md +++ b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md @@ -1,5 +1,5 @@ --- -title: Download the latest firmware and drivers for Surface devices (Surface) +title: Deploy the latest firmware and drivers for Surface devices (Surface) description: This article provides a list of the available downloads for Surface devices and links to download the drivers and firmware for your device. ms.assetid: 7662BF68-8BF7-43F7-81F5-3580A770294A ms.reviewer: @@ -11,27 +11,43 @@ ms.mktglfcycl: deploy ms.pagetype: surface, devices ms.sitesec: library author: dansimp -ms.date: 11/15/2018 +ms.date: 08/13/2019 ms.author: dansimp ms.topic: article --- -# Deploying the latest firmware and drivers for Surface devices +# Deploy the latest firmware and drivers for Surface devices Although Surface devices are typically automatically updated with the latest device drivers and firmware via Windows Update, sometimes it's necessary to download and install updates manually, such as during a Windows deployment. -## Downloading MSI files +## Download MSI files To download MSI files, refer to the following Microsoft Support page: - [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware-for-surface)
Installation files for administrative tools, drivers for accessories, and updates for Windows are also available for some devices. ## Deploying MSI files -Driver and firmware updates for Surface devices containing all required cumulative updates are packaged in separate MSI files for specific versions of Windows 10. -In the name of each of these files you will find a Windows build number, this number indicates the minimum supported build required to install the drivers and firmware contained within. Refer to [Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information) for a list of the build numbers for each version. For example, to install the drivers contained in SurfacePro6_Win10_16299_1900307_0.msi file you must have Windows 10 Fall Creators Update version 1709, or newer installed on your Surface Pro 6. +Driver and firmware updates for Surface devices consisting of all required cumulative updates are packaged in separate MSI files for specific versions of Windows 10. +The MSI file names contain useful information including the minimum supported Windows build number required to install the drivers and firmware. For example, to install the drivers contained in SurfaceBook_Win10_17763_19.080.2031.0.msi requires Windows 10 Fall Creators Update version 1709 or later installed on your Surface Book. + +To view build numbers for each version, refer to [Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information). ### Surface MSI naming convention -Each .MSI file is named in accordance with a formula that begins with the product and Windows release information, followed by the Windows build number and version number, and ending with the revision of version number. SurfacePro6_Win10_16299_1900307_0.msi is classified as follows: +Beginning in August 2019, MSI files use the following naming formula: + +- Product > Windows release > Windows build number > Version number > Revision of version number (typically zero). + +**Example:** +SurfacePro6_Win10_18362_19.073.44195_0.msi : + +| Product | Windows release | Build | Version | Revision of version | +| --- | --- | --- | --- | --- | +| SurfacePro6 | Win10 | 18362 | 19.073.44195 | 0 | +| | | | Indicates key date and sequence information. | Indicates release history of the update. | +| | | | **19:** Signifies the year (2019).
**073**: Signifies the month (July) and week of the release (3).
**44195**: Signifies the minute of the month that the MSI file was created. |**0:** Signifies it's the first release of version 1907344195 and has not been re-released for any reason. | + +### Legacy Surface MSI naming convention +Legacy MSI files prior to August 2019 followed the same overall naming formula but used a different method to derive the version number. **Example:** SurfacePro6_Win10_16299_1900307_0.msi : @@ -39,8 +55,8 @@ SurfacePro6_Win10_16299_1900307_0.msi : | Product | Windows release | Build | Version | Revision of version | | --- | --- | --- | --- | --- | | SurfacePro6 | Win10 | 16299 | 1900307 | 0 | -| | | | Indicates key date and sequence information | Indicates release history of the MSI file | -| | | | **19:** Signifies the year (2019)
**003**: Signifies that it’s the third release of 2019
**07**: Signifies the product version number. (Surface Pro 6 is officially the seventh version of Surface Pro.) | **0:** Signifies it's the first release of version 1900307 and has not been re-released for any reason. | +| | | | Indicates key date and sequence information. | Indicates release history of the MSI file. | +| | | | **19:** Signifies the year (2019)
**003**: Signifies that it’s the third release of 2019.
**07**: Signifies the product version number. (Surface Pro 6 is officially the seventh version of Surface Pro.) | **0:** Signifies it's the first release of version 1900307 and has not been re-released for any reason. | Look to the **version** number to determine the latest files that contain the most recent security updates. For example, you might need to install the newest file from the following list: @@ -52,22 +68,13 @@ Look to the **version** number to determine the latest files that contain the mo The first file — SurfacePro6_Win10_16299_1900307_0.msi — is the newest because its VERSION field has the newest build in 2019; the other files are from 2018. ## Supported devices -Downloadable MSI files are available for Surface devices from Surface Pro 2 and later. +Downloadable MSI files are available for Surface devices from Surface Pro 2 and later. - -[!NOTE] -There are no downloadable firmware or driver updates available for Surface devices with Windows RT, including Surface RT and Surface 2. Updates can only be applied using Windows Update. +>[!NOTE] +>There are no downloadable firmware or driver updates available for Surface devices with Windows RT, including Surface RT and Surface 2. Updates can only be applied using Windows Update. For more information about deploying Surface drivers and firmware, refer to: -- [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates). - -- [Microsoft Surface support for business](https://www.microsoft.com/surface/support/business). - - -  - - - - +- [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates) +- [Microsoft Surface support for business](https://www.microsoft.com/surface/support/business) diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md index ea5592fb85..258912cc3d 100644 --- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md +++ b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md @@ -55,7 +55,7 @@ Before you can perform a deployment with MDT, you must first supply a set of ope >[!NOTE] ->The installation media generated from the [Get Windows 10](https://www.microsoft.com/en-us/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT. +>The installation media generated from the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT. #### Windows Server @@ -64,7 +64,7 @@ Although MDT can be installed on a Windows client, to take full advantage of Win >[!NOTE] ->To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/en-us/evalcenter). +>To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/evalcenter). #### Windows Deployment Services @@ -82,7 +82,7 @@ Because customizations are performed by MDT at the time of deployment, the goal >[!NOTE] ->Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library. Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center. +>Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library. Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center. #### Surface firmware and drivers diff --git a/devices/surface/docfx.json b/devices/surface/docfx.json index 75607e9f4d..026be430c1 100644 --- a/devices/surface/docfx.json +++ b/devices/surface/docfx.json @@ -25,7 +25,9 @@ "breadcrumb_path": "/surface/breadcrumb/toc.json", "ROBOTS": "INDEX, FOLLOW", "ms.technology": "windows", + "audience": "ITPro", "ms.topic": "article", + "manager": "laurawi", "ms.date": "05/09/2017", "feedback_system": "GitHub", "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", diff --git a/devices/surface/images/wifi-band.png b/devices/surface/images/wifi-band.png new file mode 100644 index 0000000000..38681a9dc8 Binary files /dev/null and b/devices/surface/images/wifi-band.png differ diff --git a/devices/surface/images/wifi-roaming.png b/devices/surface/images/wifi-roaming.png new file mode 100644 index 0000000000..eb539c9bd6 Binary files /dev/null and b/devices/surface/images/wifi-roaming.png differ diff --git a/devices/surface/ltsb-for-surface.md b/devices/surface/ltsb-for-surface.md index d7e5bdc7d7..225135d993 100644 --- a/devices/surface/ltsb-for-surface.md +++ b/devices/surface/ltsb-for-surface.md @@ -1,5 +1,5 @@ --- -title: Long-Term Servicing Branch for Surface devices (Surface) +title: Long-Term Servicing Channel for Surface devices (Surface) description: LTSB is not supported for general-purpose Surface devices and should be used for specialized devices only. ms.prod: w10 ms.mktglfcycl: manage @@ -8,26 +8,25 @@ ms.sitesec: library author: dansimp ms.author: dansimp ms.topic: article -ms.date: 04/25/2017 ms.reviewer: manager: dansimp --- -# Long-Term Servicing Branch (LTSB) for Surface devices +# Long-Term Servicing Channel (LTSC) for Surface devices >[!WARNING] >For updated information on this topic, see [Surface device compatibility with Windows 10 Long-Term Servicing Channel](surface-device-compatibility-with-windows-10-ltsc.md). For additional information on this update, see the [Documentation Updates for Surface and Windows 10 LTSB Compatibility](https://blogs.technet.microsoft.com/surface/2017/04/11/documentation-updates-for-surface-and-windows-10-ltsb-compatibility) post on the Surface Blog for IT Pros. -General-purpose Surface devices running Long-Term Servicing Branch (LTSB) are not supported. As a general guideline, if a Surface device runs productivity software, such as Microsoft Office, it is a general-purpose device that does not qualify for LTSB and should instead run Current Branch (CB) or Current Branch for Business (CBB). +General-purpose Surface devices in the Long-Term Servicing Channel (LTSC) are not supported. As a general guideline, if a Surface device runs productivity software, such as Microsoft Office, it is a general-purpose device that does not qualify for LTSC and should instead be on the Semi-Annual Channel. >[!NOTE] >For more information about the servicing branches, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview). -LTSB prevents Surface devices from receiving critical Windows 10 feature updates and certain non-security servicing updates. Customers with poor experiences using Surface devices in the LTSB configuration will be instructed to upgrade to CB or CBB. Furthermore, the Windows 10 Enterprise LTSB edition removes core features of Surface devices, including seamless inking and touch-friendly applications. It does not contain key in-box applications including Microsoft Edge, OneNote, Calendar or Camera. Therefore, productivity is impacted and functionality is limited. LTSB is not supported as a suitable servicing solution for general-purpose Surface devices. +LTSC prevents Surface devices from receiving critical Windows 10 feature updates and certain non-security servicing updates. Customers with poor experiences using Surface devices in the LTSC configuration will be instructed to switch to the Semi-Annual Channel. Furthermore, the Windows 10 Enterprise LTSB edition removes core features of Surface devices, including seamless inking and touch-friendly applications. It does not contain key in-box applications including Microsoft Edge, OneNote, Calendar or Camera. Therefore, productivity is impacted and functionality is limited. LTSC is not supported as a suitable servicing solution for general-purpose Surface devices. -General-purpose Surface devices are intended to run CB or CBB to receive full servicing and firmware updates and forward compatibility with the introduction of new Surface features. With CB, feature updates are available as soon as Microsoft releases them. Customers in the CBB servicing model receive the same build of Windows 10 as those in CB, at a later date. +General-purpose Surface devices are intended to run on the Semi-Annual Channel to receive full servicing and firmware updates and forward compatibility with the introduction of new Surface features. In the Semi-Annual Channel, feature updates are available as soon as Microsoft releases them. -Surface devices in specialized scenarios–such as PCs that control medical equipment, point-of-sale systems, and ATMs–may consider the use of LTSB. These special-purpose systems typically perform a single task and do not require feature updates as frequently as other devices in the organization. +Surface devices in specialized scenarios–such as PCs that control medical equipment, point-of-sale systems, and ATMs–might consider the use of LTSC. These special-purpose systems typically perform a single task and do not require feature updates as frequently as other devices in the organization. diff --git a/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md b/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md index 6dcd9db277..ede174d674 100644 --- a/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md +++ b/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md @@ -9,6 +9,7 @@ ms.author: dansimp ms.topic: article ms.reviewer: manager: dansimp +ms.date: 08/21/2019 --- # Best practice power settings for Surface devices @@ -25,10 +26,14 @@ low power idle state (S0ix). To ensure Surface devices across your organization fully benefit from Surface power optimization features: -- Exclude Surface devices from any existing power management policy settings and let the Surface default policy control the power policy and behavior of the device. -- If you must manage the power profile of devices across your network (such as in highly managed organizations), use the powercfg command tool to export the power profile from the factory image of the Surface device and then import it into the provisioning package for your Surface devices. For more information, refer to [Configure power settings](https://docs.microsoft.com/windows-hardware/customize/power-settings/configure-power-settings). -- Always use the newest available version of the drivers and firmware for your devices and for the version of Windows 10 they're running. For more information, refer to [Deploying the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) -- Avoid creating custom power profiles or adjusting advanced power settings not visible in the default UI (**System** > **Power & sleep**). For more information, refer to User best practices for extended battery life in this document. +- Install the latest drivers and firmware from Windows Update or the Surface Driver and Firmware MSI. This creates the balanced power plan (aka power profile) by default and configures optimal power settings. For more information, refer to [Deploying the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md). +- Avoid creating custom power profiles or adjusting advanced power settings not visible in the default UI (**System** > **Power & sleep**). +- If you must manage the power profile of devices across your network (such as in highly managed organizations), use the powercfg command tool to export the power plan from the factory image of the Surface device and then import it into the provisioning package for your Surface devices. + +>[!NOTE] +>You can only export a power plan across the same type of Surface device. For example, you cannot export a power plan from Surface Laptop and import it on Surface Pro. For more information, refer to [Configure power settings](https://docs.microsoft.com/windows-hardware/customize/power-settings/configure-power-settings). + +- Exclude Surface devices from any existing power management policy settings. ## Background @@ -59,14 +64,14 @@ instant on/instant off functionality typical of smartphones. S0ix, also known as Deepest Runtime Idle Platform State (DRIPS), is the default power mode for Surface devices. Modern standby has two modes: - - **Connected standby.** The default mode for up-to-the minute - delivery of emails, messaging, and cloud-synced data, connected - standby keeps Wi-Fi on and maintains network connectivity. +- **Connected standby.** The default mode for up-to-the minute + delivery of emails, messaging, and cloud-synced data, connected + standby keeps Wi-Fi on and maintains network connectivity. - - **Disconnected standby.** An optional mode for extended battery - life, disconnected standby delivers the same instant-on experience - and saves power by turning off Wi-Fi, Bluetooth, and related network - connectivity. +- **Disconnected standby.** An optional mode for extended battery + life, disconnected standby delivers the same instant-on experience + and saves power by turning off Wi-Fi, Bluetooth, and related network + connectivity. To learn more about modern standby, refer to the [Microsoft Hardware Dev Center](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby-wake-sources). @@ -76,13 +81,13 @@ Center](https://docs.microsoft.com/windows-hardware/design/device-experiences/mo Surface integrates the following features designed to help users optimize the power management experience: - - [Singular power plan](#singular-power-plan) +- [Singular power plan](#singular-power-plan) - - [Simplified power settings user - interface](#simplified-power-settings-user-interface) +- [Simplified power settings user + interface](#simplified-power-settings-user-interface) - - [Windows performance power - slider](#windows-performance-power-slider) +- [Windows performance power + slider](#windows-performance-power-slider) ### Singular power plan @@ -171,4 +176,4 @@ To learn more, see: - [Battery saver](https://docs.microsoft.com/windows-hardware/design/component-guidelines/battery-saver) -- [Deploying the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) \ No newline at end of file +- [Deploying the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) diff --git a/devices/surface/manage-surface-pro-3-firmware-updates.md b/devices/surface/manage-surface-pro-3-firmware-updates.md index 0913c4266d..e37749103c 100644 --- a/devices/surface/manage-surface-pro-3-firmware-updates.md +++ b/devices/surface/manage-surface-pro-3-firmware-updates.md @@ -62,16 +62,3 @@ The individual driver files are also made available in the Microsoft Download Ce **Windows PE and Surface firmware and drivers** A best practice for deployment with any solution that uses the Windows Preinstallation Environment (WinPE), such as System Center Configuration Manager or MDT, is to configure WinPE with only the drivers that are required during the WinPE stage of deployment. These usually include drivers for network adapters and storage controllers. This best practice helps to prevent errors with more complex drivers that rely on components that are not present in WinPE. For Surface Pro 3 devices, this is especially true of the Touch Firmware. The Touch Firmware should never be loaded in a WinPE environment on Surface Pro 3. - -**Update Surface Pro 3 firmware offline through USB** - -In some early versions of Surface Pro 3 firmware, PXE boot performance can be quite slow. This has been resolved with updated firmware, but for organizations where firmware will be updated through operating system deployment, this issue is encountered before the updates can be deployed to the device. In this scenario, you can deploy updated firmware through a USB drive to ensure that when the operating system deployment is initiated, the network boot is quick, and deployment can complete in a timely fashion. To create a USB drive to update Surface Pro 3 firmware, see [How to Update the Surface Pro 3 Firmware Offline using a USB Drive](https://blogs.technet.microsoft.com/askpfeplat/2014/10/19/how-to-update-the-surface-pro-3-firmware-offline-using-a-usb-drive/) on the Ask Premier Field Engineering (PFE) Platforms TechNet Blog. - -  - -  - - - - - diff --git a/devices/surface/microsoft-surface-brightness-control.md b/devices/surface/microsoft-surface-brightness-control.md index 34ccb3aa18..41b2e3d994 100644 --- a/devices/surface/microsoft-surface-brightness-control.md +++ b/devices/surface/microsoft-surface-brightness-control.md @@ -25,16 +25,16 @@ designed to help reduce thermal load and lower the overall carbon footprint for deployed Surface devices. The tool automatically dims the screen when not in use and includes the following configuration options: - - Period of inactivity before dimming the display. +- Period of inactivity before dimming the display. - - Brightness level when dimmed. +- Brightness level when dimmed. - - Maximum brightness level when in use. +- Maximum brightness level when in use. **To run Surface Brightness Control:** - - Install surfacebrightnesscontrol.msi on the target device and Surface Brightness Control - will begin working immediately. +- Install surfacebrightnesscontrol.msi on the target device and Surface Brightness Control + will begin working immediately. ## Configuring Surface Brightness Control diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md index 3688553be3..a2d74d331c 100644 --- a/devices/surface/microsoft-surface-data-eraser.md +++ b/devices/surface/microsoft-surface-data-eraser.md @@ -68,7 +68,7 @@ Some scenarios where Microsoft Surface Data Eraser can be helpful include: To create a Microsoft Surface Data Eraser USB stick, first install the Microsoft Surface Data Eraser setup tool from the Microsoft Download Center using the link provided at the beginning of this article. You do not need a Surface device to *create* the USB stick. After you have downloaded the installation file to your computer, follow these steps to install the Microsoft Surface Data Eraser creation tool: -1. Run the DataEraserSetup.msi installation file that you downloaded from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=46703). +1. Run the DataEraserSetup.msi installation file that you downloaded from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=46703). 2. Select the check box to accept the terms of the license agreement, and then click **Install**. diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md index 2d0b406711..956924345f 100644 --- a/devices/surface/step-by-step-surface-deployment-accelerator.md +++ b/devices/surface/step-by-step-surface-deployment-accelerator.md @@ -61,8 +61,8 @@ The following steps show you how to create a deployment share for Windows 10 tha >[!NOTE] >As of SDA version 1.96.0405, SDA will install only the components of the Windows ADK that are required for deployment, as follows: > * Deployment tools - > * User State Migration Tool (USMT) - > * Windows Preinstallation Environment (WinPE) + > * User State Migration Tool (USMT) + > * Windows Preinstallation Environment (WinPE) > [!NOTE] > As of SDA version 1.96.0405, SDA will install and use MDT 2013 Update 2. Earlier versions of SDA are compatible only with MDT 2013 Update 1. @@ -75,11 +75,11 @@ The following steps show you how to create a deployment share for Windows 10 tha - **Local Path** – Specify or browse to a location on the local storage device where you would like to store the deployment share files for the Windows 10 SDA deployment share. For example, **E:\\SDAWin10\\** is the location specified in Figure 3. - - **Share Name** – Specify a name for the file share that will be used to access the deployment share on this server from the network. For example, **SDAWin10** is the deployment share name shown in Figure 3. The local path folder is automatically shared by the SDA scripts under this name to the group **Everyone** with a permission level of **Full Control**. + - **Share Name** – Specify a name for the file share that will be used to access the deployment share on this server from the network. For example, **SDAWin10** is the deployment share name shown in Figure 3. The local path folder is automatically shared by the SDA scripts under this name to the group **Everyone** with a permission level of **Full Control**. - **Windows 10 Deployment Services** - - Select the **Import boot media into the local Windows Deployment Service** check box if you would like to boot your Surface devices from the network to perform the Windows deployment. Windows Deployment Services must be installed and configured to respond to PXE boot requests. See [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426.aspx) for more information about how to configure Windows Deployment Services for PXE boot. + - Select the **Import boot media into the local Windows Deployment Service** check box if you would like to boot your Surface devices from the network to perform the Windows deployment. Windows Deployment Services must be installed and configured to respond to PXE boot requests. See [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426.aspx) for more information about how to configure Windows Deployment Services for PXE boot. - **Windows 10 Source Files** @@ -100,25 +100,25 @@ The following steps show you how to create a deployment share for Windows 10 tha 7. On the **Summary** page confirm your selections and click **Finish** to begin the creation of your deployment share. The process can take several minutes as files are downloaded, the tools are installed, and the deployment share is created. While the SDA scripts are creating your deployment share, an **Installation Progress** window will be displayed, as shown in Figure 5. A typical SDA process includes: - - Download of Windows ADK + - Download of Windows ADK - - Installation of Windows ADK + - Installation of Windows ADK - - Download of MDT + - Download of MDT - - Installation of MDT + - Installation of MDT - - Download of Surface apps and drivers + - Download of Surface apps and drivers - - Creation of the deployment share + - Creation of the deployment share - - Import of Windows installation files into the deployment share + - Import of Windows installation files into the deployment share - - Import of the apps and drivers into the deployment share + - Import of the apps and drivers into the deployment share - - Creation of rules and task sequences for Windows deployment + - Creation of rules and task sequences for Windows deployment - ![The installation progress window](images/sdasteps-fig5-installwindow.png "The installation progress window") + ![The installation progress window](images/sdasteps-fig5-installwindow.png "The installation progress window") *Figure 5. The Installation Progress window* diff --git a/devices/surface/support-solutions-surface.md b/devices/surface/support-solutions-surface.md index a6099038b0..5cc8e9de9d 100644 --- a/devices/surface/support-solutions-surface.md +++ b/devices/surface/support-solutions-surface.md @@ -25,7 +25,7 @@ These are the top Microsoft Support solutions for common issues experienced when ## Screen cracked or scratched issues -- [Cracked screen and physical damage](https://www.microsoft.com/surface/support/warranty-service-and-recovery/surface-is-damaged) +- [Contact Microsoft Support](https://support.microsoft.com/en-us/supportforbusiness/productselection) ## Device cover or keyboard issues diff --git a/devices/surface/surface-diagnostic-toolkit-for-business-intro.md b/devices/surface/surface-diagnostic-toolkit-for-business-intro.md index 83613f4a36..293aeafe93 100644 --- a/devices/surface/surface-diagnostic-toolkit-for-business-intro.md +++ b/devices/surface/surface-diagnostic-toolkit-for-business-intro.md @@ -29,14 +29,13 @@ Before you run the diagnostic tool, make sure you have the latest Windows update **To run the Surface Diagnostic Toolkit for Business:** 1. Download the [Surface Diagnostic Toolkit for Business](https://aka.ms/SDT4B). -2. Select Run and follow the on-screen instructions. - -The diagnosis and repair time averages 15 minutes but could take an hour or longer, depending on internet connection speed and the number of updates or repairs required. For more detailed information on Surface Diagnostic Toolkit for Business, refer to [Deploy Surface Diagnostic Toolkit for Business](https://docs.microsoft.com/surface/surface-diagnostic-toolkit-business). +2. Select Run and follow the on-screen instructions. For full details, refer to [Deploy Surface Diagnostic Toolkit for Business](https://docs.microsoft.com/surface/surface-diagnostic-toolkit-business). +The diagnosis and repair time averages 15 minutes but could take an hour or longer, depending on internet connection speed and the number of updates or repairs required. # If you still need help If the Surface Diagnostic Toolkit for Business didn’t fix the problem, you can also: -- Make an in-store appointment: We might be able to fix the problem or provide a replacement Surface at your local Microsoft Store. [Locate a Microsoft Store near you](https://www.microsoft.com/en-us/store/locations/find-a-store?WT.mc_id=MSC_Solutions_en_us_scheduleappt). +- Make an in-store appointment: We might be able to fix the problem or provide a replacement Surface at your local Microsoft Store. [Locate a Microsoft Store near you](https://www.microsoft.com/store/locations/find-a-store?WT.mc_id=MSC_Solutions_en_us_scheduleappt). - Contact customer support: If you want to talk to someone about how to fix your problem, [contact us](https://support.microsoft.com/en-us/help/4037645/contact-surface-warranty-and-software-support-for-business). - Get your Surface serviced: If your Surface product needs service, [request it online](https://mybusinessservice.surface.com/). diff --git a/devices/surface/surface-enterprise-management-mode.md b/devices/surface/surface-enterprise-management-mode.md index df65b6c73d..5944375042 100644 --- a/devices/surface/surface-enterprise-management-mode.md +++ b/devices/surface/surface-enterprise-management-mode.md @@ -226,7 +226,9 @@ create a reset package using PowerShell to reset SEMM. ## Version History - +### Version 2.54.139.0 +* Support to Surface Hub 2S +* Bug fixes ### Version 2.43.136.0 * Support to enable/disable simulatenous multithreating diff --git a/devices/surface/surface-wireless-connect.md b/devices/surface/surface-wireless-connect.md new file mode 100644 index 0000000000..fe1ff34fe6 --- /dev/null +++ b/devices/surface/surface-wireless-connect.md @@ -0,0 +1,84 @@ +--- +title: Optimizing wireless connectivity for Surface devices +description: This topic provides guidance around recommended wireless connectivity settings for network admins and users. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.topic: article +ms.date: 08/15/2019 +ms.reviewer: +manager: dansimp +--- +# Optimizing wireless connectivity for Surface devices + +## Introduction + +To stay connected with all-day battery life, Surface devices implement wireless connectivity settings that balance performance and power conservation. Outside of the most demanding mobility scenarios, users can maintain sufficient wireless connectivity without modifying default network adapter or related settings. + +In congested network environments, organizations can implement purpose-built wireless protocols across multiple network access points to facilitate roaming. This page highlights key wireless connectivity considerations in mobile scenarios utilizing Surface Pro 3 and later, Surface Book, Surface Laptop, and Surface Go. + +## Prerequisites + +This document assumes you have successfully deployed a wireless network that supports 802.11n (Wi-Fi 4) or later in accordance with best practice recommendations from leading equipment vendors. + +## Configuring access points for optimal roaming capabilities + +If you’re managing a wireless network that’s typically accessed by many different types of client devices, it’s recommended to enable specific protocols on access points (APs) in your WLAN, as described in [Fast Roaming with 802.11k, 802.11v, and 802.11r](https://docs.microsoft.com/en-us/windows-hardware/drivers/network/fast-roaming-with-802-11k--802-11v--and-802-11r). Surface devices can take advantage of the following wireless protocols: + +- **802.11r.** “**Fast BSS Transition”** accelerates connecting to new wireless access points by reducing the number of frames required before your device can access another AP as you move around with your device. +- **802.11k.** **“Neighbor Reports”** provides devices with information on current conditions at neighboring access points. It can help your Surface device choose the best AP using criteria other than signal strength such as AP utilization. + +Surface Go devices can also use 802.11v “BSS Transition Management Frames,” which functions much like 802.11k in providing information on nearby candidate APs. + +## Managing user settings + +You can achieve optimal roaming capabilities through a well-designed network that supports 802.11r and 802.11k across all access points. Ensuring that your network is properly configured to provide users with the best wireless experience is the recommended approach versus attempting to manage user settings on individual devices. Moreover, in many corporate environments Surface device users won’t be able to access advanced network adapter settings without explicit permissions or local admin rights. In other lightly managed networks, users can benefit by knowing how specific settings can impact their ability to remain connected. + +### Recommended user settings and best practices + +In certain situations, modifying advanced network adapter settings built into Surface devices may facilitate a more reliable connection. Keep in mind however that an inability to connect to wireless resources is more often due to an access point issue, networking design flaw, or environmental site issue. + +> [!NOTE] +> How you hold your Surface Pro or Surface Go can also affect signal strength. If you’re experiencing a loss of bandwidth, check that you’re not holding the top of the display, where the Wi-Fi radio receiver is located. Although holding the top of the display does not block wireless signals, it can trigger the device driver to initiate changes that reduce connectivity. + +### Keep default Auto setting for dual bandwidth capability +On most Surface devices, you can configure client network adapter settings to only connect to wireless APs over 5 gigahertz (GHz), only connect over 2.4 GHz, or let the operating system choose the best option (default Auto setting). + +**To access network adapter settings go to:** + +- **Start** > **Control panel** > **Network and Sharing Center** > **your Wi-Fi adapter** > **Properties** > **Configure** > **Advanced**. + +![* wifi-band settings*](images/wifi-band.png)
+ +Keep in mind that 2.4 GHz has some advantages over 5 GHz: It extends further and more easily penetrates through walls or other solid objects. Unless you have a clear use case that warrants connecting to 5 GHz, it’s recommended to leave the Band setting in the default state to avoid possible adverse consequences. For example: + + +- Many hotspots found in hotels, coffee shops, and airports still only use 2.4 GHz, effectively blocking access to devices if Band is set to 5 GHz Only. +- Since Miracast wireless display connections require the initial handshake to be completed over 2.4 GHz channels, devices won’t be able to connect at 5 GHz Only. + +> [!NOTE] +> By default Surface devices will prefer connecting to 5 GHz if available. However, to preserve power in a low battery state, Surface will first look for a 2.4 GHz connection. + +You can also toggle the band setting as needed to suit your environment. For example, users living in high density apartment buildings with multiple Wi-Fi hotspots — amid the presence of consumer devices all broadcasting via 2.4 GHz — will likely benefit by setting their Surface device to connect on 5 GHz only and then revert to Auto when needed. + +### Roaming aggressiveness settings on Surface Go + +Front-line workers using Surface Go may wish to select a signal strength threshold that prompts the device to search for a new access point when signal strength drops (roaming aggressiveness). By default, Surface devices attempt to roam to a new access point if the signal strength drops below **Medium** (50 percent signal strength). Note that whenever you increase roaming aggressiveness, you accelerate battery power consumption. + +Leave the roaming aggressiveness setting in the default state unless you’re encountering connectivity issues in specific mobile scenarios such as conducting environmental site inspections while also maintaining voice and video connectivity during a conference meeting. If you don’t notice any improvement revert to the default **Medium** state. + +**To enable roaming aggressiveness on Surface Go:** + +1. Go to **Start > Control Panel** > **Network and Internet** > **Network and Sharing Center.** +2. Under **Connections** select **Wi-Fi** and then select **Properties.** +3. Select **Client for Microsoft Networks** and then select **Configure** +4. Select **Advanced** > **Roaming Aggressiveness** and choose ****your preferred value from the drop-down menu. + +![* Roaming aggressiveness settings *](images/wifi-roaming.png)
+ +## Conclusion + +Surface devices are designed with default settings for optimal wireless connectivity balanced alongside the need to preserve battery life. The most effective way of enabling reliable connectivity for Surface devices is through a well-designed network that supports 802.11r and 802.11k. Users can adjust network adapter settings or roaming aggressiveness but should only do so in response to specific environmental factors and revert to default state if there’s no noticeable improvement. diff --git a/devices/surface/surface.yml b/devices/surface/surface.yml deleted file mode 100644 index 8287763c1e..0000000000 --- a/devices/surface/surface.yml +++ /dev/null @@ -1,61 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData -title: Surface devices -metadata: - document_id: - title: Surface devices - description: Find tools, step-by-step guides, and other resources to help you plan, deploy, and manage Surface devices in your organization. - keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories - ms.localizationpriority: medium - author: lizap - ms.author: elizapo - manager: dougkim - ms.topic: article - ms.devlang: na - -sections: -- items: - - type: markdown - text: " - Find tools, step-by-step guides, and other resources to help you plan, deploy, and manage Surface devices in your organization. - " -- title: Explore -- items: - - type: markdown - text: " - Evaluate the Surface device portfolio, review the tools and technologies for management of your Surface devices, and learn about Surface technologies and devices with engineering walkthroughs.
- -

**Surface Pro**
Light enough to take anywhere. Powerful enough to use as a full desktop workstation.
See spec
**Surface Book**
Built for extreme performance. Lightning fast access to apps. Up to 16 hours of battery life.
See spec
**Surface Studio**
Professional-grade power and performance. Use it upright or draw on it like a drafting table.
See spec
- " -- title: Plan -- items: - - type: markdown - text: " - Explore essential concepts for the deployment of Windows 10 to Surface devices.
- -

**Try Windows 10 Enterprise free for 90 days**
Try the latest features. Test your apps, hardware, and deployment strategies.
Get started
**Windows 10 upgrade paths**
Upgrade to Windows 10 from a previous version, or from one edition to another.
Explore paths
**Prepare for Windows 10 deployment**
Get familiar with current deployment options and best practices.
Review options
- " -- title: Deploy -- items: - - type: markdown - text: " - Download deployment tools and get step-by-step guidance on how to upgrade a Surface device or deploy a new image.
- -

**Microsoft Deployment Toolkit (MDT)**
Automate Windows 10 deployment, and more easily manage security and configurations.
Download the toolkit
**System Center Configuration Manager**
Use in tandem with MDT to deploy Windows 10 and manage PCs and devices moving forward.
Download an eval
**Surface Deployment Accelerator**
Automate the creation and configuration of Windows images for Surface devices.
Download the accelerator
- " -- title: Manage -- items: - - type: markdown - text: " - Learn how to more easily manage and secure Surface devices in your organization.
- -

**Manage Surface firmware and driver updates**
Download the latest firmware and drivers for Surface devices.
Manage Surface Dock Updater.
Surface update history
**Discover Surface tools for IT**
Surface Diagnostic Toolkit
Surface Data Eraser
Surface Enterprise Management Mode
Surface Pro 3 Asset Tag CLI Utility
**Manage settings and devices**
Manage Windows corporate devices
Manage Surface UEFI Settings
Bitlocker PIN on Surface Pro 3 and other tablets
Enroll and configure Surface devices with SEMM
- " -- title: Stay informed -- items: - - type: markdown - text: " - -

**Surface IT Pro Blog**
Get insight into new Surface products plus tips and tricks for IT professionals.
Learn more
**Surface on Microsoft Mechanics**
View technical demos and walkthroughs of Surface devices, features, and functionality.
Get started
**Follow us on Twitter**
Keep up with the latest news and see the latest product demonstrations.
Visit Twitter
- " diff --git a/devices/surface/update.md b/devices/surface/update.md index 0a3a4b4a5d..d68bf71ed8 100644 --- a/devices/surface/update.md +++ b/devices/surface/update.md @@ -21,23 +21,7 @@ Find out how to download and manage the latest firmware and driver updates for y | Topic | Description | | --- | --- | -|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | See how you can use Wake On LAN to remotely wake up devices to perform management or maintenance tasks, or to enable management solutions automatically. | -| [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)| Get a list of the available downloads for Surface devices and links to download the drivers and firmware for your device.| | [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md)| Explore the available options to manage firmware and driver updates for Surface devices.| +| [Deploy the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)| Find links to manually deploy firmware and drivers, outside of Windows Update. | | [Surface Dock Updater](surface-dock-updater.md)| Get a detailed walkthrough of Microsoft Surface Dock Updater.| - - -## Related topics - -[Surface TechCenter](https://technet.microsoft.com/windows/surface) - -[Surface for IT pros blog](http://blogs.technet.com/b/surface/) - - - - - - - - - +|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | See how you can use Wake On LAN to remotely wake up devices to perform management or maintenance tasks, or to enable management solutions automatically. | diff --git a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md index 72f123de7f..fc560e5345 100644 --- a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md +++ b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md @@ -14,7 +14,7 @@ ms.reviewer: manager: dansimp --- -# Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit +# Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit #### Applies to * Surface Pro 3 @@ -52,7 +52,7 @@ You will also need to have available the following resources: * Windows 10 installation files, such as the installation media downloaded from the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx) >[!NOTE] - >Installation media for use with MDT must contain a Windows image in Windows Imaging Format (.wim). Installation media produced by the [Get Windows 10](https://www.microsoft.com/en-us/software-download/windows10/) page does not use a .wim file, instead using an Electronic Software Download (.esd) file, which is not compatible with MDT. + >Installation media for use with MDT must contain a Windows image in Windows Imaging Format (.wim). Installation media produced by the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page does not use a .wim file, instead using an Electronic Software Download (.esd) file, which is not compatible with MDT. * [Surface firmware and drivers](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) for Windows 10 * Application installation files for any applications you want to install, such as the Surface app diff --git a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md index af796bd2c4..0432c65257 100644 --- a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md +++ b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md @@ -44,7 +44,7 @@ Management of SEMM with Configuration Manager requires the installation of Micro #### Download SEMM scripts for Configuration Manager -After Microsoft Surface UEFI Manager is installed on the client Surface device, SEMM is deployed and managed with PowerShell scripts. You can download samples of the [SEMM management scripts](https://www.microsoft.com/en-us/download/details.aspx?id=46703) from the Download Center. +After Microsoft Surface UEFI Manager is installed on the client Surface device, SEMM is deployed and managed with PowerShell scripts. You can download samples of the [SEMM management scripts](https://www.microsoft.com/download/details.aspx?id=46703) from the Download Center. ## Deploy Microsoft Surface UEFI Manager @@ -103,39 +103,45 @@ The sample scripts include examples of how to set Surface UEFI settings and how ### Specify certificate and package names -The first region of the script that you need to modify is the portion that specifies and loads the SEMM certificate, and also indicates the names for the SEMM configuration package and SEMM reset package. The certificate and package names are specified on lines 56 through 67 in the ConfigureSEMM.ps1 script: +The first region of the script that you need to modify is the portion that specifies and loads the SEMM certificate, and also indicates SurfaceUEFIManager version, the names for the SEMM configuration package and SEMM reset package. The certificate name and SurfaceUEFIManager version are specified on lines 56 through 73 in the ConfigureSEMM.ps1 script: ``` 56 $WorkingDirPath = split-path -parent $MyInvocation.MyCommand.Definition 57 $packageRoot = "$WorkingDirPath\Config" - 58 - 59 if (-not (Test-Path $packageRoot)) { New-Item -ItemType Directory -Force -Path $packageRoot } - 60 Copy-Item "$WorkingDirPath\FabrikamOwnerSigner.pfx" $packageRoot - 61 - 62 $privateOwnerKey = Join-Path -Path $packageRoot -ChildPath "FabrikamOwnerSigner.pfx" - 63 $ownerPackageName = Join-Path -Path $packageRoot -ChildPath "FabrikamSignerProvisioningPackage.pkg" - 64 $resetPackageName = Join-Path -Path $packageRoot -ChildPath "FabrikamUniversalResetPackage.pkg" - 65 - 66 # If your PFX file requires a password then it can be set here, otherwise use a blank string. - 67 $password = "1234" + 58 $certName = "FabrikamSEMMSample.pfx" + 59 $DllVersion = "2.26.136.0" + 60 + 61 $certNameOnly = [System.IO.Path]::GetFileNameWithoutExtension($certName) + 62 $ProvisioningPackage = $certNameOnly + "ProvisioningPackage.pkg" + 63 $ResetPackage = $certNameOnly + "ResetPackage.pkg" + 64 + 65 if (-not (Test-Path $packageRoot)) { New-Item -ItemType Directory -Force -Path $packageRoot } + 66 Copy-Item "$WorkingDirPath\$certName" $packageRoot + 67 + 68 $privateOwnerKey = Join-Path -Path $packageRoot -ChildPath $certName + 69 $ownerPackageName = Join-Path -Path $packageRoot -ChildPath $ProvisioningPackage + 70 $resetPackageName = Join-Path -Path $packageRoot -ChildPath $ResetPackage + 71 + 72 # If your PFX file requires a password then it can be set here, otherwise use a blank string. + 73 $password = "1234" ``` -Replace the **FabrikamOwnerSigner.pfx** value for the **$privateOwnerKey** variable with the name of your SEMM Certificate file on both lines 60 and 62. The script will create a working directory (named Config) in the folder where your scripts are located, and will then copy the certificate file to this working directory. +Replace the **FabrikamSEMMSample.pfx** value for the **$certName** variable with the name of your SEMM Certificate file on line 58. The script will create a working directory (named Config) in the folder where your scripts are located, and will then copy the certificate file to this working directory. -Replace the **FabrikamSignerProvisioningPackage.pkg** and **FabrikamUniversalResetPackage.pkg** values on lines 63 and 64 to define the **$ownerPackageName** and **$resetPackageName** variables with your desired names for the SEMM configuration and reset packages. These packages will also be created in the Config directory and hold the configuration for Surface UEFI settings and permissions generated by the script. +Owner package and reset package will also be created in the Config directory and hold the configuration for Surface UEFI settings and permissions generated by the script. -On line 67, replace the value of the **$password** variable, from 1234, to the password for your certificate file. If a password is not required, delete the **1234** text. +On line 73, replace the value of the **$password** variable, from 1234, to the password for your certificate file. If a password is not required, delete the **1234** text. >[!Note] ->The last two characters of the certificate thumbprint are required to enroll a device in SEMM. This script will display these digits to the user, which allows the user or technician to record these digits before the system reboots to enroll the device in SEMM. The script uses the following code, found on lines 144-149, to accomplish this: +>The last two characters of the certificate thumbprint are required to enroll a device in SEMM. This script will display these digits to the user, which allows the user or technician to record these digits before the system reboots to enroll the device in SEMM. The script uses the following code, found on lines 150-155, to accomplish this: ``` -144 # Device owners will need the last two characters of the thumbprint to accept SEMM ownership. -145 # For convenience we get the thumbprint here and present to the user. -146 $pw = ConvertTo-SecureString $password -AsPlainText -Force -147 $certPrint = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 -148 $certPrint.Import($privateOwnerKey, $pw, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::DefaultKeySet) -149 Write-Host "Thumbprint =" $certPrint.Thumbprint +150 # Device owners will need the last two characters of the thumbprint to accept SEMM ownership. +151 # For convenience we get the thumbprint here and present to the user. +152 $pw = ConvertTo-SecureString $password -AsPlainText -Force +153 $certPrint = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 +154 $certPrint.Import($privateOwnerKey, $pw, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::DefaultKeySet) +155 Write-Host "Thumbprint =" $certPrint.Thumbprint ``` Administrators with access to the certificate file (.pfx) can read the thumbprint at any time by opening the .pfx file in CertMgr. To view the thumbprint with CertMgr, follow this process: @@ -153,46 +159,47 @@ Administrators with access to the certificate file (.pfx) can read the thumbprin ### Configure permissions -The first region of the script where you will specify the configuration for Surface UEFI is the **Configure Permissions** region. This region begins at line 202 in the sample script with the comment **# Configure Permissions** and continues to line 238. The following code fragment first sets permissions to all Surface UEFI settings so that they may be modified by SEMM only, then adds explicit permissions to allow the local user to modify the Surface UEFI password, TPM, and front and rear cameras: +The first region of the script where you will specify the configuration for Surface UEFI is the **Configure Permissions** region. This region begins at line 210 in the sample script with the comment **# Configure Permissions** and continues to line 247. The following code fragment first sets permissions to all Surface UEFI settings so that they may be modified by SEMM only, then adds explicit permissions to allow the local user to modify the Surface UEFI password, TPM, and front and rear cameras: ``` -202 # Configure Permissions -203 foreach ($uefiV2 IN $surfaceDevices.Values) { -204 # Here we define which "identities" will be allowed to modify which settings -205 # PermissionSignerOwner = The primary SEMM enterprise owner identity -206 # PermissionLocal = The user when booting to the UEFI pre-boot GUI -207 # PermissionSignerUser, PermissionSignerUser1, PermissionSignerUser2 = -208 # Additional user identities created so that the signer owner -209 # can delegate permission control for some settings. -210 $ownerOnly = [Microsoft.Surface.IUefiSetting]::PermissionSignerOwner -211 $ownerAndLocalUser = ([Microsoft.Surface.IUefiSetting]::PermissionSignerOwner -bor [Microsoft.Surface.IUefiSetting]::PermissionLocal) -212 -213 # Make all permissions owner only by default -214 foreach ($setting IN $uefiV2.Settings.Values) { -215 $setting.ConfiguredPermissionFlags = $ownerOnly -216 } -217 # Allow the local user to change their own password -218 $uefiV2.SettingsById[501].ConfiguredPermissionFlags = $ownerAndLocalUser -219 -220 # Allow the local user to change the state of the TPM -221 $uefiV2.Settings["Trusted Platform Module (TPM)"].ConfiguredPermissionFlags = $ownerAndLocalUser -222 -223 # Allow the local user to change the state of the Front and Rear cameras -224 $uefiV2.SettingsById[302].ConfiguredPermissionFlags = $ownerAndLocalUser -225 $uefiV2.SettingsById[304].ConfiguredPermissionFlags = $ownerAndLocalUser -226 -227 -228 # Create a unique package name based on family and LSV. -229 # We will choose a name that can be parsed by later scripts. -230 $packageName = $uefiV2.SurfaceUefiFamily + "^Permissions^" + $lsv + ".pkg" -231 $fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName -232 -233 # Build and sign the Permission package then save it to a file. -234 $permissionPackageStream = $uefiV2.BuildAndSignPermissionPackage($privateOwnerKey, $password, "", $null, $lsv) -235 $permissionPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write) -236 $permissionPackageStream.CopyTo($permissionPackage) -237 $permissionPackage.Close() -238 } +210 # Configure Permissions +211 foreach ($uefiV2 IN $surfaceDevices.Values) { +212 if ($uefiV2.SurfaceUefiFamily -eq $Device.Model) { +213 Write-Host "Configuring permissions" +214 Write-Host $Device.Model +215 Write-Host "=======================" +216 +217 # Here we define which "identities" will be allowed to modify which settings +218 # PermissionSignerOwner = The primary SEMM enterprise owner identity +219 # PermissionLocal = The user when booting to the UEFI pre-boot GUI +220 # PermissionSignerUser, PermissionSignerUser1, PermissionSignerUser2 = +221 # Additional user identities created so that the signer owner +222 # can delegate permission control for some settings. +223 $ownerOnly = [Microsoft.Surface.IUefiSetting]::PermissionSignerOwner +224 $ownerAndLocalUser = ([Microsoft.Surface.IUefiSetting]::PermissionSignerOwner -bor [Microsoft.Surface.IUefiSetting]::PermissionLocal) +225 +226 # Make all permissions owner only by default +227 foreach ($setting IN $uefiV2.Settings.Values) { +228 $setting.ConfiguredPermissionFlags = $ownerOnly +229 } +230 +231 # Allow the local user to change their own password +232 $uefiV2.SettingsById[501].ConfiguredPermissionFlags = $ownerAndLocalUser +233 +234 Write-Host "" +235 +236 # Create a unique package name based on family and LSV. +237 # We will choose a name that can be parsed by later scripts. +238 $packageName = $uefiV2.SurfaceUefiFamily + "^Permissions^" + $lsv + ".pkg" +239 $fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName +240 +241 # Build and sign the Permission package then save it to a file. +242 $permissionPackageStream = $uefiV2.BuildAndSignPermissionPackage($privateOwnerKey, $password, "", $null, $lsv) +243 $permissionPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write) +244 $permissionPackageStream.CopyTo($permissionPackage) +245 $permissionPackage.Close() +246 } +247 } ``` Each **$uefiV2** variable identifies a Surface UEFI setting by setting name or ID, and then configures the permissions to one of the following values: @@ -204,74 +211,174 @@ You can find information about the available settings names and IDs for Surface ### Configure settings -The second region of the script where you will specify the configuration for Surface UEFI is the **Configure Settings** region of the ConfigureSEMM.ps1 script, which configures whether each setting is enabled or disabled. The sample script includes instructions to set all settings to their default values. The script then provides explicit instructions to disable IPv6 for PXE Boot and to leave the Surface UEFI Administrator password unchanged. You can find this region beginning with the **# Configure Settings** comment at line 282 through line 312 in the sample script. The region appears as follows: +The second region of the script where you will specify the configuration for Surface UEFI is the **Configure Settings** region of the ConfigureSEMM.ps1 script, which configures whether each setting is enabled or disabled. The sample script includes instructions to set all settings to their default values. The script then provides explicit instructions to disable IPv6 for PXE Boot and to leave the Surface UEFI Administrator password unchanged. You can find this region beginning with the **# Configure Settings** comment at line 291 through line 335 in the sample script. The region appears as follows: ``` -282 # Configure Settings -283 foreach ($uefiV2 IN $surfaceDevices.Values) { -284 # In this demo, we will start by setting every setting to the default factory setting. -285 # You may want to start by doing this in your scripts -286 # so that every setting gets set to a known state. -287 foreach ($setting IN $uefiV2.Settings.Values) { -288 $setting.ConfiguredValue = $setting.DefaultValue -289 } -290 -291 # If you want to set something to a different value from the default, -292 # here are examples of how to accomplish this. -293 $uefiV2.Settings["IPv6 for PXE Boot"].ConfiguredValue = "Disabled" -294 -295 # If you want to leave the setting unmodified, set it to $null -296 # PowerShell has issues setting things to $null so ClearConfiguredValue() -297 # is supplied to do this explicitly. -298 # Here is an example of leaving the UEFI administrator password as-is, -299 # even after we initially set it to factory default above. -300 $uefiV2.SettingsById[501].ClearConfiguredValue() -301 -302 # Create a unique package name based on family and LSV. -303 # We will choose a name that can be parsed by later scripts. -304 $packageName = $uefiV2.SurfaceUefiFamily + "^Settings^" + $lsv + ".pkg" -305 $fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName -306 -307 # Build and sign the Settings package then save it to a file. -308 $settingsPackageStream = $uefiV2.BuildAndSignSecuredSettingsPackage($privateOwnerKey, $password, "", $null, $lsv) -309 $settingsPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write) -310 $settingsPackageStream.CopyTo($settingsPackage) -311 $settingsPackage.Close() -312 } +291 # Configure Settings +292 foreach ($uefiV2 IN $surfaceDevices.Values) { +293 if ($uefiV2.SurfaceUefiFamily -eq $Device.Model) { +294 Write-Host "Configuring settings" +295 Write-Host $Device.Model +296 Write-Host "====================" +297 +298 # In this demo, we will start by setting every setting to the default factory setting. +299 # You may want to start by doing this in your scripts +300 # so that every setting gets set to a known state. +301 foreach ($setting IN $uefiV2.Settings.Values) { +302 $setting.ConfiguredValue = $setting.DefaultValue +303 } +304 +305 $EnabledValue = "Enabled" +306 $DisabledValue = "Disabled" +307 +308 # If you want to set something to a different value from the default, +309 # here are examples of how to accomplish this. +310 # This disables IPv6 PXE boot by name: +311 $uefiV2.Settings["IPv6 for PXE Boot"].ConfiguredValue = $DisabledValue +312 +313 # This disables IPv6 PXE Boot by ID: +314 $uefiV2.SettingsById[400].ConfiguredValue = $DisabledValue +315 +316 Write-Host "" +317 +318 # If you want to leave the setting unmodified, set it to $null +319 # PowerShell has issues setting things to $null so ClearConfiguredValue() +320 # is supplied to do this explicitly. +321 # Here is an example of leaving the UEFI administrator password as-is, +322 # even after we initially set it to factory default above. +323 $uefiV2.SettingsById[501].ClearConfiguredValue() +324 +325 # Create a unique package name based on family and LSV. +326 # We will choose a name that can be parsed by later scripts. +327 $packageName = $uefiV2.SurfaceUefiFamily + "^Settings^" + $lsv + ".pkg" +328 $fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName +329 +330 # Build and sign the Settings package then save it to a file. +331 $settingsPackageStream = $uefiV2.BuildAndSignSecuredSettingsPackage($privateOwnerKey, $password, "", $null, $lsv) +332 $settingsPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write) +333 $settingsPackageStream.CopyTo($settingsPackage) +334 $settingsPackage.Close() +335 } ``` Like the permissions set in the **Configure Permissions** section of the script, the configuration of each Surface UEFI setting is performed by defining the **$uefiV2** variable. For each line defining the **$uefiV2** variable, a Surface UEFI setting is identified by setting name or ID and the configured value is set to **Enabled** or **Disabled**. -If you do not want to alter the configuration of a Surface UEFI setting, for example to ensure that the Surface UEFI administrator password is not cleared by the action of resetting all Surface UEFI settings to their default, you can use **ClearConfiguredValue()** to enforce that this setting will not be altered. In the sample script, this is used on line 300 to prevent the clearing of the Surface UEFI Administrator password, identified in the sample script by its setting ID, **501**. +If you do not want to alter the configuration of a Surface UEFI setting, for example to ensure that the Surface UEFI administrator password is not cleared by the action of resetting all Surface UEFI settings to their default, you can use **ClearConfiguredValue()** to enforce that this setting will not be altered. In the sample script, this is used on line 323 to prevent the clearing of the Surface UEFI Administrator password, identified in the sample script by its setting ID, **501**. You can find information about the available settings names and IDs for Surface UEFI in the [Settings Names and IDs](#settings-names-and-ids) section later in this article. ### Settings registry key -To identify enrolled systems for Configuration Manager, the ConfigureSEMM.ps1 script writes a registry key that can be used to identify enrolled systems as having been installed with the SEMM configuration script. This key can be found at the following location: +To identify enrolled systems for Configuration Manager, the ConfigureSEMM.ps1 script writes registry keys that can be used to identify enrolled systems as having been installed with the SEMM configuration script. These keys can be found at the following location: -`HKLM\SOFTWARE\Microsoft\Surface\SEMM\Enabled_Version1000` +`HKLM\SOFTWARE\Microsoft\Surface\SEMM` -The following code fragment, found on lines 352-363, is used to write this registry key: +The following code fragment, found on lines 380-477, is used to write these registry keys: ``` -352 $SurfaceRegKey = "HKLM:\SOFTWARE\Microsoft\Surface\SEMM" -353 New-RegKey $SurfaceRegKey -354 $SurfaceRegValue = Get-ItemProperty $SurfaceRegKey Enabled_Version1000 -ErrorAction SilentlyContinue -355 -356 If ($SurfaceRegValue -eq $null) -357 { -358 New-ItemProperty -Path $SurfaceRegKey -Name Enabled_Version1000 -PropertyType String -Value 1 | Out-Null -359 } -360 Else -361 { -362 Set-ItemProperty -Path $SurfaceRegKey -Name Enabled_Version1000 -Value 1 -363 } +380 # For SCCM or other management solutions that wish to know what version is applied, tattoo the LSV and current DateTime (in UTC) to the registry: +381 $UTCDate = (Get-Date).ToUniversalTime().ToString() +382 $certIssuer = $certPrint.Issuer +383 $certSubject = $certPrint.Subject +384 +385 $SurfaceRegKey = "HKLM:\SOFTWARE\Microsoft\Surface\SEMM" +386 New-RegKey $SurfaceRegKey +387 $LSVRegValue = Get-ItemProperty $SurfaceRegKey LSV -ErrorAction SilentlyContinue +388 $DateTimeRegValue = Get-ItemProperty $SurfaceRegKey LastConfiguredUTC -ErrorAction SilentlyContinue +389 $OwnershipSessionIdRegValue = Get-ItemProperty $SurfaceRegKey OwnershipSessionId -ErrorAction SilentlyContinue +390 $PermissionSessionIdRegValue = Get-ItemProperty $SurfaceRegKey PermissionSessionId -ErrorAction SilentlyContinue +391 $SettingsSessionIdRegValue = Get-ItemProperty $SurfaceRegKey SettingsSessionId -ErrorAction SilentlyContinue +392 $IsResetRegValue = Get-ItemProperty $SurfaceRegKey IsReset -ErrorAction SilentlyContinue +393 $certUsedRegValue = Get-ItemProperty $SurfaceRegKey CertName -ErrorAction SilentlyContinue +394 $certIssuerRegValue = Get-ItemProperty $SurfaceRegKey CertIssuer -ErrorAction SilentlyContinue +395 $certSubjectRegValue = Get-ItemProperty $SurfaceRegKey CertSubject -ErrorAction SilentlyContinue +396 +397 +398 If ($LSVRegValue -eq $null) +399 { +400 New-ItemProperty -Path $SurfaceRegKey -Name LSV -PropertyType DWORD -Value $lsv | Out-Null +401 } +402 Else +403 { +404 Set-ItemProperty -Path $SurfaceRegKey -Name LSV -Value $lsv +405 } +406 +407 If ($DateTimeRegValue -eq $null) +408 { +409 New-ItemProperty -Path $SurfaceRegKey -Name LastConfiguredUTC -PropertyType String -Value $UTCDate | Out-Null +410 } +411 Else +412 { +413 Set-ItemProperty -Path $SurfaceRegKey -Name LastConfiguredUTC -Value $UTCDate +414 } +415 +416 If ($OwnershipSessionIdRegValue -eq $null) +417 { +418 New-ItemProperty -Path $SurfaceRegKey -Name OwnershipSessionId -PropertyType String -Value $ownerSessionIdValue | Out-Null +419 } +420 Else +421 { +422 Set-ItemProperty -Path $SurfaceRegKey -Name OwnershipSessionId -Value $ownerSessionIdValue +423 } +424 +425 If ($PermissionSessionIdRegValue -eq $null) +426 { +427 New-ItemProperty -Path $SurfaceRegKey -Name PermissionSessionId -PropertyType String -Value $permissionSessionIdValue | Out-Null +428 } +429 Else +430 { +431 Set-ItemProperty -Path $SurfaceRegKey -Name PermissionSessionId -Value $permissionSessionIdValue +432 } +433 +434 If ($SettingsSessionIdRegValue -eq $null) +435 { +436 New-ItemProperty -Path $SurfaceRegKey -Name SettingsSessionId -PropertyType String -Value $settingsSessionIdValue | Out-Null +437 } +438 Else +439 { +440 Set-ItemProperty -Path $SurfaceRegKey -Name SettingsSessionId -Value $settingsSessionIdValue +441 } +442 +443 If ($IsResetRegValue -eq $null) +444 { +445 New-ItemProperty -Path $SurfaceRegKey -Name IsReset -PropertyType DWORD -Value 0 | Out-Null +446 } +447 Else +448 { +449 Set-ItemProperty -Path $SurfaceRegKey -Name IsReset -Value 0 +450 } +451 +452 If ($certUsedRegValue -eq $null) +453 { +454 New-ItemProperty -Path $SurfaceRegKey -Name CertName -PropertyType String -Value $certName | Out-Null +455 } +456 Else +457 { +458 Set-ItemProperty -Path $SurfaceRegKey -Name CertName -Value $certName +459 } +460 +461 If ($certIssuerRegValue -eq $null) +462 { +463 New-ItemProperty -Path $SurfaceRegKey -Name CertIssuer -PropertyType String -Value $certIssuer | Out-Null +464 } +465 Else +466 { +467 Set-ItemProperty -Path $SurfaceRegKey -Name CertIssuer -Value $certIssuer +468 } +469 +470 If ($certSubjectRegValue -eq $null) +471 { +472 New-ItemProperty -Path $SurfaceRegKey -Name CertSubject -PropertyType String -Value $certSubject | Out-Null +473 } +474 Else +475 { +476 Set-ItemProperty -Path $SurfaceRegKey -Name CertSubject -Value $certSubject +477 } ``` ### Settings names and IDs -To configure Surface UEFI settings or permissions for Surface UEFI settings, you must refer to each setting by either its setting name or setting ID. With each new update for Surface UEFI, new settings may be added. The best way to get a complete list of the settings available on a Surface device, along with the settings name and settings IDs, is to use the ShowSettingsOptions.ps1 script from SEMM_Powershell.zip in [Surface Tools for IT Downloads](https://www.microsoft.com/en-us/download/details.aspx?id=46703) +To configure Surface UEFI settings or permissions for Surface UEFI settings, you must refer to each setting by either its setting name or setting ID. With each new update for Surface UEFI, new settings may be added. The best way to get a complete list of the settings available on a Surface device, along with the settings name and settings IDs, is to use the ShowSettingsOptions.ps1 script from SEMM_Powershell.zip in [Surface Tools for IT Downloads](https://www.microsoft.com/download/details.aspx?id=46703) The computer where ShowSettingsOptions.ps1 is run must have Microsoft Surface UEFI Manager installed, but the script does not require a Surface device. diff --git a/devices/surface/windows-autopilot-and-surface-devices.md b/devices/surface/windows-autopilot-and-surface-devices.md index 8134359845..aee66dbdb7 100644 --- a/devices/surface/windows-autopilot-and-surface-devices.md +++ b/devices/surface/windows-autopilot-and-surface-devices.md @@ -19,39 +19,10 @@ Windows Autopilot is a cloud-based deployment technology available in Windows 10 With Surface devices, you can choose to register your devices at the time of purchase when purchasing from a Surface partner enabled for Windows Autopilot. New devices can be shipped directly to your end-users and will be automatically enrolled and configured when the units are unboxed and turned on for the first time. This process can eliminate need to reimage your devices as part of your deployment process, reducing the work required of your deployment staff and opening up new, agile methods for device management and distribution. -In this article learn how to enroll your Surface devices in Windows Autopilot with a Surface partner and the options and considerations you will need to know along the way. This article focuses specifically on Surface devices, for more information about using Windows Autopilot with other devices, or to read more about Windows Autopilot and its capabilities, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot) in the Windows Docs Library. - -## Prerequisites -Enrollment of Surface devices in Windows Autopilot with a Surface partner enabled for Windows Autopilot has the following licensing requirements for each enrolled Surface device: -* **Azure Active Directory Premium** – Required to enroll your devices in your organization and to automatically enroll devices in your organization’s mobile management solution. -* **Mobile Device Management (such as Microsoft Intune)** – Required to remotely deploy applications, configure, and manage your enrolled devices. -* **Office 365 ProPlus** – Required to deploy Microsoft Office to your enrolled devices. - -These requirements are also met by the following solutions: -* Microsoft 365 E3 or E5 (includes Azure Active Directory Premium, Microsoft Intune, and Office 365 ProPlus) - -Or -* Enterprise Mobility + Security E3 or E5 (includes Azure Active Directory Premium and Microsoft Intune) -* Office 365 ProPlus, E3, or E5 (includes Office 365 ProPlus) - ->[!NOTE] ->Deployment of devices using Windows Autopilot to complete the Out-of-Box Experience (OOBE) is supported without these prerequisites, however will yield deployed devices without applications, configuration, or enrollment in a management solution and is highly discouraged. +In this article learn how to enroll your Surface devices in Windows Autopilot with a Surface partner and the options and considerations you will need to know along the way. This article focuses specifically on Surface devices, for more information about using Windows Autopilot with other devices, or to read more about Windows Autopilot and its capabilities, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot) in the Windows Docs Library. For information about licensing and other prerequisites, see [Windows Autopilot requirements](https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot-requirements). ### Windows version considerations -Support for broad deployments of Surface devices using Windows Autopilot, including enrollment performed by Surface partners at the time of purchase, requires devices manufactured with or otherwise installed with Windows 10 Version 1709 (Fall Creators Update). Windows 10 Version 1709 uses a secure 4096-bit (4k) hash value to uniquely identify devices for Windows Autopilot that is necessary for deployments at scale. - -### Surface device support -Surface devices with support for out-of-box deployment with Windows Autopilot, enrolled during the purchase process with a Surface partner, include the following devices, where the devices ship from the factory with Windows 10 Version 1709: - -* Surface Pro (5th gen) -* Surface Laptop(1st gen) -* Surface Studio (1st gen) -* Surface Pro 6 -* Surface Book 2 -* Surface Laptop 2 -* Surface Studio 2 -* Surface Go -* Surface Go with LTE Advanced +Support for broad deployments of Surface devices using Windows Autopilot, including enrollment performed by Surface partners at the time of purchase, requires devices manufactured with or otherwise installed with Windows 10 Version 1709 (Fall Creators Update) or later. These versions support a 4000-byte (4k) hash value to uniquely identify devices for Windows Autopilot that is necessary for deployments at scale. All new Surface devices ship with Windows 10 Version 1709 or above. ## Surface partners enabled for Windows Autopilot Enrolling Surface devices in Windows Autopilot at the time of purchase is a capability provided by select Surface partners that are enabled with the capability to identify individual Surface devices during the purchase process and perform enrollment on an organization’s behalf. Devices enrolled by a Surface partner at time of purchase can be shipped directly to users and configured entirely through the zero-touch process of Windows Autopilot, Azure Active Directory, and Mobile Device Management. @@ -63,4 +34,3 @@ When you purchase Surface devices from a Surface partner enabled for Windows Aut - [Insight](https://www.insight.com/en_US/buy/partner/microsoft/surface/windows-autopilot.html) - [SHI](https://www.shi.com/Surface) - diff --git a/education/docfx.json b/education/docfx.json index c336a4de5b..15587928ef 100644 --- a/education/docfx.json +++ b/education/docfx.json @@ -27,6 +27,9 @@ "ROBOTS": "INDEX, FOLLOW", "audience": "windows-education", "ms.topic": "article", + "ms.technology": "windows", + "manager": "laurawi", + "audience": "ITPro", "breadcrumb_path": "/education/breadcrumb/toc.json", "ms.date": "05/09/2017", "feedback_system": "GitHub", diff --git a/education/get-started/change-history-ms-edu-get-started.md b/education/get-started/change-history-ms-edu-get-started.md index 5273dbe9ce..8524f4cf8b 100644 --- a/education/get-started/change-history-ms-edu-get-started.md +++ b/education/get-started/change-history-ms-edu-get-started.md @@ -6,8 +6,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 07/07/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/configure-microsoft-store-for-education.md b/education/get-started/configure-microsoft-store-for-education.md index d6010ad62c..3aedd8379c 100644 --- a/education/get-started/configure-microsoft-store-for-education.md +++ b/education/get-started/configure-microsoft-store-for-education.md @@ -5,11 +5,11 @@ keywords: education, Microsoft Education, full cloud IT solution, school, deploy ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.topic: get-started +ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 08/29/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/enable-microsoft-teams.md b/education/get-started/enable-microsoft-teams.md index 170c94d505..76b967ae75 100644 --- a/education/get-started/enable-microsoft-teams.md +++ b/education/get-started/enable-microsoft-teams.md @@ -5,11 +5,11 @@ keywords: education, Microsoft Education, full cloud IT solution, school, deploy ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.topic: get-started +ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 07/28/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/finish-setup-and-other-tasks.md b/education/get-started/finish-setup-and-other-tasks.md index 9495aa1d31..f0bd720e51 100644 --- a/education/get-started/finish-setup-and-other-tasks.md +++ b/education/get-started/finish-setup-and-other-tasks.md @@ -5,11 +5,11 @@ keywords: education, Microsoft Education, full cloud IT solution, school, deploy ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.topic: get-started +ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/09/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/get-started-with-microsoft-education.md b/education/get-started/get-started-with-microsoft-education.md index a36cdb45da..e5347813d5 100644 --- a/education/get-started/get-started-with-microsoft-education.md +++ b/education/get-started/get-started-with-microsoft-education.md @@ -5,11 +5,11 @@ keywords: education, Microsoft Education, full cloud IT solution, school, deploy ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.topic: hero-article +ms.topic: article ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/09/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index d8c3f7273d..0cd250e3ff 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -9,8 +9,8 @@ ms.topic: article ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 06/12/2018 ms.reviewer: manager: dansimp diff --git a/education/get-started/set-up-office365-edu-tenant.md b/education/get-started/set-up-office365-edu-tenant.md index 0d5813061e..64499de75e 100644 --- a/education/get-started/set-up-office365-edu-tenant.md +++ b/education/get-started/set-up-office365-edu-tenant.md @@ -5,11 +5,11 @@ keywords: education, Microsoft Education, full cloud IT solution, school, deploy ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.topic: get-started +ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/09/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/set-up-windows-10-education-devices.md b/education/get-started/set-up-windows-10-education-devices.md index bc564efa41..2bcc88089c 100644 --- a/education/get-started/set-up-windows-10-education-devices.md +++ b/education/get-started/set-up-windows-10-education-devices.md @@ -5,11 +5,11 @@ keywords: education, Microsoft Education, full cloud IT solution, school, deploy ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.topic: get-started +ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/09/2017 ms.reviewer: manager: dansimp @@ -26,6 +26,8 @@ We recommend using the latest build of Windows 10, version 1703 on your educatio To set up new Windows 10 devices and enroll them to your education tenant, choose from one of these options and follow the link to watch the video or follow the step-by-step guide: - **Option 1: [Use the Set up School PCs app](https://docs.microsoft.com/education/windows/use-set-up-school-pcs-app)** - You can use the app to create a setup file that you can use to quickly set up one or more Windows 10 devices. - **Option 2: [Go through Windows OOBE and join the device to Azure AD](set-up-windows-education-devices.md)** - You can go through a typical Windows 10 device setup or first-run experience to configure your device. +- **Option 3: [Bulk enrollment for Windows devices](https://docs.microsoft.com/en-us/intune/windows-bulk-enroll)** +- **Option 4: [Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/en-us/intune/enrollment-autopilot)** > [!div class="step-by-step"] > [<< Use Intune for Education to manage groups, apps, and settings](use-intune-for-education.md) diff --git a/education/get-started/set-up-windows-education-devices.md b/education/get-started/set-up-windows-education-devices.md index 582134817f..a3175b1d1b 100644 --- a/education/get-started/set-up-windows-education-devices.md +++ b/education/get-started/set-up-windows-education-devices.md @@ -5,11 +5,11 @@ keywords: education, Microsoft Education, full cloud IT solution, school, deploy ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.topic: get-started +ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 07/28/2017 ms.reviewer: manager: dansimp diff --git a/education/get-started/use-intune-for-education.md b/education/get-started/use-intune-for-education.md index 9a4b451c83..e3e3be043a 100644 --- a/education/get-started/use-intune-for-education.md +++ b/education/get-started/use-intune-for-education.md @@ -5,11 +5,11 @@ keywords: education, Microsoft Education, full cloud IT solution, school, deploy ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.topic: get-started +ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 08/29/2017 ms.reviewer: manager: dansimp @@ -21,7 +21,7 @@ manager: dansimp > [<< Configure Microsoft Store for Education](configure-microsoft-store-for-education.md) > [Set up Windows 10 education devices >>](set-up-windows-10-education-devices.md) -Intune for Education is a streamlined device management solution for educational institutions that can be used to quickly set up and manage Windows 10 devices for your school. It provides a new streamlined UI with the enterprise readiness and resiliency of the Intune service. You can learn more about Intune for Education by reading the Intune for Education documentation. +Intune for Education is a streamlined device management solution for educational institutions that can be used to quickly set up and manage Windows 10 and iOS devices for your school. It provides a new streamlined UI with the enterprise readiness and resiliency of the Intune service. You can learn more about Intune for Education by reading the Intune for Education documentation. ## Example - Set up Intune for Education, buy apps from the Store, and install the apps In this walkthrough, we'll go through a sample scenario and walk you through the steps to: @@ -221,4 +221,4 @@ You're now done assigning apps to all users in your tenant. It's time to set up ## Related topic -[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) +[Set up iOS device management](https://docs.microsoft.com/en-us/intune-education/setup-ios-device-management) diff --git a/education/get-started/use-school-data-sync.md b/education/get-started/use-school-data-sync.md index 6a025b3ff4..6ab9b54cba 100644 --- a/education/get-started/use-school-data-sync.md +++ b/education/get-started/use-school-data-sync.md @@ -5,11 +5,11 @@ keywords: education, Microsoft Education, full cloud IT solution, school, deploy ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.topic: get-started +ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 07/10/2017 ms.reviewer: manager: dansimp diff --git a/education/index.md b/education/index.md index f07f216119..c36a33ee36 100644 --- a/education/index.md +++ b/education/index.md @@ -1,11 +1,11 @@ ---- +--- layout: HubPage hide_bc: true title: Microsoft 365 Education documentation and resources | Microsoft Docs description: Learn about product documentation and resources available for school IT administrators, teachers, students, and education app developers. -author: CelesteDG +author: dansimp ms.topic: hub-page -ms.author: celested +ms.author: dansimp ms.collection: ITAdminEDU ms.date: 10/30/2017 ms.prod: w10 @@ -26,7 +26,7 @@ ms.prod: w10
  • - +
    @@ -56,7 +56,7 @@ ms.prod: w10

    Deployment Guidance

    -

    Dive right into the step-by-step process for the easiest deployment path to M365 EDU. We walk you through setting up cloud infrastructure, configuring and managing devices, and migrating on-premise servers for Sharepoint and Exchange to the cloud.

    +

    Learn the easiest path to deploy Microsoft 365 Education through our step-by-step process. We walk you through cloud deployment, device management,apps set up and configuration, and how to find deployment assistance.

    diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md index f1d88dc8c8..aff8c085b5 100644 --- a/education/trial-in-a-box/educator-tib-get-started.md +++ b/education/trial-in-a-box/educator-tib-get-started.md @@ -9,8 +9,8 @@ ms.topic: article ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 03/18/2018 ms.reviewer: manager: dansimp @@ -339,7 +339,7 @@ For more information about checking for updates, and how to optionally turn on a ## Get more info * Learn more at     microsoft.com/education * Find out if your school is eligible for a device trial at aka.ms/EDUTrialInABox -* Buy Windows 10 devices +* Buy Windows 10 devices

    diff --git a/education/trial-in-a-box/index.md b/education/trial-in-a-box/index.md index c91f1c0264..f21a0ddcf4 100644 --- a/education/trial-in-a-box/index.md +++ b/education/trial-in-a-box/index.md @@ -1,6 +1,6 @@ --- title: Microsoft Education Trial in a Box -description: For IT admins, educators, and students, discover what you can do with Microsoft 365 Education. Try it out with our Trial in a Box program. +description: For IT admins, educators, and students, discover what you can do with Microsoft 365 Education. Try it out with our Trial in a Box program. keywords: education, Microsoft 365 Education, trial, full cloud IT solution, school, deploy, setup, IT admin, educator, student, explore, Trial in a Box ms.prod: w10 ms.mktglfcycl: deploy @@ -9,8 +9,8 @@ ms.topic: article ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: CelesteDG -ms.author: celested +author: dansimp +ms.author: dansimp ms.date: 12/11/2017 --- diff --git a/education/trial-in-a-box/itadmin-tib-get-started.md b/education/trial-in-a-box/itadmin-tib-get-started.md index bdb1df0296..1965c6abf7 100644 --- a/education/trial-in-a-box/itadmin-tib-get-started.md +++ b/education/trial-in-a-box/itadmin-tib-get-started.md @@ -5,12 +5,12 @@ keywords: education, Microsoft 365 Education, trial, full cloud IT solution, sch ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.topic: get-started +ms.topic: quickstart ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 03/18/2018 ms.reviewer: manager: dansimp @@ -278,4 +278,4 @@ For more information about checking for updates, and how to optionally turn on a ## Get more info * Learn more at microsoft.com/education * Find out if your school is eligible for a device trial at aka.ms/EDUTrialInABox -* Buy Windows 10 devices +* Buy Windows 10 devices diff --git a/education/trial-in-a-box/support-options.md b/education/trial-in-a-box/support-options.md index b377719a91..9cb32351de 100644 --- a/education/trial-in-a-box/support-options.md +++ b/education/trial-in-a-box/support-options.md @@ -1,6 +1,6 @@ --- title: Microsoft Education Trial in a Box Support -description: Need help or have a question about using Microsoft Education Trial in a Box? Start here. +description: Need help or have a question about using Microsoft Education Trial in a Box? Start here. keywords: support, troubleshooting, education, Microsoft 365 Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, Microsoft Store for Education, Set up School PCs ms.prod: w10 ms.mktglfcycl: deploy @@ -9,8 +9,8 @@ ms.topic: article ms.localizationpriority: medium ms.pagetype: edu ROBOTS: noindex,nofollow -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 03/18/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md index 2c11c122c4..ecc1f3f77c 100644 --- a/education/windows/autopilot-reset.md +++ b/education/windows/autopilot-reset.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 06/27/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/change-history-edu.md b/education/windows/change-history-edu.md index b3dd38357b..9302c8fdb4 100644 --- a/education/windows/change-history-edu.md +++ b/education/windows/change-history-edu.md @@ -6,8 +6,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 05/21/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/change-to-pro-education.md b/education/windows/change-to-pro-education.md index da30be64ef..e40ce61ea7 100644 --- a/education/windows/change-to-pro-education.md +++ b/education/windows/change-to-pro-education.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 05/21/2019 ms.reviewer: manager: dansimp @@ -37,7 +37,7 @@ Before you change to Windows 10 Pro Education, make sure you meet these requirem - The user making the changes must be a member of the Azure AD global administrator group. ## Compare Windows 10 Pro and Pro Education editions -You can [compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare) to find out more about the features we support in other editions of Windows 10. +You can [compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare) to find out more about the features we support in other editions of Windows 10. For more info about Windows 10 default settings and recommendations for education customers, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). @@ -314,6 +314,6 @@ For more information about integrating on-premises AD DS domains with Azure AD, [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) [Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md) -[Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare) +[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare) [Windows 10 subscription activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation) diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md index 9769d7a3bf..051954b11f 100644 --- a/education/windows/chromebook-migration-guide.md +++ b/education/windows/chromebook-migration-guide.md @@ -10,8 +10,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu, devices ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/13/2017 --- diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md index 1cb747217a..688b66c92b 100644 --- a/education/windows/configure-windows-for-education.md +++ b/education/windows/configure-windows-for-education.md @@ -7,8 +7,8 @@ ms.sitesec: library ms.prod: w10 ms.pagetype: edu ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 08/31/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index bb621c32d8..43b68e46ad 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.pagetype: edu ms.sitesec: library ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.reviewer: manager: dansimp --- @@ -26,7 +26,7 @@ This guide shows you how to deploy the Windows 10 operating system in a school d Proper preparation is essential for a successful district deployment. To avoid common mistakes, your first step is to plan a typical district configuration. Just as with building a house, you need a blueprint for what your district and individual schools should look like when it’s finished. The second step in preparation is to learn how you will manage the users, apps, and devices in your district. Just as a builder needs to have the right tools to build a house, you need the right set of tools to deploy your district. ->**Note**  This guide focuses on Windows 10 deployment and management in a district. For management of other devices and operating systems in education environments, see [Manage BYOD and corporate-owned devices with MDM solutions](https://www.microsoft.com/en-us/cloud-platform/mobile-device-management). +>**Note**  This guide focuses on Windows 10 deployment and management in a district. For management of other devices and operating systems in education environments, see [Manage BYOD and corporate-owned devices with MDM solutions](https://www.microsoft.com/cloud-platform/mobile-device-management). ### Plan a typical district configuration @@ -115,7 +115,7 @@ The configuration process requires the following devices: * **Admin device.** This is the device you use for your day-to-day job functions. It’s also the one you use to create and manage the Windows 10 and app deployment process. You install the Windows ADK, MDT, and the System Center Configuration Manager Console on this device. * **Reference devices.** These are the devices that you will use as a template for the faculty and student devices. You install Windows 10 and Windows desktop apps on these devices, and then capture an image (.wim file) of the devices. - You will have a reference device for each type of device in your district. For example, if your district has Surface, HP Stream, Dell Inspiron, and Lenovo Yoga devices, then you would have a reference device for each model. For more information about approved Windows 10 devices, see [Explore devices](https://www.microsoft.com/en-us/windows/view-all). + You will have a reference device for each type of device in your district. For example, if your district has Surface, HP Stream, Dell Inspiron, and Lenovo Yoga devices, then you would have a reference device for each model. For more information about approved Windows 10 devices, see [Explore devices](https://www.microsoft.com/windows/view-all). * **Faculty and staff devices.** These are the devices that the teachers, faculty, and staff use for their day-to-day job functions. You use the admin device to deploy (or upgrade) Windows 10 and apps to these devices. * **Student devices.** The students will use these devices. You will use the admin device deploy (or upgrade) Windows 10 and apps to them. @@ -550,7 +550,7 @@ In this section, you installed the Windows ADK and MDT on the admin device. You Office 365 is one of the core components of your classroom environment. You create and manage student identities in Office 365, and students and teachers use the suite as their email, contacts, and calendar system. They also use Office 365 collaboration features such as SharePoint, OneNote, and OneDrive for Business. -As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/en-us/education/products/office-365-deployment-resources/default.aspx). +As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/education/products/office-365-deployment-resources/default.aspx). ### Select the appropriate Office 365 Education license plan @@ -991,7 +991,7 @@ Depending on your school’s requirements, you may need any combination of the f >**Note**  Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Microsoft Store for Business—features not available in Windows 10 Home. For more information about how to upgrade Windows 10 Home to Windows 10 Pro or Windows 10 Education, see [Windows 10 edition upgrade](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades). -For more information about the Windows 10 editions, see [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). +For more information about the Windows 10 editions, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). One other consideration is the mix of processor architectures you will support. If you can, support only 64-bit versions of Windows 10. If you have devices that can run only 32-bit versions of Windows 10, you will need to import both 64-bit and 32-bit versions of the Windows 10 editions listed above. diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md index f1696a220d..3cfeafb6d3 100644 --- a/education/windows/deploy-windows-10-in-a-school.md +++ b/education/windows/deploy-windows-10-in-a-school.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.pagetype: edu ms.sitesec: library ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.reviewer: manager: dansimp --- @@ -164,7 +164,7 @@ In this section, you installed the Windows ADK and MDT on the admin device. You Office 365 is one of the core components of your classroom environment. You create and manage student identities in Office 365, and students and teachers use the suite as their email, contacts, and calendar system. Teachers and students use Office 365 collaboration features such as SharePoint, OneNote, and OneDrive for Business. -As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/en-us/education/products/office-365-deployment-resources/default.aspx). +As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/education/products/office-365-deployment-resources/default.aspx). ### Select the appropriate Office 365 Education license plan diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md index cb30050aa8..1f3bcffff3 100644 --- a/education/windows/edu-deployment-recommendations.md +++ b/education/windows/edu-deployment-recommendations.md @@ -5,8 +5,8 @@ keywords: Windows 10 deployment, recommendations, privacy settings, school ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 10/13/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/education-scenarios-store-for-business.md b/education/windows/education-scenarios-store-for-business.md index 5598256e19..3149237ba1 100644 --- a/education/windows/education-scenarios-store-for-business.md +++ b/education/windows/education-scenarios-store-for-business.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -searchScope: +searchScope: - Store -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 03/30/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/enable-s-mode-on-surface-go-devices.md b/education/windows/enable-s-mode-on-surface-go-devices.md index 0862548ea6..0b7fc8c617 100644 --- a/education/windows/enable-s-mode-on-surface-go-devices.md +++ b/education/windows/enable-s-mode-on-surface-go-devices.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: levinec -ms.author: ellevin +author: dansimp +ms.author: dansimp ms.date: 07/30/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/get-minecraft-device-promotion.md b/education/windows/get-minecraft-device-promotion.md index 4864b6d4a0..bafc4ed6ae 100644 --- a/education/windows/get-minecraft-device-promotion.md +++ b/education/windows/get-minecraft-device-promotion.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: levinec -searchScope: +author: dansimp +searchScope: - Store -ms.author: ellevin +ms.author: dansimp ms.date: 06/05/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index 0908c78b04..7037b5ce14 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: levinec -searchScope: +author: dansimp +searchScope: - Store -ms.author: ellevin +ms.author: dansimp ms.date: 01/29/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/index.md b/education/windows/index.md index 0f1dedb139..b40b009575 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: CelesteDG -ms.author: celested +author: dansimp +ms.author: dansimp ms.date: 10/13/2017 --- @@ -19,8 +19,8 @@ ms.date: 10/13/2017 ## ![Learn more about Windows](images/education.png) Learn

    Windows 10 editions for education customers
    Windows 10, version 1607 introduces two editions designed for the unique needs of K-12 institutions: Windows 10 Pro Education and Windows 10 Education. These editions provide education-specific default settings for the evolving landscape in K-12 education IT environments.

    -

    Compare each Windows edition
    Find out more about the features and functionality we support in each edition of Windows.

    -

    Get Windows 10 Education or Windows 10 Pro Education
    When you've made your decision, find out how to buy Windows for your school.

    +

    Compare each Windows edition
    Find out more about the features and functionality we support in each edition of Windows.

    +

    Get Windows 10 Education or Windows 10 Pro Education
    When you've made your decision, find out how to buy Windows for your school.

    ## ![Plan for Windows 10 in your school](images/clipboard.png) Plan diff --git a/education/windows/s-mode-switch-to-edu.md b/education/windows/s-mode-switch-to-edu.md index d92973b13b..4860249e19 100644 --- a/education/windows/s-mode-switch-to-edu.md +++ b/education/windows/s-mode-switch-to-edu.md @@ -1,6 +1,6 @@ --- title: Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode -description: Switching out of Windows 10 Pro in S mode to Windows 10 Pro Education in S mode. The S mode switch documentation describes the requirements and process for Switching to Windows 10 Pro Education in S mode. +description: Switching out of Windows 10 Pro in S mode to Windows 10 Pro Education in S mode. The S mode switch documentation describes the requirements and process for Switching to Windows 10 Pro Education in S mode. keywords: Windows 10 S switch, S mode Switch, switch in S mode, Switch S mode, Windows 10 Pro Education in S mode, S mode, system requirements, Overview, Windows 10 Pro in S mode, Education, EDU ms.mktglfcycl: deploy ms.localizationpriority: medium @@ -10,8 +10,8 @@ ms.pagetype: edu ms.date: 12/03/2018 ms.reviewer: manager: dansimp -ms.author: macapara -author: mjcaparas +ms.author: dansimp +author: dansimp --- # Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode @@ -42,7 +42,7 @@ S mode is an enhanced security mode of Windows 10 – streamlined for security a |Credential Guard | | | | X | |Device Guard | | | | X | -### Windows 10 in S mode is safe, secure, and fast. +### Windows 10 in S mode is safe, secure, and fast. However, in some limited scenarios, you might need to switch to Windows 10 Education. You can switch devices running Windows 10, version 1709 or later. Use the following information to switch to Windows 10 Pro through the Microsoft Store. ## How to switch @@ -71,4 +71,4 @@ Tenant-wide Windows 10 Pro > Pro Education [FAQs](https://support.microsoft.com/help/4020089/windows-10-in-s-mode-faq)
    [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)
    [Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)
    -[Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare) +[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare) diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index 00a5baee8a..515bfff44f 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: levinec -searchScope: +author: dansimp +searchScope: - Store -ms.author: ellevin +ms.author: dansimp ms.date: 01/30/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-school-pcs-azure-ad-join.md b/education/windows/set-up-school-pcs-azure-ad-join.md index 7b8f55bb14..6d62b6bb55 100644 --- a/education/windows/set-up-school-pcs-azure-ad-join.md +++ b/education/windows/set-up-school-pcs-azure-ad-join.md @@ -1,14 +1,14 @@ ---- -title: Azure AD Join with Set up School PCs app -description: Describes how Azure AD Join is configured in the Set up School PCs app. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: medium -author: levinec -ms.author: ellevin +--- +title: Azure AD Join with Set up School PCs app +description: Describes how Azure AD Join is configured in the Set up School PCs app. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: medium +author: dansimp +ms.author: dansimp ms.date: 01/11/2019 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-school-pcs-provisioning-package.md b/education/windows/set-up-school-pcs-provisioning-package.md index 48a2aa9549..12bbf4fc89 100644 --- a/education/windows/set-up-school-pcs-provisioning-package.md +++ b/education/windows/set-up-school-pcs-provisioning-package.md @@ -1,15 +1,15 @@ ---- -title: What's in Set up School PCs provisioning package -description: Lists the provisioning package settings that are configured in the Set up School PCs app. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara -ms.date: 10/17/2018 +--- +title: What's in Set up School PCs provisioning package +description: Lists the provisioning package settings that are configured in the Set up School PCs app. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: medium +author: dansimp +ms.author: dansimp +ms.date: 10/17/2018 ms.reviewer: manager: dansimp --- diff --git a/education/windows/set-up-school-pcs-shared-pc-mode.md b/education/windows/set-up-school-pcs-shared-pc-mode.md index 50b01da4f3..2ac3eb11d0 100644 --- a/education/windows/set-up-school-pcs-shared-pc-mode.md +++ b/education/windows/set-up-school-pcs-shared-pc-mode.md @@ -1,15 +1,15 @@ ---- -title: Shared PC mode for school devices -description: Describes how shared PC mode is set for devices set up with the Set up School PCs app. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara -ms.date: 07/13/2018 +--- +title: Shared PC mode for school devices +description: Describes how shared PC mode is set for devices set up with the Set up School PCs app. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: medium +author: dansimp +ms.author: dansimp +ms.date: 07/13/2018 ms.reviewer: manager: dansimp --- diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md index ab45a9f0a7..67c378fb9f 100644 --- a/education/windows/set-up-school-pcs-technical.md +++ b/education/windows/set-up-school-pcs-technical.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 07/11/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-school-pcs-whats-new.md b/education/windows/set-up-school-pcs-whats-new.md index 27ca52dfd3..fa888ab81c 100644 --- a/education/windows/set-up-school-pcs-whats-new.md +++ b/education/windows/set-up-school-pcs-whats-new.md @@ -1,15 +1,15 @@ ---- -title: What's new in the Windows Set up School PCs app -description: Find out about app updates and new features in Set up School PCs. -keywords: shared cart, shared PC, school, set up school pcs -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.pagetype: edu -ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara -ms.date: 06/03/2019 +--- +title: What's new in the Windows Set up School PCs app +description: Find out about app updates and new features in Set up School PCs. +keywords: shared cart, shared PC, school, set up school pcs +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: medium +author: dansimp +ms.author: dansimp +ms.date: 08/15/2019 ms.reviewer: manager: dansimp --- @@ -17,6 +17,15 @@ manager: dansimp # What's new in Set up School PCs Learn what’s new with the Set up School PCs app each week. Find out about new app features and functionality, and see updated screenshots. You'll also find information about past releases. + +## Week of June 24, 2019 + +### Resumed support for Windows 10, version 1903 and later +The previously mentioned provisioning problem was resolved, so the Set up School PCs app once again supports Windows 10, version 1903 and later. The Windows 10 settings that were removed are now back in the app. + +### Device rename made optional for Azure AD joined devices +When you set up your Azure AD join devices in the Set up School PCs app, you no longer need to rename your devices. Set up School PCs will let you keep existing device names. + ## Week of May 23, 2019 ### Suspended support for Windows 10, version 1903 and later diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index 3842e9d435..0ebe308f14 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -6,8 +6,8 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 07/27/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-students-pcs-with-apps.md b/education/windows/set-up-students-pcs-with-apps.md index 8f09eb0561..c711403393 100644 --- a/education/windows/set-up-students-pcs-with-apps.md +++ b/education/windows/set-up-students-pcs-with-apps.md @@ -7,8 +7,8 @@ ms.pagetype: edu ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 10/13/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/set-up-windows-10.md b/education/windows/set-up-windows-10.md index eaa22faf91..b401df97ef 100644 --- a/education/windows/set-up-windows-10.md +++ b/education/windows/set-up-windows-10.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 07/27/2017 ms.reviewer: manager: dansimp @@ -20,9 +20,9 @@ manager: dansimp - Windows 10 You have two tools to choose from to set up PCs for your classroom: - * Set up School PCs - * Windows Configuration Designer - +* Set up School PCs +* Windows Configuration Designer + Choose the tool that is appropriate for how your students will sign in (Active Directory, Azure Active Directory, or no account). You can use the following diagram to compare the tools. diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md index 7106de6cfd..9f006e7a88 100644 --- a/education/windows/take-a-test-app-technical.md +++ b/education/windows/take-a-test-app-technical.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 11/28/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index ac67906e9b..c49e6ea21f 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 11/08/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index bb20a3760e..41fbb7b7fd 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 11/08/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index cad3303266..4ff027e388 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 10/16/2017 ms.reviewer: manager: dansimp diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 838aa85226..501e3f3249 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: plan ms.sitesec: library ms.localizationpriority: medium -author: mjcaparas -searchScope: +author: dansimp +searchScope: - Store -ms.author: macapara +ms.author: dansimp ms.date: 01/05/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/test-windows10s-for-edu.md b/education/windows/test-windows10s-for-edu.md index 8f8f6c6aa2..2b64a32bd1 100644 --- a/education/windows/test-windows10s-for-edu.md +++ b/education/windows/test-windows10s-for-edu.md @@ -7,8 +7,8 @@ ms.prod: w10 ms.pagetype: edu ms.sitesec: library ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 07/30/2019 ms.reviewer: manager: dansimp @@ -51,7 +51,7 @@ Due to these reasons, we recommend that you use the installation tool and avoid Before you install Windows 10 in S mode on your existing Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise device: * Make sure that you updated your existing device to Windows 10, version 1703 (Creators Update). - See [Download Windows 10](https://www.microsoft.com/en-us/software-download/windows10) and follow the instructions to update your device to Windows 10, version 1703. You can verify your current version in **Settings > System > About**. + See [Download Windows 10](https://www.microsoft.com/software-download/windows10) and follow the instructions to update your device to Windows 10, version 1703. You can verify your current version in **Settings > System > About**. * Install the latest Windows Update. @@ -184,7 +184,7 @@ If you see this message, follow these steps to stop receiving the message: To use an installation media to reinstall Windows 10, follow these steps. -1. On a working PC, go to the [Microsoft software download website](https://www.microsoft.com/en-us/software-download/windows10). +1. On a working PC, go to the [Microsoft software download website](https://www.microsoft.com/software-download/windows10). 2. Download the Media Creation Tool and then run it. 3. Select **Create installation media for another PC**. 4. Choose a language, edition, and architecture (64-bit or 32-bit). diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 1af547f463..3f31119391 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 10/23/2018 ms.reviewer: manager: dansimp diff --git a/education/windows/windows-editions-for-education-customers.md b/education/windows/windows-editions-for-education-customers.md index 52a4aa6bb6..80555a4b90 100644 --- a/education/windows/windows-editions-for-education-customers.md +++ b/education/windows/windows-editions-for-education-customers.md @@ -7,8 +7,8 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: edu ms.localizationpriority: medium -author: mjcaparas -ms.author: macapara +author: dansimp +ms.author: dansimp ms.date: 05/21/2019 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/TOC.md b/mdop/agpm/TOC.md index 1443cf78ae..319eeaf746 100644 --- a/mdop/agpm/TOC.md +++ b/mdop/agpm/TOC.md @@ -240,5 +240,6 @@ ###### [AGPM Server Connection Settings](agpm-server-connection-settings.md) ###### [Feature Visibility Settings](feature-visibility-settings.md) ##### [Other Enhancements to the GPMC](other-enhancements-to-the-gpmc.md) +## [Troubleshooting AGPM Upgrades](troubleshooting-agpm40-upgrades.md) ## [Resources for AGPM](resources-for-agpm.md) diff --git a/mdop/agpm/administrative-template-settings.md b/mdop/agpm/administrative-template-settings.md index 80b6ac71d2..ba47c7e2f0 100644 --- a/mdop/agpm/administrative-template-settings.md +++ b/mdop/agpm/administrative-template-settings.md @@ -1,7 +1,7 @@ --- title: Administrative Template Settings description: Administrative Template Settings -author: mjcaparas +author: dansimp ms.assetid: 1abbf0c1-fd32-46a8-a3ba-c005f066523d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/administrative-templates-folder-agpm30ops.md b/mdop/agpm/administrative-templates-folder-agpm30ops.md index 5e0fc9628c..2a83078fab 100644 --- a/mdop/agpm/administrative-templates-folder-agpm30ops.md +++ b/mdop/agpm/administrative-templates-folder-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Administrative Templates Folder description: Administrative Templates Folder -author: mjcaparas +author: dansimp ms.assetid: 0cc5b570-b6d3-4841-9646-02521c13519c ms.reviewer: manager: dansimp diff --git a/mdop/agpm/administrative-templates-folder-agpm40.md b/mdop/agpm/administrative-templates-folder-agpm40.md index f40c1aca18..ad14b8a812 100644 --- a/mdop/agpm/administrative-templates-folder-agpm40.md +++ b/mdop/agpm/administrative-templates-folder-agpm40.md @@ -1,7 +1,7 @@ --- title: Administrative Templates Folder description: Administrative Templates Folder -author: mjcaparas +author: dansimp ms.assetid: abc41968-4505-4b09-94f2-67ee0e6c9aaf ms.reviewer: manager: dansimp diff --git a/mdop/agpm/advanced-group-policy-management-40.md b/mdop/agpm/advanced-group-policy-management-40.md index 0ea0886272..eee54f15cc 100644 --- a/mdop/agpm/advanced-group-policy-management-40.md +++ b/mdop/agpm/advanced-group-policy-management-40.md @@ -1,7 +1,7 @@ --- title: Advanced Group Policy Management 4.0 description: Advanced Group Policy Management 4.0 -author: mjcaparas +author: dansimp ms.assetid: 9873a1f7-97fc-4546-9538-b4c0308529c0 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/agpm-25-navengl.md b/mdop/agpm/agpm-25-navengl.md index 6b407bf5e4..f670327ad5 100644 --- a/mdop/agpm/agpm-25-navengl.md +++ b/mdop/agpm/agpm-25-navengl.md @@ -1,7 +1,7 @@ --- title: AGPM 2.5 description: AGPM 2.5 -author: mjcaparas +author: dansimp ms.assetid: 6db42f2e-88b2-4305-ab6b-d3cd0c5d686c ms.reviewer: manager: dansimp diff --git a/mdop/agpm/agpm-3-navengl.md b/mdop/agpm/agpm-3-navengl.md index fd7734162e..c9bd8c14e6 100644 --- a/mdop/agpm/agpm-3-navengl.md +++ b/mdop/agpm/agpm-3-navengl.md @@ -1,7 +1,7 @@ --- title: AGPM 3 description: AGPM 3 -author: mjcaparas +author: dansimp ms.assetid: b0d0051d-2900-4a0f-8307-552ad26b0e3b ms.reviewer: manager: dansimp diff --git a/mdop/agpm/agpm-4-navengl.md b/mdop/agpm/agpm-4-navengl.md index dbf263cc72..b74ee375cb 100644 --- a/mdop/agpm/agpm-4-navengl.md +++ b/mdop/agpm/agpm-4-navengl.md @@ -1,7 +1,7 @@ --- title: AGPM 4 description: AGPM 4 -author: mjcaparas +author: dansimp ms.assetid: 81693f30-1b8e-4e63-b1ac-e6de1bc30cc0 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/agpm-40-sp1-navengl.md b/mdop/agpm/agpm-40-sp1-navengl.md index 03a4a2a65d..4dc1d9c084 100644 --- a/mdop/agpm/agpm-40-sp1-navengl.md +++ b/mdop/agpm/agpm-40-sp1-navengl.md @@ -1,7 +1,7 @@ --- title: AGPM 4.0 SP1 description: AGPM 4.0 SP1 -author: mjcaparas +author: dansimp ms.assetid: 4e55d9e6-635c-4ba6-acbb-ed1d1b580a5b ms.reviewer: manager: dansimp diff --git a/mdop/agpm/agpm-40-sp2-navengl.md b/mdop/agpm/agpm-40-sp2-navengl.md index 49ac51fa2d..3722b06033 100644 --- a/mdop/agpm/agpm-40-sp2-navengl.md +++ b/mdop/agpm/agpm-40-sp2-navengl.md @@ -1,7 +1,7 @@ --- title: AGPM 4.0 SP2 description: AGPM 4.0 SP2 -author: mjcaparas +author: dansimp ms.assetid: 915c9791-ac07-43db-bd53-957b641c700f ms.reviewer: manager: dansimp diff --git a/mdop/agpm/agpm-40-sp3-navengl.md b/mdop/agpm/agpm-40-sp3-navengl.md index 336886046c..36960dfbb9 100644 --- a/mdop/agpm/agpm-40-sp3-navengl.md +++ b/mdop/agpm/agpm-40-sp3-navengl.md @@ -1,7 +1,7 @@ --- title: AGPM 4.0 SP3 description: AGPM 4.0 SP3 -author: mjcaparas +author: dansimp ms.assetid: cd80eea9-601f-4e45-b89e-c3904addee37 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/agpm-server-connection-settings-agpm30ops.md b/mdop/agpm/agpm-server-connection-settings-agpm30ops.md index 60c6b4b4ab..b1137e1bc4 100644 --- a/mdop/agpm/agpm-server-connection-settings-agpm30ops.md +++ b/mdop/agpm/agpm-server-connection-settings-agpm30ops.md @@ -1,7 +1,7 @@ --- title: AGPM Server Connection Settings description: AGPM Server Connection Settings -author: mjcaparas +author: dansimp ms.assetid: 5f03e397-b868-4c49-9cbf-a5f5d0ddcc39 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/agpm-server-connection-settings-agpm40.md b/mdop/agpm/agpm-server-connection-settings-agpm40.md index cd4a015986..e804960bbd 100644 --- a/mdop/agpm/agpm-server-connection-settings-agpm40.md +++ b/mdop/agpm/agpm-server-connection-settings-agpm40.md @@ -1,7 +1,7 @@ --- title: AGPM Server Connection Settings description: AGPM Server Connection Settings -author: mjcaparas +author: dansimp ms.assetid: cc67f122-6309-4820-92c2-f6a27d897123 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/agpm-server-connection-settings.md b/mdop/agpm/agpm-server-connection-settings.md index a303704f78..613bb7281f 100644 --- a/mdop/agpm/agpm-server-connection-settings.md +++ b/mdop/agpm/agpm-server-connection-settings.md @@ -1,7 +1,7 @@ --- title: AGPM Server Connection Settings description: AGPM Server Connection Settings -author: mjcaparas +author: dansimp ms.assetid: faf78e5b-2b0d-4069-9b8c-910add892200 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/agpm-server-tab-agpm30ops.md b/mdop/agpm/agpm-server-tab-agpm30ops.md index 184530ce23..11f742945d 100644 --- a/mdop/agpm/agpm-server-tab-agpm30ops.md +++ b/mdop/agpm/agpm-server-tab-agpm30ops.md @@ -1,7 +1,7 @@ --- title: AGPM Server Tab description: AGPM Server Tab -author: mjcaparas +author: dansimp ms.assetid: fb3b0265-53ed-4bf6-88a4-c409f5f1bed4 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/agpm-server-tab-agpm40.md b/mdop/agpm/agpm-server-tab-agpm40.md index 6e0807ad30..e7cc510fdb 100644 --- a/mdop/agpm/agpm-server-tab-agpm40.md +++ b/mdop/agpm/agpm-server-tab-agpm40.md @@ -1,7 +1,7 @@ --- title: AGPM Server Tab description: AGPM Server Tab -author: mjcaparas +author: dansimp ms.assetid: a6689437-233e-4f33-a0d6-f7d432c96c00 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/agpm-server-tab.md b/mdop/agpm/agpm-server-tab.md index f009fdd1b3..8fa23f34ae 100644 --- a/mdop/agpm/agpm-server-tab.md +++ b/mdop/agpm/agpm-server-tab.md @@ -1,7 +1,7 @@ --- title: AGPM Server Tab description: AGPM Server Tab -author: mjcaparas +author: dansimp ms.assetid: ce4490b7-b564-49af-8962-858ee39e0016 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md b/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md index 90d438d2f0..e46c90285d 100644 --- a/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md +++ b/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Approve or Reject a Pending Action description: Approve or Reject a Pending Action -author: mjcaparas +author: dansimp ms.assetid: 6d78989a-b600-4876-9dd9-bc6207ff2ce7 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md b/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md index cba1a90592..fcea90cd4b 100644 --- a/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md +++ b/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md @@ -1,7 +1,7 @@ --- title: Approve or Reject a Pending Action description: Approve or Reject a Pending Action -author: mjcaparas +author: dansimp ms.assetid: 078ea8b5-9ac5-45fc-9ac1-a1aa629c10b4 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/approve-or-reject-a-pending-action.md b/mdop/agpm/approve-or-reject-a-pending-action.md index 08603a71fc..b86ec7dc7b 100644 --- a/mdop/agpm/approve-or-reject-a-pending-action.md +++ b/mdop/agpm/approve-or-reject-a-pending-action.md @@ -1,7 +1,7 @@ --- title: Approve or Reject a Pending Action description: Approve or Reject a Pending Action -author: mjcaparas +author: dansimp ms.assetid: 22921a51-50fb-4a47-bec1-4f563f523675 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/back-up-the-archive-agpm40.md b/mdop/agpm/back-up-the-archive-agpm40.md index e07a0de456..2d6683352f 100644 --- a/mdop/agpm/back-up-the-archive-agpm40.md +++ b/mdop/agpm/back-up-the-archive-agpm40.md @@ -1,7 +1,7 @@ --- title: Back Up the Archive description: Back Up the Archive -author: mjcaparas +author: dansimp ms.assetid: 538d85eb-3596-4c1d-bbd7-26bc28857c28 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/back-up-the-archive.md b/mdop/agpm/back-up-the-archive.md index a85193dcac..424db72881 100644 --- a/mdop/agpm/back-up-the-archive.md +++ b/mdop/agpm/back-up-the-archive.md @@ -1,7 +1,7 @@ --- title: Back Up the Archive description: Back Up the Archive -author: mjcaparas +author: dansimp ms.assetid: 400176da-3518-4475-ad19-c96cda6ca7ba ms.reviewer: manager: dansimp diff --git a/mdop/agpm/best-practices-for-version-control-agpm40.md b/mdop/agpm/best-practices-for-version-control-agpm40.md index 92a272c0d4..f44e46fe21 100644 --- a/mdop/agpm/best-practices-for-version-control-agpm40.md +++ b/mdop/agpm/best-practices-for-version-control-agpm40.md @@ -1,7 +1,7 @@ --- title: Best Practices for Version Control description: Best Practices for Version Control -author: mjcaparas +author: dansimp ms.assetid: 4a2a1ac7-67f3-4ba3-ab07-860d33da0efe ms.reviewer: manager: dansimp diff --git a/mdop/agpm/best-practices-for-version-control.md b/mdop/agpm/best-practices-for-version-control.md index 0ec09f3051..74572fe88d 100644 --- a/mdop/agpm/best-practices-for-version-control.md +++ b/mdop/agpm/best-practices-for-version-control.md @@ -1,7 +1,7 @@ --- title: Best Practices for Version Control description: Best Practices for Version Control -author: mjcaparas +author: dansimp ms.assetid: 89067f6a-f7ea-4dad-999d-118284cf6c5a ms.reviewer: manager: dansimp diff --git a/mdop/agpm/check-in-a-gpo-agpm30ops.md b/mdop/agpm/check-in-a-gpo-agpm30ops.md index 399b6e1604..785c61aefc 100644 --- a/mdop/agpm/check-in-a-gpo-agpm30ops.md +++ b/mdop/agpm/check-in-a-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Check In a GPO description: Check In a GPO -author: mjcaparas +author: dansimp ms.assetid: 437397db-c94b-4940-b1a4-05442619ebee ms.reviewer: manager: dansimp diff --git a/mdop/agpm/check-in-a-gpo-agpm40.md b/mdop/agpm/check-in-a-gpo-agpm40.md index 1353c657f0..2c44785dfd 100644 --- a/mdop/agpm/check-in-a-gpo-agpm40.md +++ b/mdop/agpm/check-in-a-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Check In a GPO description: Check In a GPO -author: mjcaparas +author: dansimp ms.assetid: b838c8a2-eb9e-4e5b-8740-d7701a4294ac ms.reviewer: manager: dansimp diff --git a/mdop/agpm/check-in-a-gpo-approver.md b/mdop/agpm/check-in-a-gpo-approver.md index 1b264c6d74..eae694f22d 100644 --- a/mdop/agpm/check-in-a-gpo-approver.md +++ b/mdop/agpm/check-in-a-gpo-approver.md @@ -1,7 +1,7 @@ --- title: Check In a GPO description: Check In a GPO -author: mjcaparas +author: dansimp ms.assetid: e428cfff-651f-4903-bf01-d742714d2fa9 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md b/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md index 4b298d6115..84166e43be 100644 --- a/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md +++ b/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md @@ -1,7 +1,7 @@ --- title: Checklist Administer the AGPM Server and Archive description: Checklist Administer the AGPM Server and Archive -author: mjcaparas +author: dansimp ms.assetid: d9c60203-90c2-48a7-9318-197e0ec5038b ms.reviewer: manager: dansimp diff --git a/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md b/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md index 51a6f1f128..918d0e79f3 100644 --- a/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md +++ b/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md @@ -1,7 +1,7 @@ --- title: Checklist Administer the AGPM Server and Archive description: Checklist Administer the AGPM Server and Archive -author: mjcaparas +author: dansimp ms.assetid: 0b2eb536-c3cc-462f-a42f-27a53f57bc55 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md index 25fa7701f1..5d035608be 100644 --- a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md +++ b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Checklist Create, Edit, and Deploy a GPO description: Checklist Create, Edit, and Deploy a GPO -author: mjcaparas +author: dansimp ms.assetid: a7a17706-304a-4455-9ada-52508ec620f1 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md index a95a9654f7..f64e3178eb 100644 --- a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md +++ b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Checklist Create, Edit, and Deploy a GPO description: Checklist Create, Edit, and Deploy a GPO -author: mjcaparas +author: dansimp ms.assetid: 44631bed-16d2-4b5a-af70-17a73fb5f6af ms.reviewer: manager: dansimp diff --git a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md index fcb032c722..1c05b3d735 100644 --- a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md +++ b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md @@ -1,7 +1,7 @@ --- title: Checklist Create, Edit, and Deploy a GPO description: Checklist Create, Edit, and Deploy a GPO -author: mjcaparas +author: dansimp ms.assetid: 614e2d9a-c18b-4f62-99fd-e17a2ac8559d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/choosing-which-version-of-agpm-to-install.md b/mdop/agpm/choosing-which-version-of-agpm-to-install.md index c5b9d72127..9f4c03d4bf 100644 --- a/mdop/agpm/choosing-which-version-of-agpm-to-install.md +++ b/mdop/agpm/choosing-which-version-of-agpm-to-install.md @@ -1,7 +1,7 @@ --- title: Choosing Which Version of AGPM to Install description: Choosing Which Version of AGPM to Install -author: mjcaparas +author: dansimp ms.assetid: 31357d2a-bc23-4e15-93f4-0beda8ab7a7b ms.reviewer: manager: dansimp diff --git a/mdop/agpm/common-secondary-tab-features.md b/mdop/agpm/common-secondary-tab-features.md index 7383568174..b723efba3f 100644 --- a/mdop/agpm/common-secondary-tab-features.md +++ b/mdop/agpm/common-secondary-tab-features.md @@ -1,7 +1,7 @@ --- title: Common Secondary Tab Features description: Common Secondary Tab Features -author: mjcaparas +author: dansimp ms.assetid: 44a15c28-944c-49c1-8534-115ce1c362ed ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-agpm-server-connections-agpm30ops.md b/mdop/agpm/configure-agpm-server-connections-agpm30ops.md index 14cb1c8009..74dc22dd7f 100644 --- a/mdop/agpm/configure-agpm-server-connections-agpm30ops.md +++ b/mdop/agpm/configure-agpm-server-connections-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Configure AGPM Server Connections description: Configure AGPM Server Connections -author: mjcaparas +author: dansimp ms.assetid: 6062b77b-2fd7-442c-ad1b-6f14419ebd5f ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-agpm-server-connections-agpm40.md b/mdop/agpm/configure-agpm-server-connections-agpm40.md index f830c94dae..b4e7744dc7 100644 --- a/mdop/agpm/configure-agpm-server-connections-agpm40.md +++ b/mdop/agpm/configure-agpm-server-connections-agpm40.md @@ -1,7 +1,7 @@ --- title: Configure AGPM Server Connections description: Configure AGPM Server Connections -author: mjcaparas +author: dansimp ms.assetid: bbbb15e8-35e7-403c-b695-7a6ebeb87839 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-an-agpm-server-connection-agpm40.md b/mdop/agpm/configure-an-agpm-server-connection-agpm40.md index 1d27c35dd9..20fa0ad21e 100644 --- a/mdop/agpm/configure-an-agpm-server-connection-agpm40.md +++ b/mdop/agpm/configure-an-agpm-server-connection-agpm40.md @@ -1,7 +1,7 @@ --- title: Configure an AGPM Server Connection description: Configure an AGPM Server Connection -author: mjcaparas +author: dansimp ms.assetid: 409cbbcf-3b0e-459d-9bd2-75cb7b9430b0 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md b/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md index 4941464778..e8003ab16d 100644 --- a/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md +++ b/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Configure an AGPM Server Connection description: Configure an AGPM Server Connection -author: mjcaparas +author: dansimp ms.assetid: ae78dc74-111d-4509-b0a6-e8b8b451c22a ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-e-mail-notification-agpm30ops.md b/mdop/agpm/configure-e-mail-notification-agpm30ops.md index c1e769ec3e..02ef47c3f7 100644 --- a/mdop/agpm/configure-e-mail-notification-agpm30ops.md +++ b/mdop/agpm/configure-e-mail-notification-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Configure E-Mail Notification description: Configure E-Mail Notification -author: mjcaparas +author: dansimp ms.assetid: b32ce395-d1b9-4c5b-b765-97cdbf455f9e ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-e-mail-notification-agpm40.md b/mdop/agpm/configure-e-mail-notification-agpm40.md index 10119ff76f..b126a1fc3c 100644 --- a/mdop/agpm/configure-e-mail-notification-agpm40.md +++ b/mdop/agpm/configure-e-mail-notification-agpm40.md @@ -1,7 +1,7 @@ --- title: Configure E-Mail Notification description: Configure E-Mail Notification -author: mjcaparas +author: dansimp ms.assetid: 06f19556-f296-4a80-86a4-4f446c992204 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-e-mail-notification.md b/mdop/agpm/configure-e-mail-notification.md index 865b510ca2..e133904f01 100644 --- a/mdop/agpm/configure-e-mail-notification.md +++ b/mdop/agpm/configure-e-mail-notification.md @@ -1,7 +1,7 @@ --- title: Configure E-Mail Notification description: Configure E-Mail Notification -author: mjcaparas +author: dansimp ms.assetid: 6e152de0-4376-4963-8d1a-3e7f5866d30f ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md b/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md index 4e4802cb36..bc53e8aa80 100644 --- a/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md +++ b/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Configure E-Mail Security for AGPM description: Configure E-Mail Security for AGPM -author: mjcaparas +author: dansimp ms.assetid: 4850ed8e-a1c6-43f0-95c5-853aa66a94ae ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md b/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md index e4c204dcf0..faab3fd398 100644 --- a/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md +++ b/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md @@ -1,7 +1,7 @@ --- title: Configure E-Mail Security for AGPM description: Configure E-Mail Security for AGPM -author: mjcaparas +author: dansimp ms.assetid: b9c48894-0a10-4d03-8027-50ed3b02485a ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-logging-and-tracing-agpm30ops.md b/mdop/agpm/configure-logging-and-tracing-agpm30ops.md index 2fd5e988c9..a47217417b 100644 --- a/mdop/agpm/configure-logging-and-tracing-agpm30ops.md +++ b/mdop/agpm/configure-logging-and-tracing-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Configure Logging and Tracing description: Configure Logging and Tracing -author: mjcaparas +author: dansimp ms.assetid: 4f89552f-e949-48b0-9325-23746034eaa4 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-logging-and-tracing-agpm40.md b/mdop/agpm/configure-logging-and-tracing-agpm40.md index 69c630de77..e3906f9cf6 100644 --- a/mdop/agpm/configure-logging-and-tracing-agpm40.md +++ b/mdop/agpm/configure-logging-and-tracing-agpm40.md @@ -1,7 +1,7 @@ --- title: Configure Logging and Tracing description: Configure Logging and Tracing -author: mjcaparas +author: dansimp ms.assetid: 2418cb6a-7189-4080-8fe2-9c8d47dec62c ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-logging-and-tracing.md b/mdop/agpm/configure-logging-and-tracing.md index 5146b45a14..9ee2278316 100644 --- a/mdop/agpm/configure-logging-and-tracing.md +++ b/mdop/agpm/configure-logging-and-tracing.md @@ -1,7 +1,7 @@ --- title: Configure Logging and Tracing description: Configure Logging and Tracing -author: mjcaparas +author: dansimp ms.assetid: 419231f9-e9db-4f91-a7cf-a0a73db25256 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-the-agpm-server-connection-reviewer.md b/mdop/agpm/configure-the-agpm-server-connection-reviewer.md index e4c102ba9e..57d5dc665d 100644 --- a/mdop/agpm/configure-the-agpm-server-connection-reviewer.md +++ b/mdop/agpm/configure-the-agpm-server-connection-reviewer.md @@ -1,7 +1,7 @@ --- title: Configure the AGPM Server Connection description: Configure the AGPM Server Connection -author: mjcaparas +author: dansimp ms.assetid: 74e8f348-a8ed-4d69-a8e0-9c974aaeca2d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configure-the-agpm-server-connection.md b/mdop/agpm/configure-the-agpm-server-connection.md index 80bef3aea5..afcbe48f4f 100644 --- a/mdop/agpm/configure-the-agpm-server-connection.md +++ b/mdop/agpm/configure-the-agpm-server-connection.md @@ -1,7 +1,7 @@ --- title: Configure the AGPM Server Connection description: Configure the AGPM Server Connection -author: mjcaparas +author: dansimp ms.assetid: 9a42b5bc-41be-44ef-a6e2-6f56e2cf1996 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md b/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md index fa059fc59e..d75d6e0e98 100644 --- a/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md +++ b/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md @@ -1,7 +1,7 @@ --- title: Configuring Advanced Group Policy Management description: Configuring Advanced Group Policy Management -author: mjcaparas +author: dansimp ms.assetid: 8c978ddf-2789-44e4-9c08-de7b4cd1afa0 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/configuring-advanced-group-policy-management.md b/mdop/agpm/configuring-advanced-group-policy-management.md index a8b8d92728..207e7d745b 100644 --- a/mdop/agpm/configuring-advanced-group-policy-management.md +++ b/mdop/agpm/configuring-advanced-group-policy-management.md @@ -1,7 +1,7 @@ --- title: Configuring Advanced Group Policy Management description: Configuring Advanced Group Policy Management -author: mjcaparas +author: dansimp ms.assetid: 836f4a49-2c77-4f6b-8727-9df7ef443141 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/contents-tab-agpm30ops.md b/mdop/agpm/contents-tab-agpm30ops.md index 8ab5fc8894..ca23b55b63 100644 --- a/mdop/agpm/contents-tab-agpm30ops.md +++ b/mdop/agpm/contents-tab-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Contents Tab description: Contents Tab -author: mjcaparas +author: dansimp ms.assetid: 6ada6430-cd93-47aa-af6e-d7f5b5620132 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/contents-tab-agpm40.md b/mdop/agpm/contents-tab-agpm40.md index 6f2c059b3e..d7f2b51096 100644 --- a/mdop/agpm/contents-tab-agpm40.md +++ b/mdop/agpm/contents-tab-agpm40.md @@ -1,7 +1,7 @@ --- title: Contents Tab description: Contents Tab -author: mjcaparas +author: dansimp ms.assetid: cf9d1f17-3c3d-422f-bd6b-3db87be45554 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/contents-tab-features-agpm30ops.md b/mdop/agpm/contents-tab-features-agpm30ops.md index 217b586426..b0103aeb44 100644 --- a/mdop/agpm/contents-tab-features-agpm30ops.md +++ b/mdop/agpm/contents-tab-features-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Contents Tab Features description: Contents Tab Features -author: mjcaparas +author: dansimp ms.assetid: 725f025a-c30a-4d07-add1-4e0ed9a1a5fd ms.reviewer: manager: dansimp diff --git a/mdop/agpm/contents-tab-features-agpm40.md b/mdop/agpm/contents-tab-features-agpm40.md index c714922193..6edfb8b2a8 100644 --- a/mdop/agpm/contents-tab-features-agpm40.md +++ b/mdop/agpm/contents-tab-features-agpm40.md @@ -1,7 +1,7 @@ --- title: Contents Tab Features description: Contents Tab Features -author: mjcaparas +author: dansimp ms.assetid: f1f4849d-bf94-47d5-ad81-0eee33abcaca ms.reviewer: manager: dansimp diff --git a/mdop/agpm/contents-tab.md b/mdop/agpm/contents-tab.md index 0039020f48..11d7827842 100644 --- a/mdop/agpm/contents-tab.md +++ b/mdop/agpm/contents-tab.md @@ -1,7 +1,7 @@ --- title: Contents Tab description: Contents Tab -author: mjcaparas +author: dansimp ms.assetid: 8a756bc1-3900-4d83-93c4-7ebc4705d956 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/control-a-previously-uncontrolled-gpo.md b/mdop/agpm/control-a-previously-uncontrolled-gpo.md index 535a5958f2..135e1bfcab 100644 --- a/mdop/agpm/control-a-previously-uncontrolled-gpo.md +++ b/mdop/agpm/control-a-previously-uncontrolled-gpo.md @@ -1,7 +1,7 @@ --- title: Control a Previously Uncontrolled GPO description: Control a Previously Uncontrolled GPO -author: mjcaparas +author: dansimp ms.assetid: 452689a9-4e32-4e3b-8208-56353a82bf36 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md b/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md index 6b69bcd500..c3ec80fd27 100644 --- a/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md +++ b/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Control an Uncontrolled GPO description: Control an Uncontrolled GPO -author: mjcaparas +author: dansimp ms.assetid: 603f00f9-1e65-4b2f-902a-e53dafedbd8d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md b/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md index fa7fb95245..d475f64bd0 100644 --- a/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md +++ b/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Control an Uncontrolled GPO description: Control an Uncontrolled GPO -author: mjcaparas +author: dansimp ms.assetid: dc81545c-8da5-4b6f-b266-f01a82e27c6b ms.reviewer: manager: dansimp diff --git a/mdop/agpm/controlled-gpo-commands-agpm30ops.md b/mdop/agpm/controlled-gpo-commands-agpm30ops.md index a964df04b5..e7f472be8e 100644 --- a/mdop/agpm/controlled-gpo-commands-agpm30ops.md +++ b/mdop/agpm/controlled-gpo-commands-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Controlled GPO Commands description: Controlled GPO Commands -author: mjcaparas +author: dansimp ms.assetid: 82db4772-154a-4a8d-99cd-2c69e1738698 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/controlled-gpo-commands-agpm40.md b/mdop/agpm/controlled-gpo-commands-agpm40.md index 7f1617be1c..82220a3109 100644 --- a/mdop/agpm/controlled-gpo-commands-agpm40.md +++ b/mdop/agpm/controlled-gpo-commands-agpm40.md @@ -1,7 +1,7 @@ --- title: Controlled GPO Commands description: Controlled GPO Commands -author: mjcaparas +author: dansimp ms.assetid: 370d3db9-4efc-4799-983d-e29ba5f32b07 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/controlled-tab.md b/mdop/agpm/controlled-tab.md index c17aab7903..91f3106011 100644 --- a/mdop/agpm/controlled-tab.md +++ b/mdop/agpm/controlled-tab.md @@ -1,7 +1,7 @@ --- title: Controlled Tab description: Controlled Tab -author: mjcaparas +author: dansimp ms.assetid: 8995a9e1-ace4-40b7-a47b-e1e9924541ba ms.reviewer: manager: dansimp diff --git a/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md b/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md index ed19062453..d476d76832 100644 --- a/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md +++ b/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Create a New Controlled GPO description: Create a New Controlled GPO -author: mjcaparas +author: dansimp ms.assetid: f89eaae8-7858-4222-ba3f-a93a9d7ea5a3 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/create-a-new-controlled-gpo-agpm40.md b/mdop/agpm/create-a-new-controlled-gpo-agpm40.md index 89efc3c447..0331289cbd 100644 --- a/mdop/agpm/create-a-new-controlled-gpo-agpm40.md +++ b/mdop/agpm/create-a-new-controlled-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Create a New Controlled GPO description: Create a New Controlled GPO -author: mjcaparas +author: dansimp ms.assetid: 5ce760f6-9f05-42b4-b787-7835ab8e324e ms.reviewer: manager: dansimp diff --git a/mdop/agpm/create-a-new-controlled-gpo.md b/mdop/agpm/create-a-new-controlled-gpo.md index 614627225b..c8beb4c4a2 100644 --- a/mdop/agpm/create-a-new-controlled-gpo.md +++ b/mdop/agpm/create-a-new-controlled-gpo.md @@ -1,7 +1,7 @@ --- title: Create a New Controlled GPO description: Create a New Controlled GPO -author: mjcaparas +author: dansimp ms.assetid: b43ce0f4-4519-4278-83c4-c7d5163ddd11 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/create-a-template-agpm30ops.md b/mdop/agpm/create-a-template-agpm30ops.md index 406acb5276..4e0a8ecb46 100644 --- a/mdop/agpm/create-a-template-agpm30ops.md +++ b/mdop/agpm/create-a-template-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Create a Template description: Create a Template -author: mjcaparas +author: dansimp ms.assetid: 8208f14a-5c18-43a7-8564-118230398cca ms.reviewer: manager: dansimp diff --git a/mdop/agpm/create-a-template-agpm40.md b/mdop/agpm/create-a-template-agpm40.md index c8a1e97a01..16e28ce80a 100644 --- a/mdop/agpm/create-a-template-agpm40.md +++ b/mdop/agpm/create-a-template-agpm40.md @@ -1,7 +1,7 @@ --- title: Create a Template description: Create a Template -author: mjcaparas +author: dansimp ms.assetid: b38423af-7d24-437a-98bc-01f1ae891127 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/create-a-template.md b/mdop/agpm/create-a-template.md index d0db0eb513..16c9a86ee5 100644 --- a/mdop/agpm/create-a-template.md +++ b/mdop/agpm/create-a-template.md @@ -1,7 +1,7 @@ --- title: Create a Template description: Create a Template -author: mjcaparas +author: dansimp ms.assetid: 6992bd55-4a4f-401f-9815-c468bac598ef ms.reviewer: manager: dansimp diff --git a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md b/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md index d35b5810d4..c54885f7d7 100644 --- a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md +++ b/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Creating a Template and Setting a Default Template description: Creating a Template and Setting a Default Template -author: mjcaparas +author: dansimp ms.assetid: acce0e0f-7e67-479c-9daa-e678fccd7ced ms.reviewer: manager: dansimp diff --git a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md b/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md index a3981ca8a0..c4b3be7551 100644 --- a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md +++ b/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md @@ -1,7 +1,7 @@ --- title: Creating a Template and Setting a Default Template description: Creating a Template and Setting a Default Template -author: mjcaparas +author: dansimp ms.assetid: ffa72c2a-64eb-4492-8072-c3a66179b546 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/creating-a-template-and-setting-a-default-template.md b/mdop/agpm/creating-a-template-and-setting-a-default-template.md index 79e1c3682d..3aeb2a2ac7 100644 --- a/mdop/agpm/creating-a-template-and-setting-a-default-template.md +++ b/mdop/agpm/creating-a-template-and-setting-a-default-template.md @@ -1,7 +1,7 @@ --- title: Creating a Template and Setting a Default Template description: Creating a Template and Setting a Default Template -author: mjcaparas +author: dansimp ms.assetid: 8771b4b5-4dea-4be1-a675-f60cfd3ec5dc ms.reviewer: manager: dansimp diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md index 8e9e92e5ac..2d6c3cc9f1 100644 --- a/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md +++ b/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Creating, Controlling, or Importing a GPO description: Creating, Controlling, or Importing a GPO -author: mjcaparas +author: dansimp ms.assetid: ce8b232e-7758-4a6a-9e2f-18967da6cdad ms.reviewer: manager: dansimp diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md index ba433a553b..5534f1f89a 100644 --- a/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md +++ b/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md @@ -1,7 +1,7 @@ --- title: Creating, Controlling, or Importing a GPO description: Creating, Controlling, or Importing a GPO -author: mjcaparas +author: dansimp ms.assetid: f2c8bef5-b654-4864-99d4-9207cfb0a137 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md index 0aee5a400a..d5ac6710c9 100644 --- a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md +++ b/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Creating, Controlling, or Importing a GPO description: Creating, Controlling, or Importing a GPO -author: mjcaparas +author: dansimp ms.assetid: 0cc1b6ee-3335-4d84-9e1c-d1aefabfef51 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md index 7a228249c6..990725ed87 100644 --- a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md +++ b/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md @@ -1,7 +1,7 @@ --- title: Creating, Controlling, or Importing a GPO description: Creating, Controlling, or Importing a GPO -author: mjcaparas +author: dansimp ms.assetid: 5259ce25-f570-4346-9f50-6b051724a998 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md b/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md index fc60c82ade..ae19e2af92 100644 --- a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md +++ b/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md @@ -1,7 +1,7 @@ --- title: Creating or Controlling a GPO description: Creating or Controlling a GPO -author: mjcaparas +author: dansimp ms.assetid: ca2fa40e-c6e9-4c57-9da1-e5375df4a2fd ms.reviewer: manager: dansimp diff --git a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md b/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md index 119b8134b3..acc64f4c0f 100644 --- a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md +++ b/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md @@ -1,7 +1,7 @@ --- title: Creating or Controlling a GPO description: Creating or Controlling a GPO -author: mjcaparas +author: dansimp ms.assetid: 807f3b3f-ad3d-4851-9772-7f54a065632a ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delegate-access-to-a-gpo.md b/mdop/agpm/delegate-access-to-a-gpo.md index d303c1e2f1..42df98f0d2 100644 --- a/mdop/agpm/delegate-access-to-a-gpo.md +++ b/mdop/agpm/delegate-access-to-a-gpo.md @@ -1,7 +1,7 @@ --- title: Delegate Access to a GPO description: Delegate Access to a GPO -author: mjcaparas +author: dansimp ms.assetid: f1d6bb6c-d5bf-4080-a6cb-32774689f804 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md b/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md index 3c102e5273..a83688d311 100644 --- a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md +++ b/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Delegate Access to an Individual GPO in the Archive description: Delegate Access to an Individual GPO in the Archive -author: mjcaparas +author: dansimp ms.assetid: 7b37b188-2b6b-4e52-be97-8ef899e9893b ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md b/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md index f5124591cc..2f79f15624 100644 --- a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md +++ b/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md @@ -1,7 +1,7 @@ --- title: Delegate Access to an Individual GPO in the Archive description: Delegate Access to an Individual GPO in the Archive -author: mjcaparas +author: dansimp ms.assetid: 284d2aa2-7c10-4ffa-8978-bbe30867c1c1 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delegate-access-to-an-individual-gpo.md b/mdop/agpm/delegate-access-to-an-individual-gpo.md index 48a3a17674..3eca548ecb 100644 --- a/mdop/agpm/delegate-access-to-an-individual-gpo.md +++ b/mdop/agpm/delegate-access-to-an-individual-gpo.md @@ -1,7 +1,7 @@ --- title: Delegate Access to an Individual GPO description: Delegate Access to an Individual GPO -author: mjcaparas +author: dansimp ms.assetid: b2a7d550-14bf-4b41-b6e4-2cc091eedd2d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md b/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md index 5465a92076..83237183a6 100644 --- a/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md +++ b/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Delegate Access to the Production Environment description: Delegate Access to the Production Environment -author: mjcaparas +author: dansimp ms.assetid: c1ebae2e-909b-4e64-b368-b7d3cc67b1eb ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md b/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md index 499f2dda22..a56dd205f1 100644 --- a/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md +++ b/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md @@ -1,7 +1,7 @@ --- title: Delegate Access to the Production Environment description: Delegate Access to the Production Environment -author: mjcaparas +author: dansimp ms.assetid: 4c670581-8c47-41ea-80eb-02846ff1ec1f ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md b/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md index 3d5ef495b1..47b815dc6f 100644 --- a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md +++ b/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Delegate Domain-Level Access to the Archive description: Delegate Domain-Level Access to the Archive -author: mjcaparas +author: dansimp ms.assetid: d232069e-71d5-4b4d-b22e-bef11de1cfd4 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md b/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md index f1aa01ad7e..052f1cd78d 100644 --- a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md +++ b/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md @@ -1,7 +1,7 @@ --- title: Delegate Domain-Level Access to the Archive description: Delegate Domain-Level Access to the Archive -author: mjcaparas +author: dansimp ms.assetid: 11ca1d40-4b5c-496e-8922-d01412717858 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delegate-domain-level-access.md b/mdop/agpm/delegate-domain-level-access.md index da327eae2f..8b14fc2952 100644 --- a/mdop/agpm/delegate-domain-level-access.md +++ b/mdop/agpm/delegate-domain-level-access.md @@ -1,7 +1,7 @@ --- title: Delegate Domain-Level Access description: Delegate Domain-Level Access -author: mjcaparas +author: dansimp ms.assetid: 64c8e773-38cc-4991-9ed2-5a801094d06e ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md b/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md index 2a17a1e42b..1a909c75dd 100644 --- a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md +++ b/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Delegate Management of a Controlled GPO description: Delegate Management of a Controlled GPO -author: mjcaparas +author: dansimp ms.assetid: 509b02e7-ce0b-4919-b58a-c3a33051152e ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md b/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md index 19b09da4c5..a6e9a29c85 100644 --- a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md +++ b/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Delegate Management of a Controlled GPO description: Delegate Management of a Controlled GPO -author: mjcaparas +author: dansimp ms.assetid: 96b4bfb3-5657-4267-8326-85d7a0db87ce ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md b/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md index 82004ed62c..0616b6addc 100644 --- a/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md +++ b/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Delete a Controlled GPO description: Delete a Controlled GPO -author: mjcaparas +author: dansimp ms.assetid: f51c1737-c116-4faf-a6f6-c72303f60a3b ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delete-a-controlled-gpo-agpm40.md b/mdop/agpm/delete-a-controlled-gpo-agpm40.md index 4b1f19997b..a57e046369 100644 --- a/mdop/agpm/delete-a-controlled-gpo-agpm40.md +++ b/mdop/agpm/delete-a-controlled-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Delete a Controlled GPO description: Delete a Controlled GPO -author: mjcaparas +author: dansimp ms.assetid: 2a461018-aa0b-4ae3-b079-efc554ca4a3d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delete-a-gpo-approver.md b/mdop/agpm/delete-a-gpo-approver.md index fee036a028..c5611d8396 100644 --- a/mdop/agpm/delete-a-gpo-approver.md +++ b/mdop/agpm/delete-a-gpo-approver.md @@ -1,7 +1,7 @@ --- title: Delete a GPO description: Delete a GPO -author: mjcaparas +author: dansimp ms.assetid: 85fca371-5707-49c1-aa51-813fc3a58dfc ms.reviewer: manager: dansimp diff --git a/mdop/agpm/delete-a-gpo-editor.md b/mdop/agpm/delete-a-gpo-editor.md index 5bc745374a..3990f6289a 100644 --- a/mdop/agpm/delete-a-gpo-editor.md +++ b/mdop/agpm/delete-a-gpo-editor.md @@ -1,7 +1,7 @@ --- title: Delete a GPO description: Delete a GPO -author: mjcaparas +author: dansimp ms.assetid: 66be3dde-653e-4c25-8cb7-00e7090c8d31 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md b/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md index d4ebed245e..5542d0c0d0 100644 --- a/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md +++ b/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Deleting or Restoring a GPO description: Deleting or Restoring a GPO -author: mjcaparas +author: dansimp ms.assetid: ee4a467a-187a-48e3-8f0d-548de0606a56 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md b/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md index e0bc537cc9..f753b56232 100644 --- a/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md +++ b/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Deleting or Restoring a GPO description: Deleting or Restoring a GPO -author: mjcaparas +author: dansimp ms.assetid: d4f92f4d-eba7-4e6e-b166-13670864d298 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md b/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md index a27d832f3f..1b8e2fa12c 100644 --- a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md +++ b/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Deleting, Restoring, or Destroying a GPO description: Deleting, Restoring, or Destroying a GPO -author: mjcaparas +author: dansimp ms.assetid: 3e1b862e-007a-4b60-900f-0489069f5c75 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md b/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md index e9a7b13f30..b97ab849ad 100644 --- a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md +++ b/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Deleting, Restoring, or Destroying a GPO description: Deleting, Restoring, or Destroying a GPO -author: mjcaparas +author: dansimp ms.assetid: 3af6c396-61c8-4b32-9fd8-28e9f15e575c ms.reviewer: manager: dansimp diff --git a/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md b/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md index 96207fe50f..b68db7b2ea 100644 --- a/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md +++ b/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md @@ -1,7 +1,7 @@ --- title: Deleting, Restoring, or Destroying a GPO description: Deleting, Restoring, or Destroying a GPO -author: mjcaparas +author: dansimp ms.assetid: 089c68e7-c1a5-418a-8776-cf23960f10c4 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/deploy-a-gpo-agpm30ops.md b/mdop/agpm/deploy-a-gpo-agpm30ops.md index 15b54d327d..776112e102 100644 --- a/mdop/agpm/deploy-a-gpo-agpm30ops.md +++ b/mdop/agpm/deploy-a-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Deploy a GPO description: Deploy a GPO -author: mjcaparas +author: dansimp ms.assetid: 3767b722-db43-40f1-a714-bb8e38bcaa10 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/deploy-a-gpo-agpm40.md b/mdop/agpm/deploy-a-gpo-agpm40.md index d24c1562ea..dd8273b4fc 100644 --- a/mdop/agpm/deploy-a-gpo-agpm40.md +++ b/mdop/agpm/deploy-a-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Deploy a GPO description: Deploy a GPO -author: mjcaparas +author: dansimp ms.assetid: a6febeaa-144b-4c02-99af-d972f0f2b544 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/deploy-a-gpo.md b/mdop/agpm/deploy-a-gpo.md index 6cccb83b8a..cddc1433c8 100644 --- a/mdop/agpm/deploy-a-gpo.md +++ b/mdop/agpm/deploy-a-gpo.md @@ -1,7 +1,7 @@ --- title: Deploy a GPO description: Deploy a GPO -author: mjcaparas +author: dansimp ms.assetid: a0a3f292-e3ab-46ae-a0fd-d7b2b4ad8883 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/destroy-a-gpo-agpm30ops.md b/mdop/agpm/destroy-a-gpo-agpm30ops.md index dd853317de..39d4b138ce 100644 --- a/mdop/agpm/destroy-a-gpo-agpm30ops.md +++ b/mdop/agpm/destroy-a-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Destroy a GPO description: Destroy a GPO -author: mjcaparas +author: dansimp ms.assetid: bfabd71a-47f3-462e-b86f-5f15762b9e28 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/destroy-a-gpo-agpm40.md b/mdop/agpm/destroy-a-gpo-agpm40.md index 28f76ae7c9..8fe48c6000 100644 --- a/mdop/agpm/destroy-a-gpo-agpm40.md +++ b/mdop/agpm/destroy-a-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Destroy a GPO description: Destroy a GPO -author: mjcaparas +author: dansimp ms.assetid: 09bce8c4-f75b-4633-b80b-d894bbec95c9 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/destroy-a-gpo.md b/mdop/agpm/destroy-a-gpo.md index 4c21c398e6..7ba2a6f165 100644 --- a/mdop/agpm/destroy-a-gpo.md +++ b/mdop/agpm/destroy-a-gpo.md @@ -1,7 +1,7 @@ --- title: Destroy a GPO description: Destroy a GPO -author: mjcaparas +author: dansimp ms.assetid: d74941a3-beef-46cd-a4ca-80a324dcfadf ms.reviewer: manager: dansimp diff --git a/mdop/agpm/domain-delegation-tab-agpm30ops.md b/mdop/agpm/domain-delegation-tab-agpm30ops.md index aa5f709f13..e6ce2ce32d 100644 --- a/mdop/agpm/domain-delegation-tab-agpm30ops.md +++ b/mdop/agpm/domain-delegation-tab-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Domain Delegation Tab description: Domain Delegation Tab -author: mjcaparas +author: dansimp ms.assetid: 523cdf39-f4b8-4d20-a917-3485756658ce ms.reviewer: manager: dansimp diff --git a/mdop/agpm/domain-delegation-tab-agpm40.md b/mdop/agpm/domain-delegation-tab-agpm40.md index 5d2f696910..884dfe968b 100644 --- a/mdop/agpm/domain-delegation-tab-agpm40.md +++ b/mdop/agpm/domain-delegation-tab-agpm40.md @@ -1,7 +1,7 @@ --- title: Domain Delegation Tab description: Domain Delegation Tab -author: mjcaparas +author: dansimp ms.assetid: 5be5841e-92fb-4af6-aa68-0ae50f8d5141 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/domain-delegation-tab.md b/mdop/agpm/domain-delegation-tab.md index 476c26e436..27847ba556 100644 --- a/mdop/agpm/domain-delegation-tab.md +++ b/mdop/agpm/domain-delegation-tab.md @@ -1,7 +1,7 @@ --- title: Domain Delegation Tab description: Domain Delegation Tab -author: mjcaparas +author: dansimp ms.assetid: 15a9bfff-e25b-4b62-9ebc-521a5f4eae96 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/edit-a-gpo-offline-agpm30ops.md b/mdop/agpm/edit-a-gpo-offline-agpm30ops.md index 5518d46244..9d85b7de64 100644 --- a/mdop/agpm/edit-a-gpo-offline-agpm30ops.md +++ b/mdop/agpm/edit-a-gpo-offline-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Edit a GPO Offline description: Edit a GPO Offline -author: mjcaparas +author: dansimp ms.assetid: 51677d8a-6209-41b5-82ed-4f3be817abc0 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/edit-a-gpo-offline-agpm40.md b/mdop/agpm/edit-a-gpo-offline-agpm40.md index 4f311a1cc3..86cd27fe82 100644 --- a/mdop/agpm/edit-a-gpo-offline-agpm40.md +++ b/mdop/agpm/edit-a-gpo-offline-agpm40.md @@ -1,7 +1,7 @@ --- title: Edit a GPO Offline description: Edit a GPO Offline -author: mjcaparas +author: dansimp ms.assetid: 9c75eb3c-d4d5-41e0-b65e-8b4464a42cd9 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/edit-a-gpo-offline.md b/mdop/agpm/edit-a-gpo-offline.md index 6ea16ebc61..f10b9771de 100644 --- a/mdop/agpm/edit-a-gpo-offline.md +++ b/mdop/agpm/edit-a-gpo-offline.md @@ -1,7 +1,7 @@ --- title: Edit a GPO Offline description: Edit a GPO Offline -author: mjcaparas +author: dansimp ms.assetid: 4a148952-9fe9-4ec4-8df1-b25e37c97a54 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/editing-a-gpo-agpm30ops.md b/mdop/agpm/editing-a-gpo-agpm30ops.md index 36bd0a1166..ff27db8319 100644 --- a/mdop/agpm/editing-a-gpo-agpm30ops.md +++ b/mdop/agpm/editing-a-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Editing a GPO description: Editing a GPO -author: mjcaparas +author: dansimp ms.assetid: 3024051a-ff33-46d0-9c3e-68ebae7f6b60 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/editing-a-gpo-agpm40.md b/mdop/agpm/editing-a-gpo-agpm40.md index 77dcc4e9cc..d1f6bbfeae 100644 --- a/mdop/agpm/editing-a-gpo-agpm40.md +++ b/mdop/agpm/editing-a-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Editing a GPO description: Editing a GPO -author: mjcaparas +author: dansimp ms.assetid: ef42eefe-7705-46b2-954d-18966335cbbf ms.reviewer: manager: dansimp diff --git a/mdop/agpm/editing-a-gpo.md b/mdop/agpm/editing-a-gpo.md index c4bcdd473c..860e142fc9 100644 --- a/mdop/agpm/editing-a-gpo.md +++ b/mdop/agpm/editing-a-gpo.md @@ -1,7 +1,7 @@ --- title: Editing a GPO description: Editing a GPO -author: mjcaparas +author: dansimp ms.assetid: ec77d3bb-8a64-4d8e-9c28-87763de02ec0 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/export-a-gpo-to-a-file.md b/mdop/agpm/export-a-gpo-to-a-file.md index d75d40eada..6f8016e934 100644 --- a/mdop/agpm/export-a-gpo-to-a-file.md +++ b/mdop/agpm/export-a-gpo-to-a-file.md @@ -1,7 +1,7 @@ --- title: Export a GPO to a File description: Export a GPO to a File -author: mjcaparas +author: dansimp ms.assetid: 0d01b1f7-a6a4-4d0d-9aa7-2d6f1ae93d9d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/feature-visibility-settings-agpm30ops.md b/mdop/agpm/feature-visibility-settings-agpm30ops.md index d3049f4b3f..923dbcddcb 100644 --- a/mdop/agpm/feature-visibility-settings-agpm30ops.md +++ b/mdop/agpm/feature-visibility-settings-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Feature Visibility Settings description: Feature Visibility Settings -author: mjcaparas +author: dansimp ms.assetid: 6a844478-a6b0-490d-923f-5a6f82467831 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/feature-visibility-settings-agpm40.md b/mdop/agpm/feature-visibility-settings-agpm40.md index e30c603bc7..ea02966e81 100644 --- a/mdop/agpm/feature-visibility-settings-agpm40.md +++ b/mdop/agpm/feature-visibility-settings-agpm40.md @@ -1,7 +1,7 @@ --- title: Feature Visibility Settings description: Feature Visibility Settings -author: mjcaparas +author: dansimp ms.assetid: d3c0b02a-b943-4001-8b9c-dfac8fe58789 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/feature-visibility-settings.md b/mdop/agpm/feature-visibility-settings.md index 1cb1b3fc24..4b5bdb06b8 100644 --- a/mdop/agpm/feature-visibility-settings.md +++ b/mdop/agpm/feature-visibility-settings.md @@ -1,7 +1,7 @@ --- title: Feature Visibility Settings description: Feature Visibility Settings -author: mjcaparas +author: dansimp ms.assetid: 9db2ba03-fb75-4f95-9138-ec89b9fc8d01 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/history-window-agpm30ops.md b/mdop/agpm/history-window-agpm30ops.md index c3295c3095..890e223a94 100644 --- a/mdop/agpm/history-window-agpm30ops.md +++ b/mdop/agpm/history-window-agpm30ops.md @@ -1,7 +1,7 @@ --- title: History Window description: History Window -author: mjcaparas +author: dansimp ms.assetid: 114f50a4-508d-4589-b006-6cd05cffe6b7 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/history-window-agpm40.md b/mdop/agpm/history-window-agpm40.md index 7603d75dd5..0100174bae 100644 --- a/mdop/agpm/history-window-agpm40.md +++ b/mdop/agpm/history-window-agpm40.md @@ -1,7 +1,7 @@ --- title: History Window description: History Window -author: mjcaparas +author: dansimp ms.assetid: 5bea62e7-d267-40b2-a66d-fb1be7373a1c ms.reviewer: manager: dansimp diff --git a/mdop/agpm/history-window.md b/mdop/agpm/history-window.md index 0e5e9a6687..15710eda36 100644 --- a/mdop/agpm/history-window.md +++ b/mdop/agpm/history-window.md @@ -1,7 +1,7 @@ --- title: History Window description: History Window -author: mjcaparas +author: dansimp ms.assetid: f11f9ad9-bffe-4c56-8c46-fe9c0a8e55c1 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md index 370ce5130b..d1630c746f 100644 --- a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md +++ b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Identify Differences Between GPOs, GPO Versions, or Templates description: Identify Differences Between GPOs, GPO Versions, or Templates -author: mjcaparas +author: dansimp ms.assetid: e391fa91-3956-4150-9d43-900cfc88d543 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md index 57a7719f21..38b81a26ac 100644 --- a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md +++ b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md @@ -1,7 +1,7 @@ --- title: Identify Differences Between GPOs, GPO Versions, or Templates description: Identify Differences Between GPOs, GPO Versions, or Templates -author: mjcaparas +author: dansimp ms.assetid: 3f03c368-162b-450f-be6c-2807c3e8d741 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md index 31a0ed88ed..33485698c3 100644 --- a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md +++ b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md @@ -1,7 +1,7 @@ --- title: Identify Differences Between GPOs, GPO Versions, or Templates description: Identify Differences Between GPOs, GPO Versions, or Templates -author: mjcaparas +author: dansimp ms.assetid: 6320afc4-af81-47e8-9f4c-463ff99d5a53 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md b/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md index 259967c12d..d4b755d702 100644 --- a/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md +++ b/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md @@ -1,7 +1,7 @@ --- title: Import a GPO from a File description: Import a GPO from a File -author: mjcaparas +author: dansimp ms.assetid: 2cbcda72-4de3-47ad-aaf8-4fc7341d5a00 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/import-a-gpo-from-a-file-ed.md b/mdop/agpm/import-a-gpo-from-a-file-ed.md index 3019b67029..697dafa9de 100644 --- a/mdop/agpm/import-a-gpo-from-a-file-ed.md +++ b/mdop/agpm/import-a-gpo-from-a-file-ed.md @@ -1,7 +1,7 @@ --- title: Import a GPO from a File description: Import a GPO from a File -author: mjcaparas +author: dansimp ms.assetid: 6e901a52-1101-4fed-9f90-3819b573b378 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/import-a-gpo-from-production-agpm30ops.md b/mdop/agpm/import-a-gpo-from-production-agpm30ops.md index 06214d174c..5cadc7906b 100644 --- a/mdop/agpm/import-a-gpo-from-production-agpm30ops.md +++ b/mdop/agpm/import-a-gpo-from-production-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Import a GPO from Production description: Import a GPO from Production -author: mjcaparas +author: dansimp ms.assetid: 35c2a682-ece8-4577-a083-7e3e9facfd13 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/import-a-gpo-from-production-agpm40-app.md b/mdop/agpm/import-a-gpo-from-production-agpm40-app.md index af00e3582a..ef0343b66b 100644 --- a/mdop/agpm/import-a-gpo-from-production-agpm40-app.md +++ b/mdop/agpm/import-a-gpo-from-production-agpm40-app.md @@ -1,7 +1,7 @@ --- title: Import a GPO from Production description: Import a GPO from Production -author: mjcaparas +author: dansimp ms.assetid: c5b2f40d-1dc7-4dbf-b8b3-4d97ad73e1e5 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md b/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md index a10d461d9e..521e17cd6f 100644 --- a/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md +++ b/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md @@ -1,7 +1,7 @@ --- title: Import a GPO from Production description: Import a GPO from Production -author: mjcaparas +author: dansimp ms.assetid: ad14203a-2e6a-41d4-a05e-4508c80045fd ms.reviewer: manager: dansimp diff --git a/mdop/agpm/import-a-gpo-from-production-approver.md b/mdop/agpm/import-a-gpo-from-production-approver.md index 6895bd2248..b3b6509ac6 100644 --- a/mdop/agpm/import-a-gpo-from-production-approver.md +++ b/mdop/agpm/import-a-gpo-from-production-approver.md @@ -1,7 +1,7 @@ --- title: Import a GPO from Production description: Import a GPO from Production -author: mjcaparas +author: dansimp ms.assetid: 071270fa-1890-40ce-ab89-ce070a54aa59 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md b/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md index cc32d29e0f..6233511c16 100644 --- a/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md +++ b/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Import a GPO from Production description: Import a GPO from Production -author: mjcaparas +author: dansimp ms.assetid: ad90f13e-e73c-400f-b86f-c12f2e75d19d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/import-a-gpo-from-production-editor.md b/mdop/agpm/import-a-gpo-from-production-editor.md index 3ee29adf06..a67b4eb887 100644 --- a/mdop/agpm/import-a-gpo-from-production-editor.md +++ b/mdop/agpm/import-a-gpo-from-production-editor.md @@ -1,7 +1,7 @@ --- title: Import a GPO from Production description: Import a GPO from Production -author: mjcaparas +author: dansimp ms.assetid: ffa02b2a-2a43-4fc0-a06e-7d4b59022cc3 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/index.md b/mdop/agpm/index.md index 324327c269..3832e088c4 100644 --- a/mdop/agpm/index.md +++ b/mdop/agpm/index.md @@ -1,7 +1,7 @@ --- title: Advanced Group Policy Management description: Advanced Group Policy Management -author: jamiejdt +author: dansimp ms.assetid: 493ca3c3-c3d6-4bb1-9430-dc1e43c86bb0 ms.pagetype: mdop ms.mktglfcycl: manage diff --git a/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md b/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md index 1aa5500034..2a32a77423 100644 --- a/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md +++ b/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Label the Current Version of a GPO description: Label the Current Version of a GPO -author: mjcaparas +author: dansimp ms.assetid: 3845211a-0bc9-4875-9906-cb758c443825 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md b/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md index 4a8c652822..8e2ca70456 100644 --- a/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md +++ b/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Label the Current Version of a GPO description: Label the Current Version of a GPO -author: mjcaparas +author: dansimp ms.assetid: cadc8769-21da-44b0-8122-6cafdb448913 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/label-the-current-version-of-a-gpo.md b/mdop/agpm/label-the-current-version-of-a-gpo.md index 23520638fb..518cff6f2c 100644 --- a/mdop/agpm/label-the-current-version-of-a-gpo.md +++ b/mdop/agpm/label-the-current-version-of-a-gpo.md @@ -1,7 +1,7 @@ --- title: Label the Current Version of a GPO description: Label the Current Version of a GPO -author: mjcaparas +author: dansimp ms.assetid: 5e4e50f8-e4a8-4bda-aac4-1569d5fbd6a7 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md b/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md index d119a83fa7..c74a38c572 100644 --- a/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md +++ b/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Limit the GPO Versions Stored description: Limit the GPO Versions Stored -author: mjcaparas +author: dansimp ms.assetid: da14edc5-0c36-4c54-b122-861c86b99eb1 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md b/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md index 2570da4136..9ca2d0acda 100644 --- a/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md +++ b/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md @@ -1,7 +1,7 @@ --- title: Limit the GPO Versions Stored description: Limit the GPO Versions Stored -author: mjcaparas +author: dansimp ms.assetid: d802c7b6-f303-4b23-aefd-f19f1300b0ff ms.reviewer: manager: dansimp diff --git a/mdop/agpm/logging-and-tracing-settings-agpm30ops.md b/mdop/agpm/logging-and-tracing-settings-agpm30ops.md index 327edf7784..adb810c271 100644 --- a/mdop/agpm/logging-and-tracing-settings-agpm30ops.md +++ b/mdop/agpm/logging-and-tracing-settings-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Logging and Tracing Settings description: Logging and Tracing Settings -author: mjcaparas +author: dansimp ms.assetid: 858b6fbf-65b4-42fa-95a9-69b04e5734d7 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/logging-and-tracing-settings-agpm40.md b/mdop/agpm/logging-and-tracing-settings-agpm40.md index 3e42a4a154..2c42860152 100644 --- a/mdop/agpm/logging-and-tracing-settings-agpm40.md +++ b/mdop/agpm/logging-and-tracing-settings-agpm40.md @@ -1,7 +1,7 @@ --- title: Logging and Tracing Settings description: Logging and Tracing Settings -author: mjcaparas +author: dansimp ms.assetid: 66d03306-80d8-4132-bf71-2827157b1fc9 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/logging-and-tracing-settings.md b/mdop/agpm/logging-and-tracing-settings.md index ec78ccc511..67460cfdb5 100644 --- a/mdop/agpm/logging-and-tracing-settings.md +++ b/mdop/agpm/logging-and-tracing-settings.md @@ -1,7 +1,7 @@ --- title: Logging and Tracing Settings description: Logging and Tracing Settings -author: mjcaparas +author: dansimp ms.assetid: db6b43c7-fdde-4d11-b5ab-a81346e56940 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/managing-the-agpm-service-agpm30ops.md b/mdop/agpm/managing-the-agpm-service-agpm30ops.md index 9896b4a887..3b9da4b940 100644 --- a/mdop/agpm/managing-the-agpm-service-agpm30ops.md +++ b/mdop/agpm/managing-the-agpm-service-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Managing the AGPM Service description: Managing the AGPM Service -author: mjcaparas +author: dansimp ms.assetid: a522b1f1-c57b-43aa-9d75-acc6f9bedbf9 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/managing-the-agpm-service-agpm40.md b/mdop/agpm/managing-the-agpm-service-agpm40.md index 96280adf4b..76fedcb48b 100644 --- a/mdop/agpm/managing-the-agpm-service-agpm40.md +++ b/mdop/agpm/managing-the-agpm-service-agpm40.md @@ -1,7 +1,7 @@ --- title: Managing the AGPM Service description: Managing the AGPM Service -author: mjcaparas +author: dansimp ms.assetid: 48ca02aa-6acf-403b-afd4-66ae8a953246 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/managing-the-agpm-service.md b/mdop/agpm/managing-the-agpm-service.md index 174c061105..da8f07c50c 100644 --- a/mdop/agpm/managing-the-agpm-service.md +++ b/mdop/agpm/managing-the-agpm-service.md @@ -1,7 +1,7 @@ --- title: Managing the AGPM Service description: Managing the AGPM Service -author: mjcaparas +author: dansimp ms.assetid: 331f64d2-1236-4711-81b4-1b92f019bfa5 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/managing-the-archive-agpm40.md b/mdop/agpm/managing-the-archive-agpm40.md index e22bed1a2d..39f7a9a28e 100644 --- a/mdop/agpm/managing-the-archive-agpm40.md +++ b/mdop/agpm/managing-the-archive-agpm40.md @@ -1,7 +1,7 @@ --- title: Managing the Archive description: Managing the Archive -author: mjcaparas +author: dansimp ms.assetid: b11a3d71-74ea-4dd7-b243-6f2880b7af2d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/managing-the-archive.md b/mdop/agpm/managing-the-archive.md index ba25337775..6b1a2d21c5 100644 --- a/mdop/agpm/managing-the-archive.md +++ b/mdop/agpm/managing-the-archive.md @@ -1,7 +1,7 @@ --- title: Managing the Archive description: Managing the Archive -author: mjcaparas +author: dansimp ms.assetid: 7c7654e9-ab0e-4531-8ef7-ae77ef391620 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/modify-the-agpm-service-account.md b/mdop/agpm/modify-the-agpm-service-account.md index 21bd9e501c..780d107283 100644 --- a/mdop/agpm/modify-the-agpm-service-account.md +++ b/mdop/agpm/modify-the-agpm-service-account.md @@ -1,7 +1,7 @@ --- title: Modify the AGPM Service Account description: Modify the AGPM Service Account -author: mjcaparas +author: dansimp ms.assetid: 0d8d8c7b-f299-4fee-8414-406492156942 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/modify-the-agpm-service-agpm30ops.md b/mdop/agpm/modify-the-agpm-service-agpm30ops.md index ce08a4d000..8834c5eb34 100644 --- a/mdop/agpm/modify-the-agpm-service-agpm30ops.md +++ b/mdop/agpm/modify-the-agpm-service-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Modify the AGPM Service description: Modify the AGPM Service -author: mjcaparas +author: dansimp ms.assetid: 3485f85f-59d1-48dc-8748-36826214dcb1 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/modify-the-agpm-service-agpm40.md b/mdop/agpm/modify-the-agpm-service-agpm40.md index 20ec5c3a65..1fdf5b8ecb 100644 --- a/mdop/agpm/modify-the-agpm-service-agpm40.md +++ b/mdop/agpm/modify-the-agpm-service-agpm40.md @@ -1,7 +1,7 @@ --- title: Modify the AGPM Service description: Modify the AGPM Service -author: mjcaparas +author: dansimp ms.assetid: 3239d088-bb86-4ec4-bc56-dbe8f1c710f5 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/modify-the-archive-path.md b/mdop/agpm/modify-the-archive-path.md index 0e52f280d7..ea4a9c81c7 100644 --- a/mdop/agpm/modify-the-archive-path.md +++ b/mdop/agpm/modify-the-archive-path.md @@ -1,7 +1,7 @@ --- title: Modify the Archive Path description: Modify the Archive Path -author: mjcaparas +author: dansimp ms.assetid: 6d90daf9-58db-4166-b5b3-e84bb261164a ms.reviewer: manager: dansimp diff --git a/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md b/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md index 6ad27ab0b6..420514276e 100644 --- a/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md +++ b/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md @@ -1,7 +1,7 @@ --- title: Modify the Port on Which the AGPM Service Listens description: Modify the Port on Which the AGPM Service Listens -author: mjcaparas +author: dansimp ms.assetid: a82c6873-e916-4a04-b263-aa612cd6956b ms.reviewer: manager: dansimp diff --git a/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md b/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md index 027abbaaa7..696cc928a3 100644 --- a/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md +++ b/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md @@ -1,7 +1,7 @@ --- title: Move the AGPM Server and the Archive description: Move the AGPM Server and the Archive -author: mjcaparas +author: dansimp ms.assetid: 9ec48d3a-c293-45f0-8939-32ccdc062303 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/move-the-agpm-server-and-the-archive.md b/mdop/agpm/move-the-agpm-server-and-the-archive.md index 93f0d42c02..29baec8da0 100644 --- a/mdop/agpm/move-the-agpm-server-and-the-archive.md +++ b/mdop/agpm/move-the-agpm-server-and-the-archive.md @@ -1,7 +1,7 @@ --- title: Move the AGPM Server and the Archive description: Move the AGPM Server and the Archive -author: mjcaparas +author: dansimp ms.assetid: 13cb83c4-bb42-4e81-8660-5b7540f473d8 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md index 464ddc37b5..c0c1b78cb0 100644 --- a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md +++ b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md @@ -1,7 +1,7 @@ --- title: Operations Guide for Microsoft Advanced Group Policy Management 2.5 description: Operations Guide for Microsoft Advanced Group Policy Management 2.5 -author: mjcaparas +author: dansimp ms.assetid: 005f0bb5-789f-42a9-bcaf-7e8c31a8df66 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md index eaa5a661af..77dfd7402a 100644 --- a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md +++ b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Operations Guide for Microsoft Advanced Group Policy Management 3.0 description: Operations Guide for Microsoft Advanced Group Policy Management 3.0 -author: mjcaparas +author: dansimp ms.assetid: aaefe6d1-a9e5-43eb-b4d8-85880798cb8b ms.reviewer: manager: dansimp diff --git a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md index 7243627a33..e6c33c6490 100644 --- a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md +++ b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md @@ -1,7 +1,7 @@ --- title: Operations Guide for Microsoft Advanced Group Policy Management 4.0 description: Operations Guide for Microsoft Advanced Group Policy Management 4.0 -author: mjcaparas +author: dansimp ms.assetid: 0bafeba3-20a9-4360-be5d-03f786df11ee ms.reviewer: manager: dansimp diff --git a/mdop/agpm/other-enhancements-to-the-gpmc.md b/mdop/agpm/other-enhancements-to-the-gpmc.md index d68a942bcd..fdf7e3ab2f 100644 --- a/mdop/agpm/other-enhancements-to-the-gpmc.md +++ b/mdop/agpm/other-enhancements-to-the-gpmc.md @@ -1,7 +1,7 @@ --- title: Other Enhancements to the GPMC description: Other Enhancements to the GPMC -author: mjcaparas +author: dansimp ms.assetid: ef344101-17e1-4e06-9dc8-2f20ca796774 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md b/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md index e14a1f4b10..ae01c964e7 100644 --- a/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md +++ b/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Overview of Advanced Group Policy Management description: Overview of Advanced Group Policy Management -author: mjcaparas +author: dansimp ms.assetid: 3a8d1e58-12b9-42bd-898f-6d57514dfbb9 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md b/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md index 4d4f47e6ad..67111dde93 100644 --- a/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md +++ b/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md @@ -1,7 +1,7 @@ --- title: Overview of Advanced Group Policy Management description: Overview of Advanced Group Policy Management -author: mjcaparas +author: dansimp ms.assetid: 2c12f3b4-8472-4c5b-b7f8-1c98a80d6b47 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/overview-of-advanced-group-policy-management.md b/mdop/agpm/overview-of-advanced-group-policy-management.md index 6bbb659ca4..d39125dff8 100644 --- a/mdop/agpm/overview-of-advanced-group-policy-management.md +++ b/mdop/agpm/overview-of-advanced-group-policy-management.md @@ -1,7 +1,7 @@ --- title: Overview of Advanced Group Policy Management description: Overview of Advanced Group Policy Management -author: mjcaparas +author: dansimp ms.assetid: 028de9dd-848b-42bc-a982-65ba5c433772 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/pending-gpo-commands-agpm30ops.md b/mdop/agpm/pending-gpo-commands-agpm30ops.md index c155fbc2cf..ac209741db 100644 --- a/mdop/agpm/pending-gpo-commands-agpm30ops.md +++ b/mdop/agpm/pending-gpo-commands-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Pending GPO Commands description: Pending GPO Commands -author: mjcaparas +author: dansimp ms.assetid: 3868dda0-8a41-4bba-9b0c-9f656f9a3cd5 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/pending-gpo-commands-agpm40.md b/mdop/agpm/pending-gpo-commands-agpm40.md index 1e6862db89..6355b75c72 100644 --- a/mdop/agpm/pending-gpo-commands-agpm40.md +++ b/mdop/agpm/pending-gpo-commands-agpm40.md @@ -1,7 +1,7 @@ --- title: Pending GPO Commands description: Pending GPO Commands -author: mjcaparas +author: dansimp ms.assetid: b62f49e1-43ab-4c93-8102-96cd97a4adad ms.reviewer: manager: dansimp diff --git a/mdop/agpm/pending-tab.md b/mdop/agpm/pending-tab.md index 4ee185771f..651aed92e0 100644 --- a/mdop/agpm/pending-tab.md +++ b/mdop/agpm/pending-tab.md @@ -1,7 +1,7 @@ --- title: Pending Tab description: Pending Tab -author: mjcaparas +author: dansimp ms.assetid: 54a9a977-c0bc-4553-922b-b2e10e162df9 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md b/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md index b23cff06c7..cb634d1f12 100644 --- a/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md +++ b/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Performing AGPM Administrator Tasks description: Performing AGPM Administrator Tasks -author: mjcaparas +author: dansimp ms.assetid: 9678b0f4-70a5-411e-a896-afa4dc9ea6c4 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md b/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md index aa73d0ac46..f8ccba7272 100644 --- a/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md +++ b/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md @@ -1,7 +1,7 @@ --- title: Performing AGPM Administrator Tasks description: Performing AGPM Administrator Tasks -author: mjcaparas +author: dansimp ms.assetid: bc746f39-bdc9-4e2a-bc48-c3c7905de098 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/performing-agpm-administrator-tasks.md b/mdop/agpm/performing-agpm-administrator-tasks.md index ebc6992639..71b1c9749c 100644 --- a/mdop/agpm/performing-agpm-administrator-tasks.md +++ b/mdop/agpm/performing-agpm-administrator-tasks.md @@ -1,7 +1,7 @@ --- title: Performing AGPM Administrator Tasks description: Performing AGPM Administrator Tasks -author: mjcaparas +author: dansimp ms.assetid: 32e694a7-be64-4943-bce2-2a3a15e5341f ms.reviewer: manager: dansimp diff --git a/mdop/agpm/performing-approver-tasks-agpm30ops.md b/mdop/agpm/performing-approver-tasks-agpm30ops.md index 457707ad10..4c519657e9 100644 --- a/mdop/agpm/performing-approver-tasks-agpm30ops.md +++ b/mdop/agpm/performing-approver-tasks-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Performing Approver Tasks description: Performing Approver Tasks -author: mjcaparas +author: dansimp ms.assetid: 9f711824-191b-4b4b-a1c6-a3b2116006a4 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/performing-approver-tasks-agpm40.md b/mdop/agpm/performing-approver-tasks-agpm40.md index 8a19c9ecda..2a949f0a84 100644 --- a/mdop/agpm/performing-approver-tasks-agpm40.md +++ b/mdop/agpm/performing-approver-tasks-agpm40.md @@ -1,7 +1,7 @@ --- title: Performing Approver Tasks description: Performing Approver Tasks -author: mjcaparas +author: dansimp ms.assetid: e0a4b7fe-ce69-4755-9104-c7f523ea6b62 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/performing-approver-tasks.md b/mdop/agpm/performing-approver-tasks.md index ce05f48885..fd4190ca12 100644 --- a/mdop/agpm/performing-approver-tasks.md +++ b/mdop/agpm/performing-approver-tasks.md @@ -1,7 +1,7 @@ --- title: Performing Approver Tasks description: Performing Approver Tasks -author: mjcaparas +author: dansimp ms.assetid: 6f6310b3-19c1-47c9-8615-964ddd10ce14 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/performing-editor-tasks-agpm30ops.md b/mdop/agpm/performing-editor-tasks-agpm30ops.md index abc69827c2..e6f638319a 100644 --- a/mdop/agpm/performing-editor-tasks-agpm30ops.md +++ b/mdop/agpm/performing-editor-tasks-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Performing Editor Tasks description: Performing Editor Tasks -author: mjcaparas +author: dansimp ms.assetid: d4ac3277-2557-41cf-ac90-5adb6c30687c ms.reviewer: manager: dansimp diff --git a/mdop/agpm/performing-editor-tasks-agpm40.md b/mdop/agpm/performing-editor-tasks-agpm40.md index b776479dfc..d359605154 100644 --- a/mdop/agpm/performing-editor-tasks-agpm40.md +++ b/mdop/agpm/performing-editor-tasks-agpm40.md @@ -1,7 +1,7 @@ --- title: Performing Editor Tasks description: Performing Editor Tasks -author: mjcaparas +author: dansimp ms.assetid: 81976a01-2a95-4256-b703-9fb3c884ef34 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/performing-editor-tasks.md b/mdop/agpm/performing-editor-tasks.md index eeea2a652c..5ba1b63760 100644 --- a/mdop/agpm/performing-editor-tasks.md +++ b/mdop/agpm/performing-editor-tasks.md @@ -1,7 +1,7 @@ --- title: Performing Editor Tasks description: Performing Editor Tasks -author: mjcaparas +author: dansimp ms.assetid: b1e62615-2e02-460e-81d1-4a3fbe59f62d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/performing-reviewer-tasks-agpm30ops.md b/mdop/agpm/performing-reviewer-tasks-agpm30ops.md index 94d4b73d01..79dddb832c 100644 --- a/mdop/agpm/performing-reviewer-tasks-agpm30ops.md +++ b/mdop/agpm/performing-reviewer-tasks-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Performing Reviewer Tasks description: Performing Reviewer Tasks -author: mjcaparas +author: dansimp ms.assetid: 1faf396d-be0d-49ac-b063-0722fda2e43d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/performing-reviewer-tasks-agpm40.md b/mdop/agpm/performing-reviewer-tasks-agpm40.md index 5bf87e09a7..e4dc40829d 100644 --- a/mdop/agpm/performing-reviewer-tasks-agpm40.md +++ b/mdop/agpm/performing-reviewer-tasks-agpm40.md @@ -1,7 +1,7 @@ --- title: Performing Reviewer Tasks description: Performing Reviewer Tasks -author: mjcaparas +author: dansimp ms.assetid: b5f0805c-da55-45a5-a94c-2473af92b54a ms.reviewer: manager: dansimp diff --git a/mdop/agpm/performing-reviewer-tasks.md b/mdop/agpm/performing-reviewer-tasks.md index aa542e0ac9..f2ea335680 100644 --- a/mdop/agpm/performing-reviewer-tasks.md +++ b/mdop/agpm/performing-reviewer-tasks.md @@ -1,7 +1,7 @@ --- title: Performing Reviewer Tasks description: Performing Reviewer Tasks -author: mjcaparas +author: dansimp ms.assetid: 4bdd43fa-5c73-4900-8947-b45906f47f60 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/production-delegation-tab-agpm30ops.md b/mdop/agpm/production-delegation-tab-agpm30ops.md index efa8ccb039..32ef7974df 100644 --- a/mdop/agpm/production-delegation-tab-agpm30ops.md +++ b/mdop/agpm/production-delegation-tab-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Production Delegation Tab description: Production Delegation Tab -author: mjcaparas +author: dansimp ms.assetid: 9851637d-d5c1-4d29-8582-e8779500a14e ms.reviewer: manager: dansimp diff --git a/mdop/agpm/production-delegation-tab-agpm40.md b/mdop/agpm/production-delegation-tab-agpm40.md index 29e323127c..118c822a7d 100644 --- a/mdop/agpm/production-delegation-tab-agpm40.md +++ b/mdop/agpm/production-delegation-tab-agpm40.md @@ -1,7 +1,7 @@ --- title: Production Delegation Tab description: Production Delegation Tab -author: mjcaparas +author: dansimp ms.assetid: 046bb9bc-769a-4306-bc49-c159a9533552 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/recycle-bin-commands-agpm30ops.md b/mdop/agpm/recycle-bin-commands-agpm30ops.md index baf41c217c..d3ed4beea9 100644 --- a/mdop/agpm/recycle-bin-commands-agpm30ops.md +++ b/mdop/agpm/recycle-bin-commands-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Recycle Bin Commands description: Recycle Bin Commands -author: mjcaparas +author: dansimp ms.assetid: ffe8f020-7aa9-40ad-8019-cc99901a7840 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/recycle-bin-commands-agpm40.md b/mdop/agpm/recycle-bin-commands-agpm40.md index ddd12cfd22..a1be8b3f88 100644 --- a/mdop/agpm/recycle-bin-commands-agpm40.md +++ b/mdop/agpm/recycle-bin-commands-agpm40.md @@ -1,7 +1,7 @@ --- title: Recycle Bin Commands description: Recycle Bin Commands -author: mjcaparas +author: dansimp ms.assetid: 347a101f-0ba0-4afc-bd59-752cc06bb904 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/recycle-bin-tab.md b/mdop/agpm/recycle-bin-tab.md index 95d40a6e1d..749191d42c 100644 --- a/mdop/agpm/recycle-bin-tab.md +++ b/mdop/agpm/recycle-bin-tab.md @@ -1,7 +1,7 @@ --- title: Recycle Bin Tab description: Recycle Bin Tab -author: mjcaparas +author: dansimp ms.assetid: 9ce62e98-c03e-4a75-90e0-51be83c6d2db ms.reviewer: manager: dansimp diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md index f72ca9d61d..26e276ed65 100644 --- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md +++ b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md @@ -1,7 +1,7 @@ --- title: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1 description: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1 -author: mjcaparas +author: dansimp ms.assetid: 91835bf8-e53c-4202-986e-8d37050d1267 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md index e5a7a19136..9c609242ce 100644 --- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md +++ b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md @@ -1,7 +1,7 @@ --- title: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2 description: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2 -author: mjcaparas +author: dansimp ms.assetid: 0593cd11-3308-4942-bf19-8a7bb9447f01 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md index 2c9d766a6d..cfeb0c897e 100644 --- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md +++ b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md @@ -1,7 +1,7 @@ --- title: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3 description: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3 -author: mjcaparas +author: dansimp ms.assetid: 955d7674-a8d9-4fc5-b18a-5a1639e38014 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md index caa920e145..1230a91148 100644 --- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md +++ b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md @@ -1,7 +1,7 @@ --- title: Release Notes for Microsoft Advanced Group Policy Management 4.0 description: Release Notes for Microsoft Advanced Group Policy Management 4.0 -author: mjcaparas +author: dansimp ms.assetid: 44c19e61-c8e8-48aa-a2c2-20396d14d5bb ms.reviewer: manager: dansimp diff --git a/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md b/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md index 3aa827f71f..6c457983f8 100644 --- a/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md +++ b/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Rename a GPO or Template description: Rename a GPO or Template -author: mjcaparas +author: dansimp ms.assetid: 19d17ddf-8b58-4677-929e-9550fa388b93 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/rename-a-gpo-or-template-agpm40.md b/mdop/agpm/rename-a-gpo-or-template-agpm40.md index 7befd4f578..a2a1b19820 100644 --- a/mdop/agpm/rename-a-gpo-or-template-agpm40.md +++ b/mdop/agpm/rename-a-gpo-or-template-agpm40.md @@ -1,7 +1,7 @@ --- title: Rename a GPO or Template description: Rename a GPO or Template -author: mjcaparas +author: dansimp ms.assetid: 84293f7a-4ff7-497e-bdbc-cabb70189a03 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/rename-a-gpo-or-template.md b/mdop/agpm/rename-a-gpo-or-template.md index 3a2a71a243..e437925f07 100644 --- a/mdop/agpm/rename-a-gpo-or-template.md +++ b/mdop/agpm/rename-a-gpo-or-template.md @@ -1,7 +1,7 @@ --- title: Rename a GPO or Template description: Rename a GPO or Template -author: mjcaparas +author: dansimp ms.assetid: 64a1aaf4-f672-48b5-94c6-473bf1076cf3 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md b/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md index e58c025f14..c31e31cb35 100644 --- a/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md +++ b/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md @@ -1,7 +1,7 @@ --- title: Request Control of a Previously Uncontrolled GPO description: Request Control of a Previously Uncontrolled GPO -author: mjcaparas +author: dansimp ms.assetid: 00e8725d-5d7f-4eed-a5e6-c3631632cfbd ms.reviewer: manager: dansimp diff --git a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md b/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md index 3d14dbd600..1f12840287 100644 --- a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md +++ b/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Request Control of an Uncontrolled GPO description: Request Control of an Uncontrolled GPO -author: mjcaparas +author: dansimp ms.assetid: b668a67a-5a2c-4f6a-8b1c-efa3ca0794d4 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md b/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md index 86d8e3030f..b82b4bae0c 100644 --- a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md +++ b/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Request Control of an Uncontrolled GPO description: Request Control of an Uncontrolled GPO -author: mjcaparas +author: dansimp ms.assetid: a34e0aeb-33a1-4c9f-b187-1d08493a785c ms.reviewer: manager: dansimp diff --git a/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md b/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md index 7f2ecf3393..4b6b24a531 100644 --- a/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md +++ b/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Request Deletion of a GPO description: Request Deletion of a GPO -author: mjcaparas +author: dansimp ms.assetid: 576ece5c-dc6d-4b5e-8628-01c15ae2c9a8 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/request-deletion-of-a-gpo-agpm40.md b/mdop/agpm/request-deletion-of-a-gpo-agpm40.md index 844b1cad3c..0124dc0a64 100644 --- a/mdop/agpm/request-deletion-of-a-gpo-agpm40.md +++ b/mdop/agpm/request-deletion-of-a-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Request Deletion of a GPO description: Request Deletion of a GPO -author: mjcaparas +author: dansimp ms.assetid: 2410f7a1-ccca-44cf-ab26-76ad474409e7 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md b/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md index a1fb49a16f..fcb659cd00 100644 --- a/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md +++ b/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Request Deployment of a GPO description: Request Deployment of a GPO -author: mjcaparas +author: dansimp ms.assetid: f44ae0fb-bcf7-477b-b99e-9dd6a55ee597 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/request-deployment-of-a-gpo-agpm40.md b/mdop/agpm/request-deployment-of-a-gpo-agpm40.md index 334d30d658..5c633c5a9c 100644 --- a/mdop/agpm/request-deployment-of-a-gpo-agpm40.md +++ b/mdop/agpm/request-deployment-of-a-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Request Deployment of a GPO description: Request Deployment of a GPO -author: mjcaparas +author: dansimp ms.assetid: 5783cfd0-bd93-46b4-8fa0-684bd39aa8fc ms.reviewer: manager: dansimp diff --git a/mdop/agpm/request-deployment-of-a-gpo.md b/mdop/agpm/request-deployment-of-a-gpo.md index fd81f52490..7c38b0addd 100644 --- a/mdop/agpm/request-deployment-of-a-gpo.md +++ b/mdop/agpm/request-deployment-of-a-gpo.md @@ -1,7 +1,7 @@ --- title: Request Deployment of a GPO description: Request Deployment of a GPO -author: mjcaparas +author: dansimp ms.assetid: 9aa9af29-4754-4f72-b624-bb3e1087cbe1 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md b/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md index 5eea73eb07..a5d72f95b9 100644 --- a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md +++ b/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Request Restoration of a Deleted GPO description: Request Restoration of a Deleted GPO -author: mjcaparas +author: dansimp ms.assetid: dcc3baea-8af7-4886-a301-98b6ac5819cd ms.reviewer: manager: dansimp diff --git a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md b/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md index 9a569cc216..6d7272bb13 100644 --- a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md +++ b/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Request Restoration of a Deleted GPO description: Request Restoration of a Deleted GPO -author: mjcaparas +author: dansimp ms.assetid: bac5ca3b-be47-49b5-bf1b-96280625fda8 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md index 9c7adfcc7c..2ad25d82f2 100644 --- a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md +++ b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Request the Creation of a New Controlled GPO description: Request the Creation of a New Controlled GPO -author: mjcaparas +author: dansimp ms.assetid: 4194c2f3-8116-4a35-be1a-81c84072daec ms.reviewer: manager: dansimp diff --git a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md index 155d54a519..c191185c64 100644 --- a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md +++ b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Request the Creation of a New Controlled GPO description: Request the Creation of a New Controlled GPO -author: mjcaparas +author: dansimp ms.assetid: cb265238-386f-4780-a59a-0c9a4a87d736 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md index be1818d321..fa93f03e77 100644 --- a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md +++ b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md @@ -1,7 +1,7 @@ --- title: Request the Creation of a New Controlled GPO description: Request the Creation of a New Controlled GPO -author: mjcaparas +author: dansimp ms.assetid: e1875d81-8553-42ee-8f3a-023d6ced86ca ms.reviewer: manager: dansimp diff --git a/mdop/agpm/resources-for-agpm.md b/mdop/agpm/resources-for-agpm.md index 310dda78df..04cbb5788f 100644 --- a/mdop/agpm/resources-for-agpm.md +++ b/mdop/agpm/resources-for-agpm.md @@ -1,7 +1,7 @@ --- title: Resources for AGPM description: Resources for AGPM -author: mjcaparas +author: dansimp ms.assetid: b44b58c0-2810-40d6-9677-f2f64e1add75 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md b/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md index 5f46d1b370..b213359f0d 100644 --- a/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md +++ b/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Restore a Deleted GPO description: Restore a Deleted GPO -author: mjcaparas +author: dansimp ms.assetid: 853feb0a-d2d9-4be9-a07e-e113a56a9968 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/restore-a-deleted-gpo-agpm40.md b/mdop/agpm/restore-a-deleted-gpo-agpm40.md index d68d3dc138..85f0cb5bb3 100644 --- a/mdop/agpm/restore-a-deleted-gpo-agpm40.md +++ b/mdop/agpm/restore-a-deleted-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Restore a Deleted GPO description: Restore a Deleted GPO -author: mjcaparas +author: dansimp ms.assetid: 0a131d26-a741-4a51-b612-c0bc7dbba06b ms.reviewer: manager: dansimp diff --git a/mdop/agpm/restore-a-deleted-gpo.md b/mdop/agpm/restore-a-deleted-gpo.md index 27a79b4d0e..b88e837db1 100644 --- a/mdop/agpm/restore-a-deleted-gpo.md +++ b/mdop/agpm/restore-a-deleted-gpo.md @@ -1,7 +1,7 @@ --- title: Restore a Deleted GPO description: Restore a Deleted GPO -author: mjcaparas +author: dansimp ms.assetid: e6953296-7b7d-4d1e-ad82-d4a23044cdd7 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md b/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md index 35d0247a88..40dfa1d821 100644 --- a/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md +++ b/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md @@ -1,7 +1,7 @@ --- title: Restore the Archive from a Backup description: Restore the Archive from a Backup -author: mjcaparas +author: dansimp ms.assetid: b83f6173-a236-4da2-b16e-8df20920d4cc ms.reviewer: manager: dansimp diff --git a/mdop/agpm/restore-the-archive-from-a-backup.md b/mdop/agpm/restore-the-archive-from-a-backup.md index 597857d21f..67953e93ac 100644 --- a/mdop/agpm/restore-the-archive-from-a-backup.md +++ b/mdop/agpm/restore-the-archive-from-a-backup.md @@ -1,7 +1,7 @@ --- title: Restore the Archive from a Backup description: Restore the Archive from a Backup -author: mjcaparas +author: dansimp ms.assetid: 49666337-d72c-4e44-99e4-9eb59b2355a9 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/review-gpo-links-agpm30ops.md b/mdop/agpm/review-gpo-links-agpm30ops.md index f76ec518b9..9871c1b92c 100644 --- a/mdop/agpm/review-gpo-links-agpm30ops.md +++ b/mdop/agpm/review-gpo-links-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Review GPO Links description: Review GPO Links -author: mjcaparas +author: dansimp ms.assetid: 5ae95afc-2b89-45cf-916c-efe2d43b2211 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/review-gpo-links-agpm40.md b/mdop/agpm/review-gpo-links-agpm40.md index 46af2603fc..7485933f68 100644 --- a/mdop/agpm/review-gpo-links-agpm40.md +++ b/mdop/agpm/review-gpo-links-agpm40.md @@ -1,7 +1,7 @@ --- title: Review GPO Links description: Review GPO Links -author: mjcaparas +author: dansimp ms.assetid: 3aaba9da-f0aa-466f-bd1c-49f11d00ea54 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/review-gpo-links.md b/mdop/agpm/review-gpo-links.md index e0569fce2c..b419911628 100644 --- a/mdop/agpm/review-gpo-links.md +++ b/mdop/agpm/review-gpo-links.md @@ -1,7 +1,7 @@ --- title: Review GPO Links description: Review GPO Links -author: mjcaparas +author: dansimp ms.assetid: 3c472448-f16a-493c-a229-5ca60a470965 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/review-gpo-settings-agpm30ops.md b/mdop/agpm/review-gpo-settings-agpm30ops.md index 5568f18e0f..6c569b8d1b 100644 --- a/mdop/agpm/review-gpo-settings-agpm30ops.md +++ b/mdop/agpm/review-gpo-settings-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Review GPO Settings description: Review GPO Settings -author: mjcaparas +author: dansimp ms.assetid: bed956d0-082e-4fa9-bf1e-572d0d3d02ec ms.reviewer: manager: dansimp diff --git a/mdop/agpm/review-gpo-settings-agpm40.md b/mdop/agpm/review-gpo-settings-agpm40.md index 2b24c18e22..77e60f42cc 100644 --- a/mdop/agpm/review-gpo-settings-agpm40.md +++ b/mdop/agpm/review-gpo-settings-agpm40.md @@ -1,7 +1,7 @@ --- title: Review GPO Settings description: Review GPO Settings -author: mjcaparas +author: dansimp ms.assetid: c346bcde-dd6a-4775-aeab-721ca3a361b2 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/review-gpo-settings.md b/mdop/agpm/review-gpo-settings.md index 406ad65b0c..952c2ac544 100644 --- a/mdop/agpm/review-gpo-settings.md +++ b/mdop/agpm/review-gpo-settings.md @@ -1,7 +1,7 @@ --- title: Review GPO Settings description: Review GPO Settings -author: mjcaparas +author: dansimp ms.assetid: e82570b2-d8ce-4bf0-8ad7-8910409f3041 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md b/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md index 14901c7456..f9c5735347 100644 --- a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md +++ b/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Roll Back to a Previous Version of a GPO description: Roll Back to a Previous Version of a GPO -author: mjcaparas +author: dansimp ms.assetid: 2a98ad8f-32cb-41eb-ab99-0318f2a55d81 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md b/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md index 2363f2055b..7068147b6c 100644 --- a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md +++ b/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md @@ -1,7 +1,7 @@ --- title: Roll Back to a Previous Version of a GPO description: Roll Back to a Previous Version of a GPO -author: mjcaparas +author: dansimp ms.assetid: 028631c0-4cb9-4642-90ad-04cd813051b7 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md b/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md index 5a9b000943..3df03b1ccd 100644 --- a/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md +++ b/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md @@ -1,7 +1,7 @@ --- title: Roll Back to an Earlier Version of a GPO description: Roll Back to an Earlier Version of a GPO -author: mjcaparas +author: dansimp ms.assetid: 06ce9251-95e0-46d0-99c2-b9a0690e5891 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/search-and-filter-the-list-of-gpos.md b/mdop/agpm/search-and-filter-the-list-of-gpos.md index 51af8002eb..1ad003bf5a 100644 --- a/mdop/agpm/search-and-filter-the-list-of-gpos.md +++ b/mdop/agpm/search-and-filter-the-list-of-gpos.md @@ -1,7 +1,7 @@ --- title: Search and Filter the List of GPOs description: Search and Filter the List of GPOs -author: mjcaparas +author: dansimp ms.assetid: 1bc58a38-033c-4aed-9eb4-c239827f5501 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/set-a-default-template-agpm30ops.md b/mdop/agpm/set-a-default-template-agpm30ops.md index aab61140e4..05832f8ef0 100644 --- a/mdop/agpm/set-a-default-template-agpm30ops.md +++ b/mdop/agpm/set-a-default-template-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Set a Default Template description: Set a Default Template -author: mjcaparas +author: dansimp ms.assetid: 84edbd69-451b-4c10-a898-781d4b75d09c ms.reviewer: manager: dansimp diff --git a/mdop/agpm/set-a-default-template-agpm40.md b/mdop/agpm/set-a-default-template-agpm40.md index 68c165be29..4369a82870 100644 --- a/mdop/agpm/set-a-default-template-agpm40.md +++ b/mdop/agpm/set-a-default-template-agpm40.md @@ -1,7 +1,7 @@ --- title: Set a Default Template description: Set a Default Template -author: mjcaparas +author: dansimp ms.assetid: 07208b6b-cb3a-4f6c-9c84-36d4dc1486d8 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/set-a-default-template.md b/mdop/agpm/set-a-default-template.md index 354b961123..8386ca2b9c 100644 --- a/mdop/agpm/set-a-default-template.md +++ b/mdop/agpm/set-a-default-template.md @@ -1,7 +1,7 @@ --- title: Set a Default Template description: Set a Default Template -author: mjcaparas +author: dansimp ms.assetid: e0acf980-437f-4357-b237-298aaebe490d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md b/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md index bd04d77d92..93d74f5f37 100644 --- a/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md +++ b/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Start and Stop the AGPM Service description: Start and Stop the AGPM Service -author: mjcaparas +author: dansimp ms.assetid: b9d26920-c439-4992-9a78-73e4fba8309d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md b/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md index 7d19498e83..533b33af92 100644 --- a/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md +++ b/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md @@ -1,7 +1,7 @@ --- title: Start and Stop the AGPM Service description: Start and Stop the AGPM Service -author: mjcaparas +author: dansimp ms.assetid: dcc9566c-c515-4fbe-b7f5-8ac030141307 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/start-and-stop-the-agpm-service.md b/mdop/agpm/start-and-stop-the-agpm-service.md index 05cb3f8cc5..3dbf704495 100644 --- a/mdop/agpm/start-and-stop-the-agpm-service.md +++ b/mdop/agpm/start-and-stop-the-agpm-service.md @@ -1,7 +1,7 @@ --- title: Start and Stop the AGPM Service description: Start and Stop the AGPM Service -author: mjcaparas +author: dansimp ms.assetid: 769aa0ce-224a-446f-9958-9518af4ad159 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md index b41ee4e572..fbeee131b7 100644 --- a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md +++ b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md @@ -1,7 +1,7 @@ --- title: Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5 description: Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5 -author: mjcaparas +author: dansimp ms.assetid: 454298c9-0fab-497a-9808-c0246a4c8db5 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md index d593fc9011..63df928e4f 100644 --- a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md +++ b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md @@ -1,7 +1,7 @@ --- title: Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0 description: Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0 -author: mjcaparas +author: dansimp ms.assetid: d067f465-d7c8-4f6d-b311-66b9b06874f7 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md index dc69096e0f..05228f0a31 100644 --- a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md +++ b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md @@ -1,7 +1,7 @@ --- title: Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0 description: Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0 -author: mjcaparas +author: dansimp ms.assetid: dc6f9b16-b1d4-48f3-88bb-f29301f0131c ms.reviewer: manager: dansimp @@ -272,15 +272,17 @@ As an AGPM Administrator (Full Control), you designate the e-mail addresses of A **To configure e-mail notification for AGPM** -1. In the details pane, click the **Domain Delegation** tab. +1. In **Group Policy Management Editor** , navigate to the **Change Control** folder -2. In the **From e-mail address** field, type the e-mail alias for AGPM from which notifications should be sent. +2. In the details pane, click the **Domain Delegation** tab. -3. In the **To e-mail address** field, type the e-mail address for the user account to which you intend to assign the Approver role. +3. In the **From e-mail address** field, type the e-mail alias for AGPM from which notifications should be sent. -4. In the **SMTP server** field, type a valid SMTP mail server. +4. In the **To e-mail address** field, type the e-mail address for the user account to which you intend to assign the Approver role. -5. In the **User name** and **Password** fields, type the credentials of a user who has access to the SMTP service. Click **Apply**. +5. In the **SMTP server** field, type a valid SMTP mail server. + +6. In the **User name** and **Password** fields, type the credentials of a user who has access to the SMTP service. Click **Apply**. ### Step 5: Delegate access diff --git a/mdop/agpm/technical-overview-of-agpm.md b/mdop/agpm/technical-overview-of-agpm.md index 9f7a7d14d8..8a6b243011 100644 --- a/mdop/agpm/technical-overview-of-agpm.md +++ b/mdop/agpm/technical-overview-of-agpm.md @@ -1,7 +1,7 @@ --- title: Technical Overview of AGPM description: Technical Overview of AGPM -author: mjcaparas +author: dansimp ms.assetid: 36bc0ab5-f752-474c-8559-721ea95169c2 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/template-commands-agpm30ops.md b/mdop/agpm/template-commands-agpm30ops.md index d0d078ee41..046c815f0c 100644 --- a/mdop/agpm/template-commands-agpm30ops.md +++ b/mdop/agpm/template-commands-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Template Commands description: Template Commands -author: mjcaparas +author: dansimp ms.assetid: 2ec11b3f-0c5c-4788-97bd-bd4bf64ba51a ms.reviewer: manager: dansimp diff --git a/mdop/agpm/template-commands-agpm40.md b/mdop/agpm/template-commands-agpm40.md index ab77542a14..d8a5c7af94 100644 --- a/mdop/agpm/template-commands-agpm40.md +++ b/mdop/agpm/template-commands-agpm40.md @@ -1,7 +1,7 @@ --- title: Template Commands description: Template Commands -author: mjcaparas +author: dansimp ms.assetid: 243a9b18-bf3f-44fa-94d7-5c793f7322da ms.reviewer: manager: dansimp diff --git a/mdop/agpm/templates-tab.md b/mdop/agpm/templates-tab.md index 6c6a7e617d..ff01b1c77f 100644 --- a/mdop/agpm/templates-tab.md +++ b/mdop/agpm/templates-tab.md @@ -1,7 +1,7 @@ --- title: Templates Tab description: Templates Tab -author: mjcaparas +author: dansimp ms.assetid: 5676e9f9-eb52-49e1-a55d-15c1059af368 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md b/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md index 7eebcfe46c..5770353813 100644 --- a/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md +++ b/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md @@ -1,7 +1,7 @@ --- title: Test a GPO in a Separate Organizational Unit description: Test a GPO in a Separate Organizational Unit -author: mjcaparas +author: dansimp ms.assetid: 9a9e6d22-74e6-41d8-ac2f-12a1b76ad5a0 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md b/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md index 9cfdbb49f9..85beacad4b 100644 --- a/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md +++ b/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Troubleshooting Advanced Group Policy Management description: Troubleshooting Advanced Group Policy Management -author: mjcaparas +author: dansimp ms.assetid: f7ece97c-e9f8-4b18-8c7a-a615c98d5c60 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/troubleshooting-advanced-group-policy-management.md b/mdop/agpm/troubleshooting-advanced-group-policy-management.md index 17e6a15981..eef7bb66d5 100644 --- a/mdop/agpm/troubleshooting-advanced-group-policy-management.md +++ b/mdop/agpm/troubleshooting-advanced-group-policy-management.md @@ -1,7 +1,7 @@ --- title: Troubleshooting Advanced Group Policy Management description: Troubleshooting Advanced Group Policy Management -author: mjcaparas +author: dansimp ms.assetid: f58849cf-6c5b-44d8-b356-0ed7a5b24cee ms.reviewer: manager: dansimp diff --git a/mdop/agpm/troubleshooting-agpm-agpm40.md b/mdop/agpm/troubleshooting-agpm-agpm40.md index a714041c6c..937da5a8bb 100644 --- a/mdop/agpm/troubleshooting-agpm-agpm40.md +++ b/mdop/agpm/troubleshooting-agpm-agpm40.md @@ -1,7 +1,7 @@ --- title: Troubleshooting AGPM description: Troubleshooting AGPM -author: mjcaparas +author: dansimp ms.assetid: bedcd817-beb2-47bf-aebd-e3923c4fd06f ms.reviewer: manager: dansimp diff --git a/mdop/agpm/troubleshooting-agpm40-upgrades.md b/mdop/agpm/troubleshooting-agpm40-upgrades.md new file mode 100644 index 0000000000..90e2ca7e1d --- /dev/null +++ b/mdop/agpm/troubleshooting-agpm40-upgrades.md @@ -0,0 +1,41 @@ +--- +title: Troubleshooting AGPM Upgrades +description: Troubleshooting AGPM Upgrades +author: dansimp +ms.assetid: 1abbf0c1-fd32-46a8-a3ba-c005f066523d +ms.reviewer: +manager: dansimp +ms.author: jedodson +ms.pagetype: mdop +ms.mktglfcycl: manage +ms.sitesec: library +ms.prod: w10 +ms.date: 06/16/2016 +--- + + +# Troubleshooting AGPM Upgrades + +This section lists common issues that you may encounter when you upgrade your Advanced Group Policy Management (AGPM) server to a newer version (e.g. AGPM 4.0 to AGPM 4.3). To diagnose issues not listed here, it may be helpful to view the [Troubleshooting AGPM](troubleshooting-agpm-agpm40.md) or for an AGPM Administrator (Full Control) to use logging and tracing. For more information, see [Configure Logging and Tracing](configure-logging-and-tracing-agpm40.md). + +## What problems are you having? + +- [Failed to generate a HTML GPO difference report (Error code 80004003)](#bkmk-error-80004003) + +### Failed to generate a HTML GPO difference report (Error code 80004003) + +- **Cause**: You have installed the AGPM upgrade package with an incorrect account. + +- **Solution**: You will need to be an AGPM administrator in order to fix this issue. + + - Ensure you know the username & password of your **AGPM service account**. + + - Log onto your AGPM server interactively as your AGPM service account. + + - This is critically important, as the install will fail if you use a different account. + + - Shutdown the AGPM service. + + - Install the required hotfix. + + - Connect to AGPM using an AGPM client to test that your difference reports are now functioning. diff --git a/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md b/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md index 63d79386b6..c371132ecd 100644 --- a/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md +++ b/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Uncontrolled GPO Commands description: Uncontrolled GPO Commands -author: mjcaparas +author: dansimp ms.assetid: 94c07b09-cb96-4ff2-b963-b25f103e73e9 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/uncontrolled-gpo-commands-agpm40.md b/mdop/agpm/uncontrolled-gpo-commands-agpm40.md index 81b96fa77a..4039771a91 100644 --- a/mdop/agpm/uncontrolled-gpo-commands-agpm40.md +++ b/mdop/agpm/uncontrolled-gpo-commands-agpm40.md @@ -1,7 +1,7 @@ --- title: Uncontrolled GPO Commands description: Uncontrolled GPO Commands -author: mjcaparas +author: dansimp ms.assetid: 05a8050f-adc3-465b-8524-bbe95745165c ms.reviewer: manager: dansimp diff --git a/mdop/agpm/uncontrolled-tab.md b/mdop/agpm/uncontrolled-tab.md index 92f967b4c2..209267d4d1 100644 --- a/mdop/agpm/uncontrolled-tab.md +++ b/mdop/agpm/uncontrolled-tab.md @@ -1,7 +1,7 @@ --- title: Uncontrolled Tab description: Uncontrolled Tab -author: mjcaparas +author: dansimp ms.assetid: d7e658bf-a72b-4813-bdc8-2fdb7251e742 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/use-a-test-environment-agpm30ops.md b/mdop/agpm/use-a-test-environment-agpm30ops.md index 02be96d42b..191a0368bf 100644 --- a/mdop/agpm/use-a-test-environment-agpm30ops.md +++ b/mdop/agpm/use-a-test-environment-agpm30ops.md @@ -1,7 +1,7 @@ --- title: Use a Test Environment description: Use a Test Environment -author: mjcaparas +author: dansimp ms.assetid: 86295084-b39e-4040-bb3f-15c3c1e99b1a ms.reviewer: manager: dansimp diff --git a/mdop/agpm/use-a-test-environment.md b/mdop/agpm/use-a-test-environment.md index 42f74a29ce..7ceb7db026 100644 --- a/mdop/agpm/use-a-test-environment.md +++ b/mdop/agpm/use-a-test-environment.md @@ -1,7 +1,7 @@ --- title: Use a Test Environment description: Use a Test Environment -author: mjcaparas +author: dansimp ms.assetid: b8d7b3ee-030a-4b5b-8223-4a3276fd47a7 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md b/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md index 1fc220154a..ec24e0f6b9 100644 --- a/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md +++ b/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md @@ -1,7 +1,7 @@ --- title: User Interface Advanced Group Policy Management description: User Interface Advanced Group Policy Management -author: mjcaparas +author: dansimp ms.assetid: 19aab694-8283-4d97-9425-1845404b461f ms.reviewer: manager: dansimp diff --git a/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md b/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md index db917b9080..4dea408268 100644 --- a/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md +++ b/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md @@ -1,7 +1,7 @@ --- title: User Interface Advanced Group Policy Management description: User Interface Advanced Group Policy Management -author: mjcaparas +author: dansimp ms.assetid: 1bf67f6a-4f24-4020-a8c1-fe440de9caa3 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/user-interface-advanced-group-policy-management.md b/mdop/agpm/user-interface-advanced-group-policy-management.md index 2ab508b6ad..df9a57c840 100644 --- a/mdop/agpm/user-interface-advanced-group-policy-management.md +++ b/mdop/agpm/user-interface-advanced-group-policy-management.md @@ -1,7 +1,7 @@ --- title: User Interface Advanced Group Policy Management description: User Interface Advanced Group Policy Management -author: mjcaparas +author: dansimp ms.assetid: 73324c99-adca-46dc-b516-ef78b7235f59 ms.reviewer: manager: dansimp diff --git a/mdop/agpm/using-a-test-environment.md b/mdop/agpm/using-a-test-environment.md index 0b9b47d7e4..e85967ce48 100644 --- a/mdop/agpm/using-a-test-environment.md +++ b/mdop/agpm/using-a-test-environment.md @@ -1,7 +1,7 @@ --- title: Using a Test Environment description: Using a Test Environment -author: mjcaparas +author: dansimp ms.assetid: fc5fcc7c-1ac8-483a-a6bd-2279ae2ee3fb ms.reviewer: manager: dansimp diff --git a/mdop/agpm/whats-new-in-agpm-30.md b/mdop/agpm/whats-new-in-agpm-30.md index 5d83cee0ba..65ef1f96ca 100644 --- a/mdop/agpm/whats-new-in-agpm-30.md +++ b/mdop/agpm/whats-new-in-agpm-30.md @@ -1,7 +1,7 @@ --- title: What's New in AGPM 3.0 description: What's New in AGPM 3.0 -author: mjcaparas +author: dansimp ms.assetid: 0d082b86-63c5-45ce-9529-6e5f37254f9d ms.reviewer: manager: dansimp diff --git a/mdop/agpm/whats-new-in-agpm-40-sp3.md b/mdop/agpm/whats-new-in-agpm-40-sp3.md index 4e65034c54..dbe0512e16 100644 --- a/mdop/agpm/whats-new-in-agpm-40-sp3.md +++ b/mdop/agpm/whats-new-in-agpm-40-sp3.md @@ -30,7 +30,7 @@ AGPM 4.0 SP3 adds support for the Windows 10 and Windows Server 2016 operating ### Support for PowerShell -AGPM 4.0 SP3 adds support for PowerShell cmdlets. For a list of the cmdlets available in AGPM 4.0 SP3, including descriptions and syntax, see [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://technet.microsoft.com/library/dn520245.aspx). +AGPM 4.0 SP3 adds support for PowerShell cmdlets. For a list of the cmdlets available in AGPM 4.0 SP3, including descriptions and syntax, see [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://docs.microsoft.com/powershell/mdop/get-started?view=win-mdop2-ps). ### Customer feedback and hotfix rollup diff --git a/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md b/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md index 1b90836822..e162df6f9b 100644 --- a/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md +++ b/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md @@ -1,7 +1,7 @@ --- title: About App-V Package Accelerators (App-V 4.6 SP1) description: About App-V Package Accelerators (App-V 4.6 SP1) -author: manikadhiman +author: dansimp ms.assetid: fc2d2375-8f17-4a6d-b374-771cb947cb8c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: manikadhiman ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/about-application-licensing.md b/mdop/appv-v4/about-application-licensing.md index 323ddc8447..039444d39d 100644 --- a/mdop/appv-v4/about-application-licensing.md +++ b/mdop/appv-v4/about-application-licensing.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-application-virtualization-applications.md b/mdop/appv-v4/about-application-virtualization-applications.md index bcde0caabe..81f4351171 100644 --- a/mdop/appv-v4/about-application-virtualization-applications.md +++ b/mdop/appv-v4/about-application-virtualization-applications.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-application-virtualization-packages.md b/mdop/appv-v4/about-application-virtualization-packages.md index cc5664e576..63e1915d67 100644 --- a/mdop/appv-v4/about-application-virtualization-packages.md +++ b/mdop/appv-v4/about-application-virtualization-packages.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-application-virtualization-servers.md b/mdop/appv-v4/about-application-virtualization-servers.md index 241dbca298..6078a1f5cb 100644 --- a/mdop/appv-v4/about-application-virtualization-servers.md +++ b/mdop/appv-v4/about-application-virtualization-servers.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md b/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md index 2ece8bb435..2379da3dff 100644 --- a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md +++ b/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md b/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md index 6e0135e762..80134f7a39 100644 --- a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md +++ b/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-45.md b/mdop/appv-v4/about-microsoft-application-virtualization-45.md index 6747f077ed..827934974f 100644 --- a/mdop/appv-v4/about-microsoft-application-virtualization-45.md +++ b/mdop/appv-v4/about-microsoft-application-virtualization-45.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md index aa774f657e..f2d49596f4 100644 --- a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md +++ b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md index d11db11a1f..ece900187a 100644 --- a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md +++ b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md index 5973540792..ef4f01c277 100644 --- a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md +++ b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46.md b/mdop/appv-v4/about-microsoft-application-virtualization-46.md index 394b921628..4e2161b45f 100644 --- a/mdop/appv-v4/about-microsoft-application-virtualization-46.md +++ b/mdop/appv-v4/about-microsoft-application-virtualization-46.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-publishing.md b/mdop/appv-v4/about-publishing.md index 54ba36cfd3..0aab27b334 100644 --- a/mdop/appv-v4/about-publishing.md +++ b/mdop/appv-v4/about-publishing.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-sequencing-phases.md b/mdop/appv-v4/about-sequencing-phases.md index 78f1f65733..e9f821e89a 100644 --- a/mdop/appv-v4/about-sequencing-phases.md +++ b/mdop/appv-v4/about-sequencing-phases.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-sharing-package-accelerators-page.md b/mdop/appv-v4/about-sharing-package-accelerators-page.md index c8cf061993..880688dd13 100644 --- a/mdop/appv-v4/about-sharing-package-accelerators-page.md +++ b/mdop/appv-v4/about-sharing-package-accelerators-page.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-the-application-virtualization-sequencer.md b/mdop/appv-v4/about-the-application-virtualization-sequencer.md index 139afed1b7..c51d335407 100644 --- a/mdop/appv-v4/about-the-application-virtualization-sequencer.md +++ b/mdop/appv-v4/about-the-application-virtualization-sequencer.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-the-application-virtualization-server-management-console.md b/mdop/appv-v4/about-the-application-virtualization-server-management-console.md index eb23af68bb..e3654b07e0 100644 --- a/mdop/appv-v4/about-the-application-virtualization-server-management-console.md +++ b/mdop/appv-v4/about-the-application-virtualization-server-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-the-deployment-tab.md b/mdop/appv-v4/about-the-deployment-tab.md index ecd0dce407..7a0a6c25b4 100644 --- a/mdop/appv-v4/about-the-deployment-tab.md +++ b/mdop/appv-v4/about-the-deployment-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/about-the-files-tab.md b/mdop/appv-v4/about-the-files-tab.md index 8d8c64dd8b..2281e4a415 100644 --- a/mdop/appv-v4/about-the-files-tab.md +++ b/mdop/appv-v4/about-the-files-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-the-osd-tab.md b/mdop/appv-v4/about-the-osd-tab.md index 6355f6a8a5..cd15ddc088 100644 --- a/mdop/appv-v4/about-the-osd-tab.md +++ b/mdop/appv-v4/about-the-osd-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-the-properties-tab.md b/mdop/appv-v4/about-the-properties-tab.md index 60f67d1be8..49f24affb3 100644 --- a/mdop/appv-v4/about-the-properties-tab.md +++ b/mdop/appv-v4/about-the-properties-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-the-sequencer-console.md b/mdop/appv-v4/about-the-sequencer-console.md index 836a438e18..c9ade6aad8 100644 --- a/mdop/appv-v4/about-the-sequencer-console.md +++ b/mdop/appv-v4/about-the-sequencer-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-the-virtual-file-system-tab.md b/mdop/appv-v4/about-the-virtual-file-system-tab.md index bd07a942c7..c63df76467 100644 --- a/mdop/appv-v4/about-the-virtual-file-system-tab.md +++ b/mdop/appv-v4/about-the-virtual-file-system-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/about-the-virtual-registry-tab.md b/mdop/appv-v4/about-the-virtual-registry-tab.md index 71e0e3aa94..580a4456c0 100644 --- a/mdop/appv-v4/about-the-virtual-registry-tab.md +++ b/mdop/appv-v4/about-the-virtual-registry-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-the-virtual-services-tab.md b/mdop/appv-v4/about-the-virtual-services-tab.md index 94b51a9dd2..9da1a5c4f1 100644 --- a/mdop/appv-v4/about-the-virtual-services-tab.md +++ b/mdop/appv-v4/about-the-virtual-services-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-using-the-sequencer-command-line.md b/mdop/appv-v4/about-using-the-sequencer-command-line.md index 844d28f414..b54eeb6152 100644 --- a/mdop/appv-v4/about-using-the-sequencer-command-line.md +++ b/mdop/appv-v4/about-using-the-sequencer-command-line.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/about-virtual-environments.md b/mdop/appv-v4/about-virtual-environments.md index 91448a0bbb..263e550a58 100644 --- a/mdop/appv-v4/about-virtual-environments.md +++ b/mdop/appv-v4/about-virtual-environments.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/add-app.md b/mdop/appv-v4/add-app.md index 56e1ff83ee..be8e8866ee 100644 --- a/mdop/appv-v4/add-app.md +++ b/mdop/appv-v4/add-app.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/add-package.md b/mdop/appv-v4/add-package.md index 58a1f87769..80ed132da5 100644 --- a/mdop/appv-v4/add-package.md +++ b/mdop/appv-v4/add-package.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/add-server.md b/mdop/appv-v4/add-server.md index 3db501a538..546c6c2e3a 100644 --- a/mdop/appv-v4/add-server.md +++ b/mdop/appv-v4/add-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/add-type.md b/mdop/appv-v4/add-type.md index 804035833e..cfcbb9e6fb 100644 --- a/mdop/appv-v4/add-type.md +++ b/mdop/appv-v4/add-type.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/administrators-node.md b/mdop/appv-v4/administrators-node.md index 4c36416137..633c1da358 100644 --- a/mdop/appv-v4/administrators-node.md +++ b/mdop/appv-v4/administrators-node.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/administrators-results-pane-columns.md b/mdop/appv-v4/administrators-results-pane-columns.md index 7a62f2ddf6..57de6d3cde 100644 --- a/mdop/appv-v4/administrators-results-pane-columns.md +++ b/mdop/appv-v4/administrators-results-pane-columns.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/administrators-results-pane.md b/mdop/appv-v4/administrators-results-pane.md index 8432b0e579..88516a4348 100644 --- a/mdop/appv-v4/administrators-results-pane.md +++ b/mdop/appv-v4/administrators-results-pane.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md index 055f74d65d..4eec31af83 100644 --- a/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md +++ b/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/app-v-45-sp2-release-notes.md b/mdop/appv-v4/app-v-45-sp2-release-notes.md index dc5d8fafe0..ab0e856ca4 100644 --- a/mdop/appv-v4/app-v-45-sp2-release-notes.md +++ b/mdop/appv-v4/app-v-45-sp2-release-notes.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- @@ -73,11 +73,11 @@ When this has been completed, install the App-V 4.5 SP2 Clients by using Setup.m When installing Microsoft Application Error Reporting, use the following command if you are installing or upgrading to the App-V 4.5 SP2 Desktop Client: -**    msiexec /i dw20shared.msi APPGUID={C6FC75B9-7D86-4C44-8BDB-EAFE1F0E200D}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus** +**msiexec /i dw20shared.msi APPGUID={C6FC75B9-7D86-4C44-8BDB-EAFE1F0E200D}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus** Alternatively, if you are installing or upgrading to the App-V 4.5 SP2 Client for Remote Desktop Services (formerly Terminal Services), use the following command: -**    msiexec /i dw20shared.msi APPGUID={ECF80BBA-CA07-4A74-9ED6-E064F38AF1F5} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus** +**msiexec /i dw20shared.msi APPGUID={ECF80BBA-CA07-4A74-9ED6-E064F38AF1F5} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus** **Note**   - The APPGUID parameter references the product code of the App-V Clients that you install or upgrade. The product code is unique for each Setup.msi. You can use the Orca Database Editor or a similar tool to examine Windows Installer files and determine the product code. This step is required for all installations or upgrades to App-V 4.5 SP2. diff --git a/mdop/appv-v4/app-v-46-release-notes.md b/mdop/appv-v4/app-v-46-release-notes.md index efa16e1ff9..08a8ca5d64 100644 --- a/mdop/appv-v4/app-v-46-release-notes.md +++ b/mdop/appv-v4/app-v-46-release-notes.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/app-v-46-sp1-release-notes.md b/mdop/appv-v4/app-v-46-sp1-release-notes.md index 09ea6abd40..dd7fa73a1b 100644 --- a/mdop/appv-v4/app-v-46-sp1-release-notes.md +++ b/mdop/appv-v4/app-v-46-sp1-release-notes.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/app-v-46-sp2-release-notes.md b/mdop/appv-v4/app-v-46-sp2-release-notes.md index 9da44bdde6..227967a34a 100644 --- a/mdop/appv-v4/app-v-46-sp2-release-notes.md +++ b/mdop/appv-v4/app-v-46-sp2-release-notes.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/app-v-46-sp3-release-notes.md b/mdop/appv-v4/app-v-46-sp3-release-notes.md index 7dc2b557c3..d62afda16b 100644 --- a/mdop/appv-v4/app-v-46-sp3-release-notes.md +++ b/mdop/appv-v4/app-v-46-sp3-release-notes.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/app-v-application-wmi-class.md b/mdop/appv-v4/app-v-application-wmi-class.md index 7aae865573..3567a8da0e 100644 --- a/mdop/appv-v4/app-v-application-wmi-class.md +++ b/mdop/appv-v4/app-v-application-wmi-class.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/app-v-client-registry-values-sp1.md b/mdop/appv-v4/app-v-client-registry-values-sp1.md index 59e5ac9ae5..5edc5870e2 100644 --- a/mdop/appv-v4/app-v-client-registry-values-sp1.md +++ b/mdop/appv-v4/app-v-client-registry-values-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/app-v-desktop-client-security.md b/mdop/appv-v4/app-v-desktop-client-security.md index 8b1261715e..2bf8723032 100644 --- a/mdop/appv-v4/app-v-desktop-client-security.md +++ b/mdop/appv-v4/app-v-desktop-client-security.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/app-v-installation-checklist.md b/mdop/appv-v4/app-v-installation-checklist.md index 4b2e5c573d..68208f051d 100644 --- a/mdop/appv-v4/app-v-installation-checklist.md +++ b/mdop/appv-v4/app-v-installation-checklist.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md b/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md index be861b5d2c..b4fc7f6ba0 100644 --- a/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md +++ b/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/app-v-package-wmi-class.md b/mdop/appv-v4/app-v-package-wmi-class.md index bd91ad1751..f9efeee4ce 100644 --- a/mdop/appv-v4/app-v-package-wmi-class.md +++ b/mdop/appv-v4/app-v-package-wmi-class.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/app-v-postinstallation-checklist.md b/mdop/appv-v4/app-v-postinstallation-checklist.md index 87b30551fd..814811b75f 100644 --- a/mdop/appv-v4/app-v-postinstallation-checklist.md +++ b/mdop/appv-v4/app-v-postinstallation-checklist.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/app-v-pre-installation-checklist.md b/mdop/appv-v4/app-v-pre-installation-checklist.md index c426c83566..4de02e6032 100644 --- a/mdop/appv-v4/app-v-pre-installation-checklist.md +++ b/mdop/appv-v4/app-v-pre-installation-checklist.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/app-v-upgrade-checklist.md b/mdop/appv-v4/app-v-upgrade-checklist.md index fcabc76d01..942fa32de6 100644 --- a/mdop/appv-v4/app-v-upgrade-checklist.md +++ b/mdop/appv-v4/app-v-upgrade-checklist.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/application-utilization-reportserver.md b/mdop/appv-v4/application-utilization-reportserver.md index 29301ef748..78ed55aaad 100644 --- a/mdop/appv-v4/application-utilization-reportserver.md +++ b/mdop/appv-v4/application-utilization-reportserver.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md b/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md index fbeb7f66e6..e7bf14bd06 100644 --- a/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md +++ b/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md b/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md index 5934984a4d..2f13cd29a0 100644 --- a/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md +++ b/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/application-virtualization-client-management-console-overview.md b/mdop/appv-v4/application-virtualization-client-management-console-overview.md index 314b2e91ef..1f514c7ba3 100644 --- a/mdop/appv-v4/application-virtualization-client-management-console-overview.md +++ b/mdop/appv-v4/application-virtualization-client-management-console-overview.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-client-management-console-reference.md b/mdop/appv-v4/application-virtualization-client-management-console-reference.md index 0d705a6dbc..e13ceabe61 100644 --- a/mdop/appv-v4/application-virtualization-client-management-console-reference.md +++ b/mdop/appv-v4/application-virtualization-client-management-console-reference.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md b/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md index c00f5ef58d..a65de90286 100644 --- a/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md +++ b/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-client-management-console.md b/mdop/appv-v4/application-virtualization-client-management-console.md index 703e1fcab3..e8e5980d13 100644 --- a/mdop/appv-v4/application-virtualization-client-management-console.md +++ b/mdop/appv-v4/application-virtualization-client-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-client-reference.md b/mdop/appv-v4/application-virtualization-client-reference.md index 2363a32ee3..bc3dbef0d8 100644 --- a/mdop/appv-v4/application-virtualization-client-reference.md +++ b/mdop/appv-v4/application-virtualization-client-reference.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-client-wmi-provider.md b/mdop/appv-v4/application-virtualization-client-wmi-provider.md index 39b1ebb2ed..dd3b3f8eae 100644 --- a/mdop/appv-v4/application-virtualization-client-wmi-provider.md +++ b/mdop/appv-v4/application-virtualization-client-wmi-provider.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-client.md b/mdop/appv-v4/application-virtualization-client.md index 1756d814d7..819dd8bed1 100644 --- a/mdop/appv-v4/application-virtualization-client.md +++ b/mdop/appv-v4/application-virtualization-client.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md index ae15062828..4bd4d4fe49 100644 --- a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md +++ b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md index c7c5b57205..d71379b47f 100644 --- a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md +++ b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md index 7e6e309b9b..c09ced741d 100644 --- a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md +++ b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-deployment-requirements.md b/mdop/appv-v4/application-virtualization-deployment-requirements.md index 2d00a73d21..9baee67d59 100644 --- a/mdop/appv-v4/application-virtualization-deployment-requirements.md +++ b/mdop/appv-v4/application-virtualization-deployment-requirements.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-glossary.md b/mdop/appv-v4/application-virtualization-glossary.md index 441bff3d5d..3669509527 100644 --- a/mdop/appv-v4/application-virtualization-glossary.md +++ b/mdop/appv-v4/application-virtualization-glossary.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md b/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md index c459939b7c..9b480ae5f3 100644 --- a/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md +++ b/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-properties-file-system-tab.md b/mdop/appv-v4/application-virtualization-properties-file-system-tab.md index 2a116d4707..fe4acb134a 100644 --- a/mdop/appv-v4/application-virtualization-properties-file-system-tab.md +++ b/mdop/appv-v4/application-virtualization-properties-file-system-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-properties-general-tab.md b/mdop/appv-v4/application-virtualization-properties-general-tab.md index 31bfb94c4b..375209e344 100644 --- a/mdop/appv-v4/application-virtualization-properties-general-tab.md +++ b/mdop/appv-v4/application-virtualization-properties-general-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md b/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md index 87085b92cf..ada91ffa6f 100644 --- a/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md +++ b/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-properties-interface-tab.md b/mdop/appv-v4/application-virtualization-properties-interface-tab.md index 558c483a39..fedbe93af5 100644 --- a/mdop/appv-v4/application-virtualization-properties-interface-tab.md +++ b/mdop/appv-v4/application-virtualization-properties-interface-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-properties-permissions-tab.md b/mdop/appv-v4/application-virtualization-properties-permissions-tab.md index b80b1b8d6a..b830275c12 100644 --- a/mdop/appv-v4/application-virtualization-properties-permissions-tab.md +++ b/mdop/appv-v4/application-virtualization-properties-permissions-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-reference.md b/mdop/appv-v4/application-virtualization-reference.md index 974d97b6f6..11b374d4e3 100644 --- a/mdop/appv-v4/application-virtualization-reference.md +++ b/mdop/appv-v4/application-virtualization-reference.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-report-types.md b/mdop/appv-v4/application-virtualization-report-types.md index 6ea5f2c5b6..3e81bdd8f6 100644 --- a/mdop/appv-v4/application-virtualization-report-types.md +++ b/mdop/appv-v4/application-virtualization-report-types.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencer-command-line.md b/mdop/appv-v4/application-virtualization-sequencer-command-line.md index a8be9c0b31..abbc660844 100644 --- a/mdop/appv-v4/application-virtualization-sequencer-command-line.md +++ b/mdop/appv-v4/application-virtualization-sequencer-command-line.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencer-console-overview.md b/mdop/appv-v4/application-virtualization-sequencer-console-overview.md index cb4b33d294..1669e0fe12 100644 --- a/mdop/appv-v4/application-virtualization-sequencer-console-overview.md +++ b/mdop/appv-v4/application-virtualization-sequencer-console-overview.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md b/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md index 22cdebc6e0..cc7fa3c205 100644 --- a/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md +++ b/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencer-online-help.md b/mdop/appv-v4/application-virtualization-sequencer-online-help.md index ca78682274..3164dedaf1 100644 --- a/mdop/appv-v4/application-virtualization-sequencer-online-help.md +++ b/mdop/appv-v4/application-virtualization-sequencer-online-help.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md index 99a1ab2bb0..894504a132 100644 --- a/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md +++ b/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencer-overview.md b/mdop/appv-v4/application-virtualization-sequencer-overview.md index 3c9e44e3ab..efe77f6f0e 100644 --- a/mdop/appv-v4/application-virtualization-sequencer-overview.md +++ b/mdop/appv-v4/application-virtualization-sequencer-overview.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencer-reference.md b/mdop/appv-v4/application-virtualization-sequencer-reference.md index e68f8bfb5c..69240cc62a 100644 --- a/mdop/appv-v4/application-virtualization-sequencer-reference.md +++ b/mdop/appv-v4/application-virtualization-sequencer-reference.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md b/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md index 75d1b5f1a4..36c372bd1c 100644 --- a/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md +++ b/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencer.md b/mdop/appv-v4/application-virtualization-sequencer.md index 7ba4e42e1c..3f31f87b42 100644 --- a/mdop/appv-v4/application-virtualization-sequencer.md +++ b/mdop/appv-v4/application-virtualization-sequencer.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md index 19fe7b1ff4..e3b9b48948 100644 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md +++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md index 6b96b69061..7d58727b72 100644 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md +++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md index a987309e5f..1a7aceec55 100644 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md +++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md index bea986ef57..c195624f90 100644 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md +++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md index fde9035b02..0fa1b9ca03 100644 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md +++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md index fbbb325980..995ae0facc 100644 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md +++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md index cab2f6fa85..8f834f6d26 100644 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md +++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md index 3cefd2e341..996fff81b1 100644 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md +++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md index e27772099e..6a9437812a 100644 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md +++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md index ac297b38e4..87689f417f 100644 --- a/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md +++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md b/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md index fd47fcd34c..8a53cc64f2 100644 --- a/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md +++ b/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- @@ -19,7 +19,7 @@ ms.date: 06/16/2016 If you plan to use a server-based deployment scenario for your Microsoft Application Virtualization environment, it is important to understand the differences between the *Application Virtualization Management Server* and the *Application Virtualization Streaming Server*. This topic describes those differences and also provides information about package delivery methods, transmission protocols, and external components that you will need to consider as you proceed with your deployment. -## Application Virtualization Management Server +## Application Virtualization Management Server The Application Virtualization Management Server performs both the publishing function and the streaming function. The server publishes application icons, shortcuts, and file type associations to the App-V clients for authorized users. When user requests for applications are received the server streams that data on-demand to authorized users using RTSP or RTSPS protocols. In most configurations using this server, one or more Management Servers share a common data store for configuration and package information. @@ -28,7 +28,7 @@ The Application Virtualization Management Servers use Active Directory groups to Because the Application Virtualization Management Servers stream applications to end-users on demand, these servers are ideally suited for system configurations that have reliable, high-bandwidth LANs. -## Application Virtualization Streaming Server +## Application Virtualization Streaming Server The Application Virtualization Streaming Server delivers the same streaming and package upgrade capabilities provided by the Management Server, but without its Active Directory or SQL Server requirements. However, the Streaming Server does not have a publishing service, nor does it have licensing or metering capabilities. The publishing service of a separate App-V Management Server is used in conjunction with the App-V Streaming Server. The App-V Streaming Server addresses the needs of businesses that want to use Application Virtualization in multiple locations with the streaming capabilities of the classic server configuration but might not have the infrastructure to support App-V Management Servers in every location. diff --git a/mdop/appv-v4/application-virtualization-server-based-scenario.md b/mdop/appv-v4/application-virtualization-server-based-scenario.md index e572a24620..84336dad16 100644 --- a/mdop/appv-v4/application-virtualization-server-based-scenario.md +++ b/mdop/appv-v4/application-virtualization-server-based-scenario.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-server-management-console-reference.md b/mdop/appv-v4/application-virtualization-server-management-console-reference.md index 24e202d492..c36cd7f3fd 100644 --- a/mdop/appv-v4/application-virtualization-server-management-console-reference.md +++ b/mdop/appv-v4/application-virtualization-server-management-console-reference.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-server-management-help.md b/mdop/appv-v4/application-virtualization-server-management-help.md index eebfea01e7..7ae7b3aab4 100644 --- a/mdop/appv-v4/application-virtualization-server-management-help.md +++ b/mdop/appv-v4/application-virtualization-server-management-help.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-server.md b/mdop/appv-v4/application-virtualization-server.md index 088cca81ff..db3ac34238 100644 --- a/mdop/appv-v4/application-virtualization-server.md +++ b/mdop/appv-v4/application-virtualization-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-system-requirements.md b/mdop/appv-v4/application-virtualization-system-requirements.md index 0688d51f04..d912bfff73 100644 --- a/mdop/appv-v4/application-virtualization-system-requirements.md +++ b/mdop/appv-v4/application-virtualization-system-requirements.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md b/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md index 0e6f43502d..3420240770 100644 --- a/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md +++ b/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/applications-licenses-node.md b/mdop/appv-v4/applications-licenses-node.md index e41472ad97..3bc727a6b1 100644 --- a/mdop/appv-v4/applications-licenses-node.md +++ b/mdop/appv-v4/applications-licenses-node.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/applications-licenses-results-pane-columns.md b/mdop/appv-v4/applications-licenses-results-pane-columns.md index db5a7c01f6..9fe5dbaaf8 100644 --- a/mdop/appv-v4/applications-licenses-results-pane-columns.md +++ b/mdop/appv-v4/applications-licenses-results-pane-columns.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/applications-licenses-results-pane.md b/mdop/appv-v4/applications-licenses-results-pane.md index 8ef30047ea..3339644301 100644 --- a/mdop/appv-v4/applications-licenses-results-pane.md +++ b/mdop/appv-v4/applications-licenses-results-pane.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/applications-node-in-server-management-console.md b/mdop/appv-v4/applications-node-in-server-management-console.md index 69d90c8bdb..0dd4066e35 100644 --- a/mdop/appv-v4/applications-node-in-server-management-console.md +++ b/mdop/appv-v4/applications-node-in-server-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/applications-node.md b/mdop/appv-v4/applications-node.md index 872ead9d24..760ebc733a 100644 --- a/mdop/appv-v4/applications-node.md +++ b/mdop/appv-v4/applications-node.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md b/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md index f39b06792c..55a7172da2 100644 --- a/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md +++ b/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/applications-results-pane-columns.md b/mdop/appv-v4/applications-results-pane-columns.md index 763e99c393..c7c7c41ec3 100644 --- a/mdop/appv-v4/applications-results-pane-columns.md +++ b/mdop/appv-v4/applications-results-pane-columns.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/applications-results-pane-in-server-management-console.md b/mdop/appv-v4/applications-results-pane-in-server-management-console.md index bd376a200e..ea36979d73 100644 --- a/mdop/appv-v4/applications-results-pane-in-server-management-console.md +++ b/mdop/appv-v4/applications-results-pane-in-server-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/applications-results-pane.md b/mdop/appv-v4/applications-results-pane.md index 22f28cbc17..ad52fe65d1 100644 --- a/mdop/appv-v4/applications-results-pane.md +++ b/mdop/appv-v4/applications-results-pane.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md b/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md index 98700d6626..8ac9a89ec9 100644 --- a/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md +++ b/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/change-history-tab-keep.md b/mdop/appv-v4/change-history-tab-keep.md index 4347604ec5..7de068d479 100644 --- a/mdop/appv-v4/change-history-tab-keep.md +++ b/mdop/appv-v4/change-history-tab-keep.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/clear-app.md b/mdop/appv-v4/clear-app.md index c2d2aabe62..ce8c9d4c5f 100644 --- a/mdop/appv-v4/clear-app.md +++ b/mdop/appv-v4/clear-app.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/clear-obj.md b/mdop/appv-v4/clear-obj.md index d3ca15bcc0..33dfd04705 100644 --- a/mdop/appv-v4/clear-obj.md +++ b/mdop/appv-v4/clear-obj.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/client-management-console-about-dialog-boxes.md b/mdop/appv-v4/client-management-console-about-dialog-boxes.md index 97a9f99b1d..67b7ff9eaa 100644 --- a/mdop/appv-v4/client-management-console-about-dialog-boxes.md +++ b/mdop/appv-v4/client-management-console-about-dialog-boxes.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/client-management-console-application-virtualization-node.md b/mdop/appv-v4/client-management-console-application-virtualization-node.md index 5f7297aa42..9ea64120a9 100644 --- a/mdop/appv-v4/client-management-console-application-virtualization-node.md +++ b/mdop/appv-v4/client-management-console-application-virtualization-node.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/client-management-console-application-virtualization-properties.md b/mdop/appv-v4/client-management-console-application-virtualization-properties.md index 5da7bbfacd..85513a0959 100644 --- a/mdop/appv-v4/client-management-console-application-virtualization-properties.md +++ b/mdop/appv-v4/client-management-console-application-virtualization-properties.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/client-management-console-applications-node.md b/mdop/appv-v4/client-management-console-applications-node.md index 586ba675da..6661141ad2 100644 --- a/mdop/appv-v4/client-management-console-applications-node.md +++ b/mdop/appv-v4/client-management-console-applications-node.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/client-management-console-file-type-associations-node.md b/mdop/appv-v4/client-management-console-file-type-associations-node.md index f30e504b85..f0c5570f3c 100644 --- a/mdop/appv-v4/client-management-console-file-type-associations-node.md +++ b/mdop/appv-v4/client-management-console-file-type-associations-node.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/client-management-console-publishing-servers-node.md b/mdop/appv-v4/client-management-console-publishing-servers-node.md index 304a71be0d..f863e5d717 100644 --- a/mdop/appv-v4/client-management-console-publishing-servers-node.md +++ b/mdop/appv-v4/client-management-console-publishing-servers-node.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/command-line-errors.md b/mdop/appv-v4/command-line-errors.md index 4acd9ab657..3da8e0d9f9 100644 --- a/mdop/appv-v4/command-line-errors.md +++ b/mdop/appv-v4/command-line-errors.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/command-line-parameters.md b/mdop/appv-v4/command-line-parameters.md index b404816379..2c67aced2f 100644 --- a/mdop/appv-v4/command-line-parameters.md +++ b/mdop/appv-v4/command-line-parameters.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/completion-page-package-accelerator.md b/mdop/appv-v4/completion-page-package-accelerator.md index 27a3c7d86a..7542c71906 100644 --- a/mdop/appv-v4/completion-page-package-accelerator.md +++ b/mdop/appv-v4/completion-page-package-accelerator.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/completion-page.md b/mdop/appv-v4/completion-page.md index 185a46fbcb..c733a56d5d 100644 --- a/mdop/appv-v4/completion-page.md +++ b/mdop/appv-v4/completion-page.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/configure-app.md b/mdop/appv-v4/configure-app.md index b79e177839..407824e6a0 100644 --- a/mdop/appv-v4/configure-app.md +++ b/mdop/appv-v4/configure-app.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/configure-package.md b/mdop/appv-v4/configure-package.md index 140a076da1..2bccdbf61d 100644 --- a/mdop/appv-v4/configure-package.md +++ b/mdop/appv-v4/configure-package.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/configure-server.md b/mdop/appv-v4/configure-server.md index 80234b1cb8..ed7f5ca4d8 100644 --- a/mdop/appv-v4/configure-server.md +++ b/mdop/appv-v4/configure-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/configure-software-page--learn-more-.md b/mdop/appv-v4/configure-software-page--learn-more-.md index af0b0a1d3a..87abcb67dd 100644 --- a/mdop/appv-v4/configure-software-page--learn-more-.md +++ b/mdop/appv-v4/configure-software-page--learn-more-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/configure-software-page-app-v-46-sp1.md b/mdop/appv-v4/configure-software-page-app-v-46-sp1.md index a34c98a052..7d201afb8d 100644 --- a/mdop/appv-v4/configure-software-page-app-v-46-sp1.md +++ b/mdop/appv-v4/configure-software-page-app-v-46-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/configure-type.md b/mdop/appv-v4/configure-type.md index e835038f35..42307e58cb 100644 --- a/mdop/appv-v4/configure-type.md +++ b/mdop/appv-v4/configure-type.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md b/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md index 13366bf24f..1fe3f100c5 100644 --- a/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md +++ b/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/configuring-app-v-for-secure-administration.md b/mdop/appv-v4/configuring-app-v-for-secure-administration.md index c7cba41d0a..a71fffa3c7 100644 --- a/mdop/appv-v4/configuring-app-v-for-secure-administration.md +++ b/mdop/appv-v4/configuring-app-v-for-secure-administration.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md b/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md index 5c2c349db4..fe8ec7d8bc 100644 --- a/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md +++ b/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md b/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md index 2a4167506b..86f2485e5c 100644 --- a/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md +++ b/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/configuring-certificates-to-support-the-app-v-web-management-service.md b/mdop/appv-v4/configuring-certificates-to-support-the-app-v-web-management-service.md index 5465035643..7999d55e32 100644 --- a/mdop/appv-v4/configuring-certificates-to-support-the-app-v-web-management-service.md +++ b/mdop/appv-v4/configuring-certificates-to-support-the-app-v-web-management-service.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/configuring-iis-for-secure-streaming.md b/mdop/appv-v4/configuring-iis-for-secure-streaming.md index 7257a99ab0..1e5c0be5b8 100644 --- a/mdop/appv-v4/configuring-iis-for-secure-streaming.md +++ b/mdop/appv-v4/configuring-iis-for-secure-streaming.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md b/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md index 96a4b5539a..022b096208 100644 --- a/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md +++ b/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md b/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md index 1bd95ead94..92700f1f2a 100644 --- a/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md +++ b/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md b/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md index edc3ef0f37..f8ec256bdd 100644 --- a/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md +++ b/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md b/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md index d464360774..571b263abc 100644 --- a/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md +++ b/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md b/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md index e30320dafe..688c137ae2 100644 --- a/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md +++ b/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/configuring-windows-firewall-for-app-v.md b/mdop/appv-v4/configuring-windows-firewall-for-app-v.md index 73934119ca..f97d412295 100644 --- a/mdop/appv-v4/configuring-windows-firewall-for-app-v.md +++ b/mdop/appv-v4/configuring-windows-firewall-for-app-v.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md b/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md index fc96660a9f..11cb5f957c 100644 --- a/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md +++ b/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/create-package-accelerator--review-errors--page.md b/mdop/appv-v4/create-package-accelerator--review-errors--page.md index 8d75ae4c4d..63cdf9f7e1 100644 --- a/mdop/appv-v4/create-package-accelerator--review-errors--page.md +++ b/mdop/appv-v4/create-package-accelerator--review-errors--page.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/create-package-accelerator-page.md b/mdop/appv-v4/create-package-accelerator-page.md index 375a138612..2d86172bf5 100644 --- a/mdop/appv-v4/create-package-accelerator-page.md +++ b/mdop/appv-v4/create-package-accelerator-page.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md b/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md index 71a197fc05..65aba0176a 100644 --- a/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md +++ b/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/create-package-page--app-v-46-sp1.md b/mdop/appv-v4/create-package-page--app-v-46-sp1.md index 11e4b06c98..cfd5f7b2fc 100644 --- a/mdop/appv-v4/create-package-page--app-v-46-sp1.md +++ b/mdop/appv-v4/create-package-page--app-v-46-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/customize-page--learn-more-.md b/mdop/appv-v4/customize-page--learn-more-.md index 6a0e3c74c1..0bed35f090 100644 --- a/mdop/appv-v4/customize-page--learn-more-.md +++ b/mdop/appv-v4/customize-page--learn-more-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md index e4c834e85d..a4d6ce5126 100644 --- a/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md +++ b/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md index 07fbba35bd..0fc1fd41be 100644 --- a/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md +++ b/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/delete-app.md b/mdop/appv-v4/delete-app.md index 0e41d65f85..a5a5189fe4 100644 --- a/mdop/appv-v4/delete-app.md +++ b/mdop/appv-v4/delete-app.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/delete-obj.md b/mdop/appv-v4/delete-obj.md index 6b5acf34df..e0e1085ae9 100644 --- a/mdop/appv-v4/delete-obj.md +++ b/mdop/appv-v4/delete-obj.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/delete-package.md b/mdop/appv-v4/delete-package.md index 925e63a5c9..f89b69d461 100644 --- a/mdop/appv-v4/delete-package.md +++ b/mdop/appv-v4/delete-package.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/delete-server.md b/mdop/appv-v4/delete-server.md index 4f021d2a66..7425b0751b 100644 --- a/mdop/appv-v4/delete-server.md +++ b/mdop/appv-v4/delete-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/delete-type.md b/mdop/appv-v4/delete-type.md index d0a905b4ee..62cbd9b1c7 100644 --- a/mdop/appv-v4/delete-type.md +++ b/mdop/appv-v4/delete-type.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/deployment-tab.md b/mdop/appv-v4/deployment-tab.md index d6e1eff0b6..0b872aa0ce 100644 --- a/mdop/appv-v4/deployment-tab.md +++ b/mdop/appv-v4/deployment-tab.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/determine-your-publishing-method.md b/mdop/appv-v4/determine-your-publishing-method.md index 1883661846..683549aa16 100644 --- a/mdop/appv-v4/determine-your-publishing-method.md +++ b/mdop/appv-v4/determine-your-publishing-method.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/determine-your-streaming-method.md b/mdop/appv-v4/determine-your-streaming-method.md index 290ebfd16b..eac83fa0c2 100644 --- a/mdop/appv-v4/determine-your-streaming-method.md +++ b/mdop/appv-v4/determine-your-streaming-method.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md b/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md index 9ff9753e82..a61b7c716f 100644 --- a/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md +++ b/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/disconnected-operation-mode.md b/mdop/appv-v4/disconnected-operation-mode.md index dd0d4d4240..b123b249f9 100644 --- a/mdop/appv-v4/disconnected-operation-mode.md +++ b/mdop/appv-v4/disconnected-operation-mode.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md b/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md index d0ea1928a7..7abf4bd3a7 100644 --- a/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md +++ b/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/edit-shortcuts-learn-more.md b/mdop/appv-v4/edit-shortcuts-learn-more.md index ace37c7243..830abacbd3 100644 --- a/mdop/appv-v4/edit-shortcuts-learn-more.md +++ b/mdop/appv-v4/edit-shortcuts-learn-more.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md b/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md index 51c635b149..6173dbdd7a 100644 --- a/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md +++ b/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/electronic-software-distribution-based-scenario.md b/mdop/appv-v4/electronic-software-distribution-based-scenario.md index 2c8df5d6cd..d99c4ce90f 100644 --- a/mdop/appv-v4/electronic-software-distribution-based-scenario.md +++ b/mdop/appv-v4/electronic-software-distribution-based-scenario.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/exclusion-item-dialog-box.md b/mdop/appv-v4/exclusion-item-dialog-box.md index 3038ca2a54..250a430862 100644 --- a/mdop/appv-v4/exclusion-item-dialog-box.md +++ b/mdop/appv-v4/exclusion-item-dialog-box.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/exclusion-items-tab-keep.md b/mdop/appv-v4/exclusion-items-tab-keep.md index 03cef6b8c2..e4dcff97c2 100644 --- a/mdop/appv-v4/exclusion-items-tab-keep.md +++ b/mdop/appv-v4/exclusion-items-tab-keep.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md index 5e81d25347..a08aea1e5d 100644 --- a/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md +++ b/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/file-type-association-results-pane-columns.md b/mdop/appv-v4/file-type-association-results-pane-columns.md index 553b985e35..1cdc78f1cc 100644 --- a/mdop/appv-v4/file-type-association-results-pane-columns.md +++ b/mdop/appv-v4/file-type-association-results-pane-columns.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/file-type-association-results-pane.md b/mdop/appv-v4/file-type-association-results-pane.md index c390505e3b..3b6a32eb71 100644 --- a/mdop/appv-v4/file-type-association-results-pane.md +++ b/mdop/appv-v4/file-type-association-results-pane.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/file-type-associations-node-client.md b/mdop/appv-v4/file-type-associations-node-client.md index eb1add60af..4182a0dbbf 100644 --- a/mdop/appv-v4/file-type-associations-node-client.md +++ b/mdop/appv-v4/file-type-associations-node-client.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/file-type-associations-node.md b/mdop/appv-v4/file-type-associations-node.md index a3c15d61a1..f739cf0208 100644 --- a/mdop/appv-v4/file-type-associations-node.md +++ b/mdop/appv-v4/file-type-associations-node.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/file-type-associations-results-pane-columns.md b/mdop/appv-v4/file-type-associations-results-pane-columns.md index 328719b89c..1458316d50 100644 --- a/mdop/appv-v4/file-type-associations-results-pane-columns.md +++ b/mdop/appv-v4/file-type-associations-results-pane-columns.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/file-type-associations-results-pane.md b/mdop/appv-v4/file-type-associations-results-pane.md index b92248b3ce..b1f2badd96 100644 --- a/mdop/appv-v4/file-type-associations-results-pane.md +++ b/mdop/appv-v4/file-type-associations-results-pane.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md index 3d67e35b05..c994c8d5e0 100644 --- a/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md +++ b/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/files-tab-keep.md b/mdop/appv-v4/files-tab-keep.md index 3c616264a1..aaeebd7805 100644 --- a/mdop/appv-v4/files-tab-keep.md +++ b/mdop/appv-v4/files-tab-keep.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/gathering-information-page--learn-more-.md b/mdop/appv-v4/gathering-information-page--learn-more-.md index c6c6f38d8a..2fb6c6cc6f 100644 --- a/mdop/appv-v4/gathering-information-page--learn-more-.md +++ b/mdop/appv-v4/gathering-information-page--learn-more-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/general-tab-keep.md b/mdop/appv-v4/general-tab-keep.md index 4df61af9be..58ae9340d1 100644 --- a/mdop/appv-v4/general-tab-keep.md +++ b/mdop/appv-v4/general-tab-keep.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/guidance-page-app-v-46-sp1.md b/mdop/appv-v4/guidance-page-app-v-46-sp1.md index 879ece17d3..6af524a1e1 100644 --- a/mdop/appv-v4/guidance-page-app-v-46-sp1.md +++ b/mdop/appv-v4/guidance-page-app-v-46-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/help.md b/mdop/appv-v4/help.md index 287e3fa741..1b14a81bf2 100644 --- a/mdop/appv-v4/help.md +++ b/mdop/appv-v4/help.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-add-a-file-type-association.md b/mdop/appv-v4/how-to-add-a-file-type-association.md index 046d2f8f0d..bd5e1a7cb5 100644 --- a/mdop/appv-v4/how-to-add-a-file-type-association.md +++ b/mdop/appv-v4/how-to-add-a-file-type-association.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md b/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md index 8f7b5ed7f5..6b9c002b72 100644 --- a/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md +++ b/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-add-a-package-version.md b/mdop/appv-v4/how-to-add-a-package-version.md index b2aba5778b..6a4b7c4372 100644 --- a/mdop/appv-v4/how-to-add-a-package-version.md +++ b/mdop/appv-v4/how-to-add-a-package-version.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-add-a-package.md b/mdop/appv-v4/how-to-add-a-package.md index 4e55ae9e08..b9f409c2cb 100644 --- a/mdop/appv-v4/how-to-add-a-package.md +++ b/mdop/appv-v4/how-to-add-a-package.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-add-a-server.md b/mdop/appv-v4/how-to-add-a-server.md index 4649e67c3f..0fb467e68f 100644 --- a/mdop/appv-v4/how-to-add-a-server.md +++ b/mdop/appv-v4/how-to-add-a-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-add-an-administrator-group.md b/mdop/appv-v4/how-to-add-an-administrator-group.md index 193e0366bd..27067fbc52 100644 --- a/mdop/appv-v4/how-to-add-an-administrator-group.md +++ b/mdop/appv-v4/how-to-add-an-administrator-group.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-add-an-application.md b/mdop/appv-v4/how-to-add-an-application.md index 71dbe1c7f8..760c7f8540 100644 --- a/mdop/appv-v4/how-to-add-an-application.md +++ b/mdop/appv-v4/how-to-add-an-application.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md b/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md index c1ecf63c7e..2616fee08d 100644 --- a/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md +++ b/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md b/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md index 4ac9accd65..ca8c706037 100644 --- a/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md +++ b/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md b/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md index ae25bdef3b..f24d17b75f 100644 --- a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md +++ b/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md b/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md index 2d0a95bbfd..9e1d52e3fc 100644 --- a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md +++ b/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md b/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md index ffb07d7155..84d62ca579 100644 --- a/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md +++ b/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-branch-a-package.md b/mdop/appv-v4/how-to-branch-a-package.md index 52221d9dd2..9b2ab8c069 100644 --- a/mdop/appv-v4/how-to-branch-a-package.md +++ b/mdop/appv-v4/how-to-branch-a-package.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md b/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md index d5b2380a20..32dfc28858 100644 --- a/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md +++ b/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-change-an-application-icon.md b/mdop/appv-v4/how-to-change-an-application-icon.md index 1f2881c4f8..9e9dbf95b0 100644 --- a/mdop/appv-v4/how-to-change-an-application-icon.md +++ b/mdop/appv-v4/how-to-change-an-application-icon.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-change-an-application-iconserver.md b/mdop/appv-v4/how-to-change-an-application-iconserver.md index 7f85c76a15..19445774d2 100644 --- a/mdop/appv-v4/how-to-change-an-application-iconserver.md +++ b/mdop/appv-v4/how-to-change-an-application-iconserver.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-change-deployment-properties.md b/mdop/appv-v4/how-to-change-deployment-properties.md index 66c8d2fd96..f9eb0b5d3f 100644 --- a/mdop/appv-v4/how-to-change-deployment-properties.md +++ b/mdop/appv-v4/how-to-change-deployment-properties.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-change-import-search-paths.md b/mdop/appv-v4/how-to-change-import-search-paths.md index 928852dfa1..fef1c273d9 100644 --- a/mdop/appv-v4/how-to-change-import-search-paths.md +++ b/mdop/appv-v4/how-to-change-import-search-paths.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-change-package-properties.md b/mdop/appv-v4/how-to-change-package-properties.md index abe69abeb3..565e4c27e9 100644 --- a/mdop/appv-v4/how-to-change-package-properties.md +++ b/mdop/appv-v4/how-to-change-package-properties.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md b/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md index 8346a0eb10..0aed8a88e3 100644 --- a/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md +++ b/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md b/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md index c981b9ffd1..4c3247ee57 100644 --- a/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md +++ b/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-change-the-server-cache-size.md b/mdop/appv-v4/how-to-change-the-server-cache-size.md index 198ee9a625..5b61e12a03 100644 --- a/mdop/appv-v4/how-to-change-the-server-cache-size.md +++ b/mdop/appv-v4/how-to-change-the-server-cache-size.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md b/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md index 8bfcb4dcb4..baeeef43e1 100644 --- a/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md +++ b/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-change-the-server-port.md b/mdop/appv-v4/how-to-change-the-server-port.md index 3a807f2d68..14d1933fb9 100644 --- a/mdop/appv-v4/how-to-change-the-server-port.md +++ b/mdop/appv-v4/how-to-change-the-server-port.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md b/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md index 7fe070657a..db72c07843 100644 --- a/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md +++ b/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-change-user-access-permissions.md b/mdop/appv-v4/how-to-change-user-access-permissions.md index ef7947df2b..e935af3cad 100644 --- a/mdop/appv-v4/how-to-change-user-access-permissions.md +++ b/mdop/appv-v4/how-to-change-user-access-permissions.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-clear-an-application.md b/mdop/appv-v4/how-to-clear-an-application.md index c738ca904d..2fba3e47a3 100644 --- a/mdop/appv-v4/how-to-clear-an-application.md +++ b/mdop/appv-v4/how-to-clear-an-application.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md b/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md index 801b2d13bc..0a694a6795 100644 --- a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md +++ b/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- @@ -156,7 +156,7 @@ Instead of changing the AppFS key FILENAME value every time that a new cache fil 3. On the VDI Master VM Image, open a Command Prompt window by using the **Run as administrator** option and grant remote link permissions so that the VM can access the symbolic link on the VDI Host operating system. By default, remote link permissions are disabled. - **     fsutil behavior set SymlinkEvaluation R2R:1** + **fsutil behavior set SymlinkEvaluation R2R:1** **Note**   On the storage server, appropriate link permissions must be enabled. Depending on the location of link and the Sftfs.fsd file, the permissions are **L2L:1** or **L2R:1** or **R2L:1** or **R2R:1**. diff --git a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md b/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md index 2ee211e811..8fd997eafd 100644 --- a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md +++ b/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- @@ -167,7 +167,7 @@ Instead of modifying the AppFS key FILENAME value every time that a new cache fi 3. On the VDI Master VM Image, open a Command Prompt window by using the **Run as administrator** option and grant remote link permissions so that the VM can access the symbolic link on the VDI Host operating system. By default, remote link permissions are disabled. - **     fsutil behavior set SymlinkEvaluation R2R:1** + **fsutil behavior set SymlinkEvaluation R2R:1** **Note**   On the storage server, appropriate link permissions must be enabled. Depending on the location of link and the Sftfs.fsd file, the permissions are **L2L:1** or **L2R:1** or **R2L:1** or **R2R:1**. diff --git a/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md b/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md index ec3efe7a1a..c14a8c48a6 100644 --- a/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md +++ b/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md b/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md index 978aefac2f..2b4a53819a 100644 --- a/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md +++ b/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md b/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md index 4f60659a53..1c79254fd6 100644 --- a/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md +++ b/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md b/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md index 9fb56f0792..5a4d8e1932 100644 --- a/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md +++ b/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md b/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md index 7f8b6db82f..c668b902eb 100644 --- a/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md +++ b/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md b/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md index 05d2bc0b77..afe7d0a2da 100644 --- a/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md +++ b/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md b/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md index 150d93d6c9..03e3ac7409 100644 --- a/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md +++ b/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md b/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md index 023d8ba9ba..615d3a60b6 100644 --- a/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md +++ b/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md b/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md index 1b477e3c0e..85ccb5fd59 100644 --- a/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md +++ b/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md b/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md index 9dc834b4ad..5dab5d7b35 100644 --- a/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md +++ b/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md b/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md index bd27ed1708..8225fe37da 100644 --- a/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md +++ b/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md b/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md index 9f63f76ebb..8671c8e401 100644 --- a/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md +++ b/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md b/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md index 54a3e12931..04f4c05542 100644 --- a/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md +++ b/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md b/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md index 08fb9b8dfb..fe5c5331d3 100644 --- a/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md +++ b/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md b/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md index ec298ac0dd..ee1c92f759 100644 --- a/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md +++ b/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md b/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md index 2dcd0fc57b..951cbbb2d7 100644 --- a/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md +++ b/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-client-log-file.md b/mdop/appv-v4/how-to-configure-the-client-log-file.md index 20b326dfa4..e4a46cd129 100644 --- a/mdop/appv-v4/how-to-configure-the-client-log-file.md +++ b/mdop/appv-v4/how-to-configure-the-client-log-file.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-file-server.md b/mdop/appv-v4/how-to-configure-the-file-server.md index 812c78cb2c..c9d01b4dba 100644 --- a/mdop/appv-v4/how-to-configure-the-file-server.md +++ b/mdop/appv-v4/how-to-configure-the-file-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-server-for-iis.md b/mdop/appv-v4/how-to-configure-the-server-for-iis.md index 76119811be..4290cc9bf5 100644 --- a/mdop/appv-v4/how-to-configure-the-server-for-iis.md +++ b/mdop/appv-v4/how-to-configure-the-server-for-iis.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md b/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md index 04e4ec6328..fec2c858fe 100644 --- a/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md +++ b/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-user-permissions.md b/mdop/appv-v4/how-to-configure-user-permissions.md index 31a1894e7b..88e1049577 100644 --- a/mdop/appv-v4/how-to-configure-user-permissions.md +++ b/mdop/appv-v4/how-to-configure-user-permissions.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md b/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md index 59c1e3b44c..3ec2889648 100644 --- a/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md +++ b/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md b/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md index 7578063d2b..7e516a89fd 100644 --- a/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md +++ b/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md b/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md index 9321f73949..8368dd56f8 100644 --- a/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md +++ b/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md b/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md index 097bf0d4b7..169761167e 100644 --- a/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md +++ b/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/how-to-create-a-reportserver.md b/mdop/appv-v4/how-to-create-a-reportserver.md index 134036f18f..abdfd7298e 100644 --- a/mdop/appv-v4/how-to-create-a-reportserver.md +++ b/mdop/appv-v4/how-to-create-a-reportserver.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-create-a-server-group.md b/mdop/appv-v4/how-to-create-a-server-group.md index fa407f994a..bc12c0bd0a 100644 --- a/mdop/appv-v4/how-to-create-a-server-group.md +++ b/mdop/appv-v4/how-to-create-a-server-group.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md b/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md index 249ed7b0e1..23e2b3570b 100644 --- a/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md +++ b/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md b/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md index 55143333bd..26aae4b1ea 100644 --- a/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md +++ b/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-create-an-application-group.md b/mdop/appv-v4/how-to-create-an-application-group.md index 4144e95e2f..ac2fba82be 100644 --- a/mdop/appv-v4/how-to-create-an-application-group.md +++ b/mdop/appv-v4/how-to-create-an-application-group.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-create-an-application-license-group.md b/mdop/appv-v4/how-to-create-an-application-license-group.md index e1c6567c65..76da2668b9 100644 --- a/mdop/appv-v4/how-to-create-an-application-license-group.md +++ b/mdop/appv-v4/how-to-create-an-application-license-group.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md b/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md index 522662b28d..bf6769fb47 100644 --- a/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md +++ b/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md b/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md index c169abd147..c4db220dcf 100644 --- a/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md +++ b/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-create-the-package-root-directory.md b/mdop/appv-v4/how-to-create-the-package-root-directory.md index 01ba72181f..8e00793ee2 100644 --- a/mdop/appv-v4/how-to-create-the-package-root-directory.md +++ b/mdop/appv-v4/how-to-create-the-package-root-directory.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md b/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md index 6b2e6bc05c..b745ddf86a 100644 --- a/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md +++ b/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md b/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md index 49f4a3afc7..f1e04f6d1e 100644 --- a/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md +++ b/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-delete-a-file-type-association.md b/mdop/appv-v4/how-to-delete-a-file-type-association.md index 8f12921951..16c96b8513 100644 --- a/mdop/appv-v4/how-to-delete-a-file-type-association.md +++ b/mdop/appv-v4/how-to-delete-a-file-type-association.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-delete-a-package-version.md b/mdop/appv-v4/how-to-delete-a-package-version.md index 62137f64ca..c1d92e1264 100644 --- a/mdop/appv-v4/how-to-delete-a-package-version.md +++ b/mdop/appv-v4/how-to-delete-a-package-version.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-delete-a-packageserver.md b/mdop/appv-v4/how-to-delete-a-packageserver.md index c63d2eaf35..7f2bd13bae 100644 --- a/mdop/appv-v4/how-to-delete-a-packageserver.md +++ b/mdop/appv-v4/how-to-delete-a-packageserver.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-delete-a-reportserver.md b/mdop/appv-v4/how-to-delete-a-reportserver.md index 2b8a517f7c..14ac327bbf 100644 --- a/mdop/appv-v4/how-to-delete-a-reportserver.md +++ b/mdop/appv-v4/how-to-delete-a-reportserver.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md b/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md index 21e583e5b2..1fdb2c31c6 100644 --- a/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md +++ b/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-delete-an-administrator-group.md b/mdop/appv-v4/how-to-delete-an-administrator-group.md index c825492416..d538220e01 100644 --- a/mdop/appv-v4/how-to-delete-an-administrator-group.md +++ b/mdop/appv-v4/how-to-delete-an-administrator-group.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-delete-an-application-server.md b/mdop/appv-v4/how-to-delete-an-application-server.md index 247163a1de..55f77b412f 100644 --- a/mdop/appv-v4/how-to-delete-an-application-server.md +++ b/mdop/appv-v4/how-to-delete-an-application-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-delete-an-application.md b/mdop/appv-v4/how-to-delete-an-application.md index 4ac8548398..c1e441347c 100644 --- a/mdop/appv-v4/how-to-delete-an-application.md +++ b/mdop/appv-v4/how-to-delete-an-application.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-deny-access-to-an-application.md b/mdop/appv-v4/how-to-deny-access-to-an-application.md index e1a9045654..1dd6b7fdf5 100644 --- a/mdop/appv-v4/how-to-deny-access-to-an-application.md +++ b/mdop/appv-v4/how-to-deny-access-to-an-application.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md b/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md index 2c88ccb0f0..6fda63581a 100644 --- a/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md +++ b/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md b/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md index 140d19db20..5394ec7bb3 100644 --- a/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md +++ b/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md b/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md index 07a83858b4..fc1d34c067 100644 --- a/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md +++ b/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md b/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md index b92d34564c..822fe72dd9 100644 --- a/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md +++ b/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md b/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md index 6930a3459d..41b7631eb1 100644 --- a/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md +++ b/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-edit-an-osd-file.md b/mdop/appv-v4/how-to-edit-an-osd-file.md index e150953185..6f19e9a7b7 100644 --- a/mdop/appv-v4/how-to-edit-an-osd-file.md +++ b/mdop/appv-v4/how-to-edit-an-osd-file.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md b/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md index 25d48601e0..480c2d8d34 100644 --- a/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md +++ b/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-export-a-reportserver.md b/mdop/appv-v4/how-to-export-a-reportserver.md index 6580474502..f7eb70e1aa 100644 --- a/mdop/appv-v4/how-to-export-a-reportserver.md +++ b/mdop/appv-v4/how-to-export-a-reportserver.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-grant-access-to-an-application.md b/mdop/appv-v4/how-to-grant-access-to-an-application.md index 697afb607b..89a6cf8277 100644 --- a/mdop/appv-v4/how-to-grant-access-to-an-application.md +++ b/mdop/appv-v4/how-to-grant-access-to-an-application.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-import-an-application.md b/mdop/appv-v4/how-to-import-an-application.md index ecaec1c2de..2fc950a033 100644 --- a/mdop/appv-v4/how-to-import-an-application.md +++ b/mdop/appv-v4/how-to-import-an-application.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-import-an-applicationserver.md b/mdop/appv-v4/how-to-import-an-applicationserver.md index 24b4bce0dd..66852c68c1 100644 --- a/mdop/appv-v4/how-to-import-an-applicationserver.md +++ b/mdop/appv-v4/how-to-import-an-applicationserver.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-install-a-database.md b/mdop/appv-v4/how-to-install-a-database.md index 884793e4a7..da440a18ff 100644 --- a/mdop/appv-v4/how-to-install-a-database.md +++ b/mdop/appv-v4/how-to-install-a-database.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md b/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md index 83e7e4b7d1..ba2ed5bf33 100644 --- a/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md +++ b/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-install-and-configure-the-default-application.md b/mdop/appv-v4/how-to-install-and-configure-the-default-application.md index c5bb0dbe54..529a24aadc 100644 --- a/mdop/appv-v4/how-to-install-and-configure-the-default-application.md +++ b/mdop/appv-v4/how-to-install-and-configure-the-default-application.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-install-application-virtualization-management-server.md b/mdop/appv-v4/how-to-install-application-virtualization-management-server.md index 0dd33e3482..9fff92bc25 100644 --- a/mdop/appv-v4/how-to-install-application-virtualization-management-server.md +++ b/mdop/appv-v4/how-to-install-application-virtualization-management-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md b/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md index e2f80c72dd..37596836cd 100644 --- a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md +++ b/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md b/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md index f5b25c5517..5485cfe6f6 100644 --- a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md +++ b/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md b/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md index d9c4fb364b..5cf9e908d7 100644 --- a/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md +++ b/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md b/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md index 0cd8731539..b6facad249 100644 --- a/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md +++ b/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md b/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md index ab7c6ff130..69e3331059 100644 --- a/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md +++ b/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/how-to-install-the-management-console.md b/mdop/appv-v4/how-to-install-the-management-console.md index 1f584040a8..df74e0f969 100644 --- a/mdop/appv-v4/how-to-install-the-management-console.md +++ b/mdop/appv-v4/how-to-install-the-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-install-the-management-web-service.md b/mdop/appv-v4/how-to-install-the-management-web-service.md index 66cdda0365..72f0d59456 100644 --- a/mdop/appv-v4/how-to-install-the-management-web-service.md +++ b/mdop/appv-v4/how-to-install-the-management-web-service.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md b/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md index ce132d4f49..ea900036a2 100644 --- a/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md +++ b/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-install-the-sequencer.md b/mdop/appv-v4/how-to-install-the-sequencer.md index 411a6c5b05..decce9699a 100644 --- a/mdop/appv-v4/how-to-install-the-sequencer.md +++ b/mdop/appv-v4/how-to-install-the-sequencer.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-install-the-servers-and-system-components.md b/mdop/appv-v4/how-to-install-the-servers-and-system-components.md index a5fa8f0893..d8d537d0e8 100644 --- a/mdop/appv-v4/how-to-install-the-servers-and-system-components.md +++ b/mdop/appv-v4/how-to-install-the-servers-and-system-components.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-load-files-and-packages.md b/mdop/appv-v4/how-to-load-files-and-packages.md index 21dc909c70..f70cbf6dc3 100644 --- a/mdop/appv-v4/how-to-load-files-and-packages.md +++ b/mdop/appv-v4/how-to-load-files-and-packages.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-load-or-unload-an-application.md b/mdop/appv-v4/how-to-load-or-unload-an-application.md index 94fce4808b..5dd97091a1 100644 --- a/mdop/appv-v4/how-to-load-or-unload-an-application.md +++ b/mdop/appv-v4/how-to-load-or-unload-an-application.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md b/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md index 6443110c20..c089ce97ab 100644 --- a/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md +++ b/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-lock-or-unlock-an-application.md b/mdop/appv-v4/how-to-lock-or-unlock-an-application.md index 8913276ecd..1b2b033d69 100644 --- a/mdop/appv-v4/how-to-lock-or-unlock-an-application.md +++ b/mdop/appv-v4/how-to-lock-or-unlock-an-application.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md index 67680da087..a48df6078f 100644 --- a/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md +++ b/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md index 279a9aaa89..89c0f06825 100644 --- a/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md +++ b/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md b/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md index 5c28780e12..caa426f56a 100644 --- a/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md +++ b/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md index 636e572699..bfae14c37b 100644 --- a/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md +++ b/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md index 59097cac45..920445161f 100644 --- a/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md +++ b/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md index a8f2d9bbe5..cfd2debb42 100644 --- a/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md +++ b/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md index 2717afbee8..9287af4caa 100644 --- a/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md +++ b/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md b/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md index 1f9c00705d..b3050789b3 100644 --- a/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md +++ b/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md b/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md index 3002ee21c9..c88c2c0a2e 100644 --- a/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md +++ b/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-manage-virtual-applications-manually.md b/mdop/appv-v4/how-to-manage-virtual-applications-manually.md index 9b3d5d2637..1e5aa136e6 100644 --- a/mdop/appv-v4/how-to-manage-virtual-applications-manually.md +++ b/mdop/appv-v4/how-to-manage-virtual-applications-manually.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md b/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md index 4048f3c6ba..49b1512034 100644 --- a/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md +++ b/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-manually-add-an-application.md b/mdop/appv-v4/how-to-manually-add-an-application.md index 965954b973..b503780e0d 100644 --- a/mdop/appv-v4/how-to-manually-add-an-application.md +++ b/mdop/appv-v4/how-to-manually-add-an-application.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md b/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md index 014d912472..3df7f2a0ee 100644 --- a/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md +++ b/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md @@ -9,56 +9,46 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- - # How to Manually Install the Application Virtualization Client - There are two types of Application Virtualization Client components: the Application Virtualization Desktop Client, which is designed for installation on desktop computers, and the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services), which you can install on Remote Desktop Session Host (RD Session Host) servers . Although the two client installer programs are different, you can use the following procedure to manually install either the Application Virtualization Desktop Client on a single desktop computer or the Application Virtualization Client for Remote Desktop Services on a single RD Session Host server. In a production environment, you most likely will install the Application Virtualization Desktop Client on multiple desktop computers with an automated scripted installation process. For information about how to install multiple clients by using a scripted installation process, see [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md). **Note** -1. If you are installing the Application Virtualization Client for Remote Desktop Services software on a RD Session Host server, advise users who have an open RDP or ICA client session with the RD Session Host server that they must save their work and close their sessions. In a Remote Desktop session, you can install the client the client manually. For more information about upgrading the client, see [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md). - -2. If you have any configuration on the user’s computer that depends on the client install path, note that the Application Virtualization (App-V) 4.5 client uses a different install folder than previous versions. By default, a new install of the Application Virtualization (App-V) 4.5 client will install to the \\Program Files\\Microsoft Application Virtualization Client folder. If an earlier version of the client is already installed, installing the App-V client will perform an upgrade into the existing installation folder. - +1. If you are installing the Application Virtualization Client for Remote Desktop Services software on a RD Session Host server, advise users who have an open RDP or ICA client session with the RD Session Host server that they must save their work and close their sessions. In a Remote Desktop session, you can install the client the client manually. For more information about upgrading the client, see [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md). +2. If you have any configuration on the user’s computer that depends on the client install path, note that the Application Virtualization (App-V) 4.5 client uses a different install folder than previous versions. By default, a new install of the Application Virtualization (App-V) 4.5 client will install to the \\Program Files\\Microsoft Application Virtualization Client folder. If an earlier version of the client is already installed, installing the App-V client will perform an upgrade into the existing installation folder. **Note** For App-V version 4.6 and later, when the App-V client is installed, SFTLDR.DLL is installed in the Windows\\system32 directory. If the App-V client is installed on a 64-bit system, SFTLDR\_WOW64.DLL is installed in the Windows\\SysWOW64 directory. - - **To manually install Application Virtualization Desktop Client** -1. After you have obtained the correct installer archive file and saved it to your computer, make sure you are logged on with an account having administrator rights on the computer and double-click the file to expand the archive. +1. After you have obtained the correct installer archive file and saved it to your computer, make sure you are logged on with an account having administrator rights on the computer and double-click the file to expand the archive. -2. Choose the folder in which to save the files, and then open the folder after the files have been copied to it. +2. Choose the folder in which to save the files, and then open the folder after the files have been copied to it. -3. Review the Release Notes if appropriate. +3. Review the Release Notes if appropriate. -4. Browse to find the setup.exe file, and double-click setup.exe to start the installation. +4. Browse to find the setup.exe file, and double-click setup.exe to start the installation. -5. The wizard checks the system to ensure that all prerequisite software is installed, and if any of the following are missing, the wizard will automatically prompt you to install them: +5. The wizard checks the system to ensure that all prerequisite software is installed, and if any of the following are missing, the wizard will automatically prompt you to install them: - - Microsoft Visual C++ 2005 SP1 Redistributable Package (x86) + - Microsoft Visual C++ 2005 SP1 Redistributable Package (x86) - - Microsoft Core XML Services (MSXML) 6.0 SP1 (x86) + - Microsoft Core XML Services (MSXML) 6.0 SP1 (x86) - - Microsoft Application Error Reporting + - Microsoft Application Error Reporting **Note** For App-V version 4.6 and later, the wizard will also install Microsoft Visual C++ 2008 SP1 Redistributable Package (x86). - For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see (https://go.microsoft.com/fwlink/?LinkId=150700). + For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see [https://go.microsoft.com/fwlink/?LinkId=150700](https://go.microsoft.com/fwlink/?LinkId=150700). - - -~~~ -If prompted, click **Install**. Installation progress is displayed, and the status changes from **Pending** to **Installing**. Installation status changes to **Succeeded** as each step is completed successfully. -~~~ + If prompted, click **Install**. Installation progress is displayed, and the status changes from **Pending** to **Installing**. Installation status changes to **Succeeded** as each step is completed successfully. 6. When the **Microsoft Application Virtualization Desktop Client – InstallShield Wizard** is displayed, click **Next**. @@ -76,88 +66,66 @@ If prompted, click **Install**. Installation progress is displayed, and the stat 12. On the **Application Virtualization Data Location** screen, click **Next** to accept the default data locations or complete the following actions to change where the data is stored: - 1. Click **Change**, and then browse to or, in the **Global Data Location** field, enter the destination folder for the global data location, and click **OK**. The Global Data Directory is where the Application Virtualization Desktop Client caches data shared by all users on the computer, like OSD files and SFT file data. + 1. Click **Change**, and then browse to or, in the **Global Data Location** field, enter the destination folder for the global data location, and click **OK**. The Global Data Directory is where the Application Virtualization Desktop Client caches data shared by all users on the computer, like OSD files and SFT file data. - 2. If you want to change the drive letter to be used, select the preferred drive letter from the drop-down list. + 2. If you want to change the drive letter to be used, select the preferred drive letter from the drop-down list. - 3. Enter a new path to store the user-specific data in the **User-specific Data Location** field if you want to change the data location. The User Data Directory is where the Application Virtualization Desktop Client stores user-specific information, like personal settings for virtualized applications. + 3. Enter a new path to store the user-specific data in the **User-specific Data Location** field if you want to change the data location. The User Data Directory is where the Application Virtualization Desktop Client stores user-specific information, like personal settings for virtualized applications. **Note** This path must be different for every user, so it should include a user-specific environment variable or a mapped drive or something else that will resolve to a unique path for each user. - - - 4. When you have finished making the changes, click **Next**. + 4. When you have finished making the changes, click **Next**. 13. On the **Cache Size Settings** screen, you can accept or change the default cache size. Click one of the following radio buttons to choose how to manage the cache space: - 1. **Use maximum cache size**. Enter a numeric value from 100–1,048,576 (1 TB) in the **Maximum size (MB)** field to specify the maximum size of the cache. + 1. **Use maximum cache size**. Enter a numeric value from 100–1,048,576 (1 TB) in the **Maximum size (MB)** field to specify the maximum size of the cache. - 2. **Use free disk space threshold**. Enter a numeric value to specify the amount of free disk space, in MB, that the Application Virtualization Client must leave available on the disk. This allows the cache to grow until the amount of free disk space reaches this limit. The value shown in **Free disk space remaining** indicates how much disk space is currently unused. + 2. **Use free disk space threshold**. Enter a numeric value to specify the amount of free disk space, in MB, that the Application Virtualization Client must leave available on the disk. This allows the cache to grow until the amount of free disk space reaches this limit. The value shown in **Free disk space remaining** indicates how much disk space is currently unused. - **Important** - To ensure that the cache has sufficient space allocated for all packages that might be deployed, use the **Use free disk space threshold** setting when you configure the client so that the cache can grow as needed. Alternatively, determine in advance how much disk space will be needed for the App-V cache, and at installation time, set the cache size accordingly. For more information about the cache space management feature, in the Microsoft Application Virtualization (App-V) Operations Guide, see **How to Use the Cache Space Management Feature**. + **Important** + To ensure that the cache has sufficient space allocated for all packages that might be deployed, use the **Use free disk space threshold** setting when you configure the client so that the cache can grow as needed. Alternatively, determine in advance how much disk space will be needed for the App-V cache, and at installation time, set the cache size accordingly. For more information about the cache space management feature, in the Microsoft Application Virtualization (App-V) Operations Guide, see **How to Use the Cache Space Management Feature**. - - -~~~ -Click **Next** to continue. -~~~ + Click **Next** to continue. 14. In the following sections of the **Runtime Package Policy Configuration** screen, you can change the parameters that affect how the Application Virtualization client behaves during runtime: - 1. **Application Source Root**. Specifies the location of SFT files. If used, overrides the protocol, server, and port portions of the CODEBASE HREF URL in the OSD file. + 1. **Application Source Root**. Specifies the location of SFT files. If used, overrides the protocol, server, and port portions of the CODEBASE HREF URL in the OSD file. - 2. **Application Authorization**. When **Require User authorization even when cached** is checked, users are required to connect to a server and validate their credentials at least once before they are allowed to start each virtual application. + 2. **Application Authorization**. When **Require User authorization even when cached** is checked, users are required to connect to a server and validate their credentials at least once before they are allowed to start each virtual application. - 3. **Allow streaming from file**. Indicates whether streaming from file will be enabled, regardless of how the **Application Source Root** field is used. If not checked, streaming from files is disabled. This must be checked if **Application Source Root** contains a UNC path in the form \\\\server\\share. + 3. **Allow streaming from file**. Indicates whether streaming from file will be enabled, regardless of how the **Application Source Root** field is used. If not checked, streaming from files is disabled. This must be checked if **Application Source Root** contains a UNC path in the form \\\\server\\share. - 4. **Automatically Load Application**. Controls when and how automatic background loading of applications occurs. + 4. **Automatically Load Application**. Controls when and how automatic background loading of applications occurs. **Note** When you install the App-V client to use with a read-only cache, for example, with a VDI server implementation, set **What applications to Auto Load** to **Do not automatically load applications** to prevent the client from trying to update applications in the read-only cache. - - -~~~ -Click **Next** to continue. -~~~ + Click **Next** to continue. 15. On the **Publishing Server** screen, select the **Set up a Publishing Server now** check box if you want to define a publishing server, or click **Next** if you want to complete this later. To define a publishing server, specify the following information: - 1. **Display Name**—Enter the name you want to display for the server. + 1. **Display Name**—Enter the name you want to display for the server. - 2. **Type**—Select the server type from the drop-down list of server types. + 2. **Type**—Select the server type from the drop-down list of server types. - 3. **Host Name** and **Port**—Enter the host name and the port in the corresponding fields. When you select a server type in the drop-down list, the port field will automatically fill with the standard port numbers. To change a port number, click the server type in the list and change the port number according to your needs. + 3. **Host Name** and **Port**—Enter the host name and the port in the corresponding fields. When you select a server type in the drop-down list, the port field will automatically fill with the standard port numbers. To change a port number, click the server type in the list and change the port number according to your needs. - 4. **Path**—If you have selected either **Standard HTTP Server** or **Enhanced Security HTTP Server**, you must enter the complete path to the XML file containing publishing data in this field. If you select either **Application Virtualization Server** or **Enhanced Security Application Virtualization Server**, this field is not active. + 4. **Path**—If you have selected either **Standard HTTP Server** or **Enhanced Security HTTP Server**, you must enter the complete path to the XML file containing publishing data in this field. If you select either **Application Virtualization Server** or **Enhanced Security Application Virtualization Server**, this field is not active. - 5. **Automatically contact this server to update settings when a user logs in**—Select this check box if you want this server to be queried automatically when users log in to their account on the Application Virtualization Client. + 5. **Automatically contact this server to update settings when a user logs in**—Select this check box if you want this server to be queried automatically when users log in to their account on the Application Virtualization Client. - 6. When finished with the configuration steps, click **Next**. + 6. When finished with the configuration steps, click **Next**. 16. On the **Ready to Install the Program** screen, click **Install**. A screen is displayed that shows the progress of the installation. 17. On the **Install Wizard Completed** screen, click **Finish**. - **Note** - If the installation fails for any reason, you might need to restart the computer before trying the install again. - - + **Note** + If the installation fails for any reason, you might need to restart the computer before trying the install again. ## Related topics - [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md) [Stand-Alone Delivery Scenario Overview](stand-alone-delivery-scenario-overview.md) - - - - - - - - - diff --git a/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md b/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md index e681bb817e..4302487ce2 100644 --- a/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md +++ b/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md b/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md index f2489eb2f5..f4e1e2a14e 100644 --- a/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md +++ b/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md b/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md index be75e8d6aa..0809dc55d0 100644 --- a/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md +++ b/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md @@ -1,7 +1,7 @@ --- title: How to Modify a Virtual Application Package (App-V 4.6) description: How to Modify a Virtual Application Package (App-V 4.6) -author: eavena +author: dansimp ms.assetid: 346ec470-3822-48a7-95e7-61f46eb38dc2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md b/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md index af10891ff9..9ef7b06355 100644 --- a/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md +++ b/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md b/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md index 0ac39a2bb7..98cb2e695d 100644 --- a/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md +++ b/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-modify-file-mapping-information.md b/mdop/appv-v4/how-to-modify-file-mapping-information.md index 650d2c5a16..edbae8f8d9 100644 --- a/mdop/appv-v4/how-to-modify-file-mapping-information.md +++ b/mdop/appv-v4/how-to-modify-file-mapping-information.md @@ -1,7 +1,7 @@ --- title: How to Modify File-Mapping Information description: How to Modify File-Mapping Information -author: eavena +author: dansimp ms.assetid: d3a9d10a-6cc8-4399-9479-b20f729c4dd9 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md b/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md index c5b952309a..abaea1f0a2 100644 --- a/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md +++ b/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md @@ -1,7 +1,7 @@ --- title: How to Modify Private Key Permissions to Support Management Server or Streaming Server description: How to Modify Private Key Permissions to Support Management Server or Streaming Server -author: eavena +author: dansimp ms.assetid: 1ebe86fa-0fbc-4512-aebc-0a5da991cd43 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md b/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md index 8b1a2d787a..210316d6fe 100644 --- a/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md +++ b/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md @@ -1,7 +1,7 @@ --- title: How to Modify the Files Included in a Package description: How to Modify the Files Included in a Package -author: eavena +author: dansimp ms.assetid: e331ac85-1c9c-49be-9d96-5444de38fd56 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md b/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md index 9992f353aa..0e8236a077 100644 --- a/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md +++ b/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md @@ -1,7 +1,7 @@ --- title: How to Modify the Location of the Log Directory description: How to Modify the Location of the Log Directory -author: eavena +author: dansimp ms.assetid: 8e222d29-6f58-43bb-9ea7-da9a2ebfa48c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md b/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md index b4a00900c6..3b1dea1dc4 100644 --- a/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md +++ b/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md @@ -1,7 +1,7 @@ --- title: How to Modify the Location of the Scratch Directory description: How to Modify the Location of the Scratch Directory -author: eavena +author: dansimp ms.assetid: 25ebc2fa-d532-4800-9825-9d08306fc2e0 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-modify-the-log-directory-location.md b/mdop/appv-v4/how-to-modify-the-log-directory-location.md index 9b4accadbf..19fda7f044 100644 --- a/mdop/appv-v4/how-to-modify-the-log-directory-location.md +++ b/mdop/appv-v4/how-to-modify-the-log-directory-location.md @@ -1,7 +1,7 @@ --- title: How to Modify the Log Directory Location description: How to Modify the Log Directory Location -author: eavena +author: dansimp ms.assetid: 203c674f-8d46-4d42-9af0-245a2681fc0f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md b/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md index f3aa20ff3b..2fe4f2b3c2 100644 --- a/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md +++ b/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md @@ -1,7 +1,7 @@ --- title: How to Modify the Operating Systems Associated With an Existing Windows Installer File description: How to Modify the Operating Systems Associated With an Existing Windows Installer File -author: eavena +author: dansimp ms.assetid: 0633f7e2-aebf-4e00-be02-35bc59dec420 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md b/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md index 582f590f01..fdcc89e4df 100644 --- a/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md +++ b/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md @@ -1,7 +1,7 @@ --- title: How to Modify the Scratch Directory Location description: How to Modify the Scratch Directory Location -author: eavena +author: dansimp ms.assetid: 61ecb379-85be-4316-8023-a2c1811504e5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md b/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md index a858d13e4d..c7f20c2042 100644 --- a/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md +++ b/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md @@ -1,7 +1,7 @@ --- title: How to Modify Virtual Registry Key Information description: How to Modify Virtual Registry Key Information -author: eavena +author: dansimp ms.assetid: cf2559f2-a8cc-4fc7-916e-8368843c7ebc ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-move-an-application-group.md b/mdop/appv-v4/how-to-move-an-application-group.md index 13f84cae13..1995381961 100644 --- a/mdop/appv-v4/how-to-move-an-application-group.md +++ b/mdop/appv-v4/how-to-move-an-application-group.md @@ -1,7 +1,7 @@ --- title: How to Move an Application Group description: How to Move an Application Group -author: eavena +author: dansimp ms.assetid: 7f9f9f2e-f394-4ad3-8615-4237a7dcfb95 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-move-an-application.md b/mdop/appv-v4/how-to-move-an-application.md index 891de6a2a0..d99811eea8 100644 --- a/mdop/appv-v4/how-to-move-an-application.md +++ b/mdop/appv-v4/how-to-move-an-application.md @@ -1,7 +1,7 @@ --- title: How to Move an Application description: How to Move an Application -author: eavena +author: dansimp ms.assetid: 3ebbf30c-b435-4a69-a0ba-2313aaf0017c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md b/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md index 9a25b5de7e..c060c24575 100644 --- a/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md +++ b/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md @@ -1,7 +1,7 @@ --- title: How to Open a Sequenced Application Using the Command Line description: How to Open a Sequenced Application Using the Command Line -author: eavena +author: dansimp ms.assetid: dc23ee65-8aea-470e-bb3f-a2f2b06cb241 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md b/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md index b155413d62..9391a45aeb 100644 --- a/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md +++ b/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md @@ -1,7 +1,7 @@ --- title: How to Perform Administrative Tasks in the Application Virtualization Server Management Console description: How to Perform Administrative Tasks in the Application Virtualization Server Management Console -author: eavena +author: dansimp ms.assetid: b80e39eb-4b2a-4f66-8c85-dd5712efed33 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md b/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md index 884e42b049..3870ab64ff 100644 --- a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md +++ b/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md @@ -1,7 +1,7 @@ --- title: How to Perform General Administrative Tasks in the App-V Client Management Console description: How to Perform General Administrative Tasks in the App-V Client Management Console -author: eavena +author: dansimp ms.assetid: 22abdb1e-ab35-440d-bf74-d358dd1a6558 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md b/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md index 72d7607e31..5d4925fc05 100644 --- a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md +++ b/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md @@ -1,7 +1,7 @@ --- title: How to Perform General Administrative Tasks in the Client Management Console description: How to Perform General Administrative Tasks in the Client Management Console -author: eavena +author: dansimp ms.assetid: 90bb7101-1075-4654-8a5e-ad08374e381f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-print-a-reportserver.md b/mdop/appv-v4/how-to-print-a-reportserver.md index c691eb95df..df30ae8d2e 100644 --- a/mdop/appv-v4/how-to-print-a-reportserver.md +++ b/mdop/appv-v4/how-to-print-a-reportserver.md @@ -1,7 +1,7 @@ --- title: How to Print a Report description: How to Print a Report -author: eavena +author: dansimp ms.assetid: 9cb3a2f1-69bf-47b2-b2cf-8afdcd77138f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md b/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md index d91ae838c7..be85378bb4 100644 --- a/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md +++ b/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md @@ -1,7 +1,7 @@ --- title: How to Publish a Virtual Application on the Client description: How to Publish a Virtual Application on the Client -author: eavena +author: dansimp ms.assetid: 90af843e-b5b3-4a71-a3a1-fa5f4c087f28 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-publish-application-shortcuts.md b/mdop/appv-v4/how-to-publish-application-shortcuts.md index 8098674b69..9ba0f5d68e 100644 --- a/mdop/appv-v4/how-to-publish-application-shortcuts.md +++ b/mdop/appv-v4/how-to-publish-application-shortcuts.md @@ -1,7 +1,7 @@ --- title: How to Publish Application Shortcuts description: How to Publish Application Shortcuts -author: eavena +author: dansimp ms.assetid: fc5efe86-1bbe-438b-b7d8-4f9b815cc58e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-refresh-the-publishing-servers.md b/mdop/appv-v4/how-to-refresh-the-publishing-servers.md index 54494a77f0..9f7be22717 100644 --- a/mdop/appv-v4/how-to-refresh-the-publishing-servers.md +++ b/mdop/appv-v4/how-to-refresh-the-publishing-servers.md @@ -1,7 +1,7 @@ --- title: How to Refresh the Publishing Servers description: How to Refresh the Publishing Servers -author: eavena +author: dansimp ms.assetid: 92e1d7b0-10ee-4531-9049-1056b44934e2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md b/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md index 29ab05d2dd..ef2d00371a 100644 --- a/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md +++ b/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md @@ -1,7 +1,7 @@ --- title: How to Refresh Virtual Applications from the Desktop Notification Area description: How to Refresh Virtual Applications from the Desktop Notification Area -author: eavena +author: dansimp ms.assetid: 801610d9-e89c-48bb-972c-20e37b945a02 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md b/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md index 4673705119..88540f333d 100644 --- a/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md +++ b/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md @@ -1,7 +1,7 @@ --- title: How to Remove a Package by Using the Command Line description: How to Remove a Package by Using the Command Line -author: eavena +author: dansimp ms.assetid: 47697ec7-20e5-4258-8865-a0a710d41d5a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-remove-a-server-group.md b/mdop/appv-v4/how-to-remove-a-server-group.md index 20cab42326..008a1a8d1e 100644 --- a/mdop/appv-v4/how-to-remove-a-server-group.md +++ b/mdop/appv-v4/how-to-remove-a-server-group.md @@ -1,7 +1,7 @@ --- title: How to Remove a Server Group description: How to Remove a Server Group -author: eavena +author: dansimp ms.assetid: 3017f4f4-614b-4db4-834c-b6fd9b45f10c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-remove-a-server.md b/mdop/appv-v4/how-to-remove-a-server.md index bda6da9484..b9d9c56690 100644 --- a/mdop/appv-v4/how-to-remove-a-server.md +++ b/mdop/appv-v4/how-to-remove-a-server.md @@ -1,7 +1,7 @@ --- title: How to Remove a Server description: How to Remove a Server -author: eavena +author: dansimp ms.assetid: afb2a889-733c-4058-9a50-caa2ca10bd58 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md b/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md index 28cf02fc30..ef40089f5e 100644 --- a/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md +++ b/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md @@ -1,7 +1,7 @@ --- title: How to Remove an Application from a License Group description: How to Remove an Application from a License Group -author: eavena +author: dansimp ms.assetid: 973dfb11-b4d1-4b79-8f6a-aaea3e52b04f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-remove-an-application-group.md b/mdop/appv-v4/how-to-remove-an-application-group.md index 9971b36c80..f6b2edb65f 100644 --- a/mdop/appv-v4/how-to-remove-an-application-group.md +++ b/mdop/appv-v4/how-to-remove-an-application-group.md @@ -1,7 +1,7 @@ --- title: How to Remove an Application Group description: How to Remove an Application Group -author: eavena +author: dansimp ms.assetid: 3016b373-f5a0-4c82-96e8-e5e7960f0cc4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-remove-an-application-license-group.md b/mdop/appv-v4/how-to-remove-an-application-license-group.md index 108f41917f..964ff0c24f 100644 --- a/mdop/appv-v4/how-to-remove-an-application-license-group.md +++ b/mdop/appv-v4/how-to-remove-an-application-license-group.md @@ -1,7 +1,7 @@ --- title: How to Remove an Application License Group description: How to Remove an Application License Group -author: eavena +author: dansimp ms.assetid: 35830916-7015-44cd-829b-23599a5029a7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md b/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md index 2d2274110c..5cc9a8ed29 100644 --- a/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md +++ b/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md @@ -1,7 +1,7 @@ --- title: How to Remove the Application Virtualization System Components description: How to Remove the Application Virtualization System Components -author: eavena +author: dansimp ms.assetid: 45bb1e43-8708-48b7-9169-e3659f32686f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-rename-an-application-group.md b/mdop/appv-v4/how-to-rename-an-application-group.md index 55b03cd556..6070df5aec 100644 --- a/mdop/appv-v4/how-to-rename-an-application-group.md +++ b/mdop/appv-v4/how-to-rename-an-application-group.md @@ -1,7 +1,7 @@ --- title: How to Rename an Application Group description: How to Rename an Application Group -author: eavena +author: dansimp ms.assetid: 4dfd3336-ea9a-4a56-91e1-7e9d742c7b9a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-rename-an-application.md b/mdop/appv-v4/how-to-rename-an-application.md index d16fc9a6e9..ca8414d735 100644 --- a/mdop/appv-v4/how-to-rename-an-application.md +++ b/mdop/appv-v4/how-to-rename-an-application.md @@ -1,7 +1,7 @@ --- title: How to Rename an Application description: How to Rename an Application -author: eavena +author: dansimp ms.assetid: 983136b7-66bf-49f6-8dea-8933b622072d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-repair-an-application.md b/mdop/appv-v4/how-to-repair-an-application.md index 21b8d3a5ef..1ec69efc56 100644 --- a/mdop/appv-v4/how-to-repair-an-application.md +++ b/mdop/appv-v4/how-to-repair-an-application.md @@ -1,7 +1,7 @@ --- title: How to Repair an Application description: How to Repair an Application -author: eavena +author: dansimp ms.assetid: 80b08416-ad86-4ed6-966a-b943e3efb951 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-reset-the-filesystem-cache.md b/mdop/appv-v4/how-to-reset-the-filesystem-cache.md index 8f50c720f3..7b8656bf7b 100644 --- a/mdop/appv-v4/how-to-reset-the-filesystem-cache.md +++ b/mdop/appv-v4/how-to-reset-the-filesystem-cache.md @@ -1,7 +1,7 @@ --- title: How to Reset the FileSystem Cache description: How to Reset the FileSystem Cache -author: eavena +author: dansimp ms.assetid: 7777259d-8c21-4c06-9384-9599b69f9828 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-run-a-reportserver.md b/mdop/appv-v4/how-to-run-a-reportserver.md index feb8ffd3aa..9776829bd2 100644 --- a/mdop/appv-v4/how-to-run-a-reportserver.md +++ b/mdop/appv-v4/how-to-run-a-reportserver.md @@ -1,7 +1,7 @@ --- title: How to Run a Report description: How to Run a Report -author: eavena +author: dansimp ms.assetid: 72a5419b-aa65-4e60-b23e-3751186b7aed ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md b/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md index 69b8fe0655..03f65fe5e6 100644 --- a/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md +++ b/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md @@ -1,7 +1,7 @@ --- title: How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1) description: How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1) -author: eavena +author: dansimp ms.assetid: 2c018215-66e5-4301-8481-159891a6b35b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- @@ -79,13 +79,13 @@ Click **Next**. 10. On the **Customize** page, if you are finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. If you want to customize any of the items in the following list, select **Customize**. - - Edit the file type associations associated with an application. + - Edit the file type associations associated with an application. - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. + - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - Specify the operating systems that can run this package. + - Specify the operating systems that can run this package. - Click **Next**. + Click **Next**. 11. On the **Edit Shortcuts** page, you can optionally configure the file type associations (FTA) that will be associated with the various applications in the package. To create a new FTA, in the left pane, select and expand the application that you want to customize, and then click **Add**. In the **Add File Type Association** dialog box, provide the necessary information for the new FTA. Under the application, select **Shortcuts** to review the shortcut information associated with an application. In the **Location** pane, you can review the icon file information. To edit an existing FTA, click **Edit**. To remove an FTA, select the FTA, and then click **Remove**. Click **Next**. diff --git a/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md b/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md index 8cf0f80add..887c4f830f 100644 --- a/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md +++ b/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md @@ -1,7 +1,7 @@ --- title: How to Sequence a New Application (App-V 4.6) description: How to Sequence a New Application (App-V 4.6) -author: eavena +author: dansimp ms.assetid: f2c398c6-9200-4be3-b502-e00386fcd150 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md b/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md index 8df7b3d92a..f49dd1afd4 100644 --- a/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md +++ b/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md @@ -1,7 +1,7 @@ --- title: How to Sequence a New Application by Using the Command Line description: How to Sequence a New Application by Using the Command Line -author: eavena +author: dansimp ms.assetid: c3b5c842-6a91-4d0a-9a22-c7b8d1aeb09a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md b/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md index 65432aa68a..1d630165c9 100644 --- a/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md +++ b/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md @@ -1,7 +1,7 @@ --- title: How to Sequence a New Application Package Using the Command Line description: How to Sequence a New Application Package Using the Command Line -author: eavena +author: dansimp ms.assetid: de72912b-d9e7-45b5-a601-12528f1a4cac ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-sequence-a-new-application.md b/mdop/appv-v4/how-to-sequence-a-new-application.md index 21debde0ba..c8207ab688 100644 --- a/mdop/appv-v4/how-to-sequence-a-new-application.md +++ b/mdop/appv-v4/how-to-sequence-a-new-application.md @@ -1,7 +1,7 @@ --- title: How to Sequence a New Application description: How to Sequence a New Application -author: eavena +author: dansimp ms.assetid: e01e98cd-2378-478f-9739-f72c465bf79a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md b/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md index 4f5f815988..bfdc11f2aa 100644 --- a/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md +++ b/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md @@ -1,7 +1,7 @@ --- title: How to Sequence a New Middleware Application (App-V 4.6 SP1) description: How to Sequence a New Middleware Application (App-V 4.6 SP1) -author: eavena +author: dansimp ms.assetid: 304045c2-5e5e-4c91-b59e-a91fdf2500fb ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md b/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md index 0811b151cb..626781d04d 100644 --- a/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md +++ b/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md @@ -1,7 +1,7 @@ --- title: How to Sequence a New Standard Application (App-V 4.6 SP1) description: How to Sequence a New Standard Application (App-V 4.6 SP1) -author: eavena +author: dansimp ms.assetid: c4a2eb33-def8-4535-b93a-3d2de21ce29f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- @@ -69,13 +69,13 @@ Click **Next**. 11. On the **Customize** page, if you are finished installing and configuring the virtual application, select **Stop now** and skip to step 15 of this procedure. If you want to customize any of the items in the following list, select **Customize**. - - Edit the file type associations and the icons associated with an application. + - Edit the file type associations and the icons associated with an application. - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. + - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - Specify the operating systems that can run this package. + - Specify the operating systems that can run this package. - Click **Next**. + Click **Next**. 12. On the **Edit Shortcuts** page, you can optionally configure the file type associations (FTA) and shortcut locations that will be associated with the various applications in the package. To create a new FTA, in the left pane, select and expand the application you want to customize, and then click **Add**. In the **Add File Type Association** dialog box, provide the necessary information for the new FTA. To review the shortcut information associated with an application, under the application, select **Shortcuts**, and in the **Location** pane, you can edit the icon file information. To edit an existing FTA, click **Edit**. To remove an FTA, select the FTA, and then click **Remove**. Click **Next**. diff --git a/mdop/appv-v4/how-to-sequence-an-application.md b/mdop/appv-v4/how-to-sequence-an-application.md index 6e4b78a2d3..0c29bb034a 100644 --- a/mdop/appv-v4/how-to-sequence-an-application.md +++ b/mdop/appv-v4/how-to-sequence-an-application.md @@ -1,7 +1,7 @@ --- title: How to Sequence an Application description: How to Sequence an Application -author: eavena +author: dansimp ms.assetid: bd643dd6-dbf6-4469-bc70-c43ad9c69da9 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md b/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md index e70a585f56..d04fd52b99 100644 --- a/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md +++ b/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md @@ -1,7 +1,7 @@ --- title: How to Set Up a Concurrent License Group description: How to Set Up a Concurrent License Group -author: eavena +author: dansimp ms.assetid: 031abcf6-d8ed-49be-bddb-91b2c695d411 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-set-up-a-named-license-group.md b/mdop/appv-v4/how-to-set-up-a-named-license-group.md index 3384f53bc7..cc23565fe6 100644 --- a/mdop/appv-v4/how-to-set-up-a-named-license-group.md +++ b/mdop/appv-v4/how-to-set-up-a-named-license-group.md @@ -1,7 +1,7 @@ --- title: How to Set Up a Named License Group description: How to Set Up a Named License Group -author: eavena +author: dansimp ms.assetid: 8ef6716c-0cb7-4706-ad3b-ac6f27b2e7ad ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md b/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md index ad12a9daea..5134961bd1 100644 --- a/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md +++ b/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md @@ -1,7 +1,7 @@ --- title: How to Set Up an Unlimited License Group description: How to Set Up an Unlimited License Group -author: eavena +author: dansimp ms.assetid: 0c37c7b7-aba9-4c03-9e0e-94c966f874cf ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md b/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md index 330c8fd3c2..153b562d87 100644 --- a/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md +++ b/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md @@ -1,7 +1,7 @@ --- title: How to Set Up and Enable or Disable Authentication description: How to Set Up and Enable or Disable Authentication -author: eavena +author: dansimp ms.assetid: 1e43d0c5-a467-4a8b-b656-93f75d7deb82 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md b/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md index 24f021a1d7..887f07a118 100644 --- a/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md +++ b/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md @@ -1,7 +1,7 @@ --- title: How to Set Up or Disable Application Licensing description: How to Set Up or Disable Application Licensing -author: eavena +author: dansimp ms.assetid: 7c00b531-ec41-4970-b0fc-d84225ce3bb2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-set-up-or-disable-database-size.md b/mdop/appv-v4/how-to-set-up-or-disable-database-size.md index 80082bec49..7c3406d783 100644 --- a/mdop/appv-v4/how-to-set-up-or-disable-database-size.md +++ b/mdop/appv-v4/how-to-set-up-or-disable-database-size.md @@ -1,7 +1,7 @@ --- title: How to Set Up or Disable Database Size description: How to Set Up or Disable Database Size -author: eavena +author: dansimp ms.assetid: 4abaf349-132d-4186-8873-a0e515593b93 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md b/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md index cc5904c915..3f6ef2f351 100644 --- a/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md +++ b/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md @@ -1,7 +1,7 @@ --- title: How to Set Up or Disable Usage Reporting description: How to Set Up or Disable Usage Reporting -author: eavena +author: dansimp ms.assetid: 8587003a-128d-4b5d-ac70-5b9eddddd3dc ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md b/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md index 7c062516ea..ca202df73c 100644 --- a/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md +++ b/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md @@ -1,7 +1,7 @@ --- title: How to Set Up Periodic Publishing Refresh description: How to Set Up Periodic Publishing Refresh -author: eavena +author: dansimp ms.assetid: c358c765-cb88-4881-b4e7-0a2e87304870 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md b/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md index 00463ee498..cea01e5b73 100644 --- a/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md +++ b/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md @@ -1,7 +1,7 @@ --- title: How to Set Up Publishing Refresh on Login description: How to Set Up Publishing Refresh on Login -author: eavena +author: dansimp ms.assetid: 196448db-7645-4fd5-a854-ef6405b15db4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-set-up-publishing-servers.md b/mdop/appv-v4/how-to-set-up-publishing-servers.md index cc298754ab..4765f6ab56 100644 --- a/mdop/appv-v4/how-to-set-up-publishing-servers.md +++ b/mdop/appv-v4/how-to-set-up-publishing-servers.md @@ -1,7 +1,7 @@ --- title: How to Set Up Publishing Servers description: How to Set Up Publishing Servers -author: eavena +author: dansimp ms.assetid: 2111f079-c202-4c49-b2a6-f4237068b2dc ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-uninstall-the-app-v-client.md b/mdop/appv-v4/how-to-uninstall-the-app-v-client.md index 32cefce588..aa1bd12d54 100644 --- a/mdop/appv-v4/how-to-uninstall-the-app-v-client.md +++ b/mdop/appv-v4/how-to-uninstall-the-app-v-client.md @@ -1,7 +1,7 @@ --- title: How to Uninstall the App-V Client description: How to Uninstall the App-V Client -author: eavena +author: dansimp ms.assetid: 07591270-9651-4bb5-a5b3-e0fc009bd9e2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md b/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md index 6084e10e78..4bea07a0e4 100644 --- a/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md +++ b/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md @@ -1,7 +1,7 @@ --- title: How to Upgrade a Package Using the Open Package Command description: How to Upgrade a Package Using the Open Package Command -author: eavena +author: dansimp ms.assetid: 67c10440-de8a-4547-a34b-f83206d0cc3b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-upgrade-a-package.md b/mdop/appv-v4/how-to-upgrade-a-package.md index 503f8d897c..f30f2b3781 100644 --- a/mdop/appv-v4/how-to-upgrade-a-package.md +++ b/mdop/appv-v4/how-to-upgrade-a-package.md @@ -1,7 +1,7 @@ --- title: How to Upgrade a Package description: How to Upgrade a Package -author: eavena +author: dansimp ms.assetid: 831c7556-6f6c-4b3a-aefb-26889094dc1a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md b/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md index 3ed3a2cdfc..09b9ef807e 100644 --- a/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md +++ b/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md @@ -1,7 +1,7 @@ --- title: How to Upgrade a Sequenced Application Package Using the Command Line description: How to Upgrade a Sequenced Application Package Using the Command Line -author: eavena +author: dansimp ms.assetid: 682fac46-c71d-4731-831b-81bfd5032764 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md b/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md index 74d9705ad4..0c229968ed 100644 --- a/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md +++ b/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md @@ -1,7 +1,7 @@ --- title: How to Upgrade a Sequenced Virtual Application Package description: How to Upgrade a Sequenced Virtual Application Package -author: eavena +author: dansimp ms.assetid: ffa989f3-6621-4c59-9599-e3c3b3332f67 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md b/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md index 30f369aa2b..4f1adedf14 100644 --- a/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md +++ b/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md @@ -1,7 +1,7 @@ --- title: How to Upgrade a Virtual Application by Using the Command Line description: How to Upgrade a Virtual Application by Using the Command Line -author: eavena +author: dansimp ms.assetid: 83c97767-6ea1-42aa-b411-ccc9fa61cf81 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md b/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md index a1184994e7..7f4721a9e4 100644 --- a/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md +++ b/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md @@ -1,7 +1,7 @@ --- title: How to Upgrade a Virtual Application Package (App-V 4.6) description: How to Upgrade a Virtual Application Package (App-V 4.6) -author: eavena +author: dansimp ms.assetid: 3566227e-f3dc-4c32-af1f-e0211588118c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md b/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md index acf753d0fd..787c679d5e 100644 --- a/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md +++ b/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md @@ -1,7 +1,7 @@ --- title: How to Upgrade an Existing Virtual Application description: How to Upgrade an Existing Virtual Application -author: eavena +author: dansimp ms.assetid: ec531576-2423-4c2c-9b9f-da74174a6858 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md b/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md index f2acf0f9d6..15ecbedb36 100644 --- a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md +++ b/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md @@ -1,7 +1,7 @@ --- title: How to Upgrade the Application Virtualization Client description: How to Upgrade the Application Virtualization Client -author: eavena +author: dansimp ms.assetid: 2a75d8b5-da88-456c-85bb-f5bd3d470f7f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md b/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md index d120506886..5a9dfc32f5 100644 --- a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md +++ b/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md @@ -1,7 +1,7 @@ --- title: How to Upgrade the Application Virtualization Sequencer description: How to Upgrade the Application Virtualization Sequencer -author: eavena +author: dansimp ms.assetid: 7f85f140-5034-4227-85ef-81f205e722ef ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md b/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md index 3724881e5b..c8e13c8bf9 100644 --- a/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md +++ b/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md @@ -1,7 +1,7 @@ --- title: How to Upgrade the Servers and System Components description: How to Upgrade the Servers and System Components -author: eavena +author: dansimp ms.assetid: 7d8374fe-5897-452e-923e-556a854b2024 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-use-dynamic-suite-composition.md b/mdop/appv-v4/how-to-use-dynamic-suite-composition.md index a92d326172..61f69a8ddb 100644 --- a/mdop/appv-v4/how-to-use-dynamic-suite-composition.md +++ b/mdop/appv-v4/how-to-use-dynamic-suite-composition.md @@ -1,7 +1,7 @@ --- title: How To Use Dynamic Suite Composition description: How To Use Dynamic Suite Composition -author: eavena +author: dansimp ms.assetid: 24147feb-a0a8-4791-a8e5-cbe5fe13c762 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md b/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md index 5c1a2d616f..76e04ddf2f 100644 --- a/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md +++ b/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md @@ -1,7 +1,7 @@ --- title: How to Use the Cache Space Management Feature description: How to Use the Cache Space Management Feature -author: eavena +author: dansimp ms.assetid: 60965660-c015-46a8-88ac-54cbc050fe33 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md b/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md index 47ad3bd18b..6f36531585 100644 --- a/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md +++ b/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md @@ -1,7 +1,7 @@ --- title: How to Use the Desktop Notification Area for Application Virtualization Client Management description: How to Use the Desktop Notification Area for Application Virtualization Client Management -author: eavena +author: dansimp ms.assetid: 75b2e636-7669-4e1e-8368-8b9fca567a84 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/how-to-use-the-differential-sft-file.md b/mdop/appv-v4/how-to-use-the-differential-sft-file.md index ee2cad8104..bb241b99c4 100644 --- a/mdop/appv-v4/how-to-use-the-differential-sft-file.md +++ b/mdop/appv-v4/how-to-use-the-differential-sft-file.md @@ -1,7 +1,7 @@ --- title: How to Use the Differential SFT File description: How to Use the Differential SFT File -author: eavena +author: dansimp ms.assetid: 607e30fd-2f0e-4e2f-b669-0b3f010aebb0 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md b/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md index 2600e02b87..0c4b2711ea 100644 --- a/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md +++ b/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md @@ -1,7 +1,7 @@ --- title: How to Work Offline or Online with Application Virtualization description: How to Work Offline or Online with Application Virtualization -author: eavena +author: dansimp ms.assetid: aa532b37-8a00-4db4-9b51-e1e8354b2495 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/improving-security-during-app-v-sequencing.md b/mdop/appv-v4/improving-security-during-app-v-sequencing.md index 25d280c294..2b6ac85fe7 100644 --- a/mdop/appv-v4/improving-security-during-app-v-sequencing.md +++ b/mdop/appv-v4/improving-security-during-app-v-sequencing.md @@ -1,7 +1,7 @@ --- title: Improving Security During App-V Sequencing description: Improving Security During App-V Sequencing -author: eavena +author: dansimp ms.assetid: f30206dd-5749-4a27-bbaf-61fc21b9c663 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md index c02fae6064..a857bd41a4 100644 --- a/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md +++ b/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md @@ -1,7 +1,7 @@ --- title: Incompatible Installer Dialog Box (App-V 4.6 SP1) description: Incompatible Installer Dialog Box (App-V 4.6 SP1) -author: eavena +author: dansimp ms.assetid: 45d465b1-ee49-4274-8234-71dd031a07b6 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/index.md b/mdop/appv-v4/index.md index 8f75ce1701..02747f94e3 100644 --- a/mdop/appv-v4/index.md +++ b/mdop/appv-v4/index.md @@ -1,12 +1,12 @@ --- title: Application Virtualization 4 description: Application Virtualization 4 -author: jamiejdt +author: dansimp ms.assetid: 9da557bc-f433-47d3-8af7-68ec4ff9bd3f ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/installation-files-page.md b/mdop/appv-v4/installation-files-page.md index 01386f3df3..20de615b7d 100644 --- a/mdop/appv-v4/installation-files-page.md +++ b/mdop/appv-v4/installation-files-page.md @@ -1,7 +1,7 @@ --- title: Installation Files Page description: Installation Files Page -author: eavena +author: dansimp ms.assetid: b0aad26f-b143-4f09-87a1-9f016a23cb62 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/installation-page--learn-more-.md b/mdop/appv-v4/installation-page--learn-more-.md index 16497b85eb..e6c8d1d84b 100644 --- a/mdop/appv-v4/installation-page--learn-more-.md +++ b/mdop/appv-v4/installation-page--learn-more-.md @@ -1,7 +1,7 @@ --- title: Installation Page (Learn More) description: Installation Page (Learn More) -author: eavena +author: dansimp ms.assetid: a53b8330-dfc3-4540-b147-7c10529f403a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/installation-report-page--learn-more-.md b/mdop/appv-v4/installation-report-page--learn-more-.md index 343d0b17fd..c84aa0f77a 100644 --- a/mdop/appv-v4/installation-report-page--learn-more-.md +++ b/mdop/appv-v4/installation-report-page--learn-more-.md @@ -1,7 +1,7 @@ --- title: Installation Report Page (Learn More) description: Installation Report Page (Learn More) -author: eavena +author: dansimp ms.assetid: 499cf4db-a39c-4dcf-b1cf-85fd7da11701 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md b/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md index a57d3fd5ef..98b91fafd4 100644 --- a/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md +++ b/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md @@ -1,7 +1,7 @@ --- title: Installing App-V Management Server or Streaming Server Securely description: Installing App-V Management Server or Streaming Server Securely -author: eavena +author: dansimp ms.assetid: d2a51a81-a80f-427c-a727-611e1eb74f02 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md b/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md index d6386c9039..b9d55dbf3c 100644 --- a/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md +++ b/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md @@ -1,7 +1,7 @@ --- title: Internet-Facing Considerations for App-V Clients description: Internet-Facing Considerations for App-V Clients -author: eavena +author: dansimp ms.assetid: 261acde3-7112-492e-8b11-934ae45adc5f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md b/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md index 08a864e1ad..53ac72fe47 100644 --- a/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md +++ b/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md @@ -1,7 +1,7 @@ --- title: Internet-Facing Server Scenarios for Perimeter Networks description: Internet-Facing Server Scenarios for Perimeter Networks -author: eavena +author: dansimp ms.assetid: 8a4da6e6-82c7-49e5-b9b1-1666cba02f65 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md b/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md index fb9336a35c..3377faf914 100644 --- a/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md +++ b/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md @@ -1,7 +1,7 @@ --- title: Introduction to the Application Virtualization Security Guide description: Introduction to the Application Virtualization Security Guide -author: eavena +author: dansimp ms.assetid: 50e1d220-7a95-45b8-933b-3dadddebe26f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/load-app.md b/mdop/appv-v4/load-app.md index e76ab3bbfd..04554a2477 100644 --- a/mdop/appv-v4/load-app.md +++ b/mdop/appv-v4/load-app.md @@ -1,7 +1,7 @@ --- title: LOAD APP description: LOAD APP -author: eavena +author: dansimp ms.assetid: 7b727d0c-5423-419d-92ef-7ebbc6343e79 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/load-package.md b/mdop/appv-v4/load-package.md index a5b0ab5872..b466aa1e10 100644 --- a/mdop/appv-v4/load-package.md +++ b/mdop/appv-v4/load-package.md @@ -1,7 +1,7 @@ --- title: LOAD PACKAGE description: LOAD PACKAGE -author: eavena +author: dansimp ms.assetid: eb19116d-e5d0-445c-b2f0-3116a09384d7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/lock-app.md b/mdop/appv-v4/lock-app.md index e33f3dccae..ab1cbe6d65 100644 --- a/mdop/appv-v4/lock-app.md +++ b/mdop/appv-v4/lock-app.md @@ -1,7 +1,7 @@ --- title: LOCK APP description: LOCK APP -author: eavena +author: dansimp ms.assetid: 30673433-4364-499f-8116-cb135fe2716f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/log-file-for-the-application-virtualization-client.md b/mdop/appv-v4/log-file-for-the-application-virtualization-client.md index 0d0fbf2b4d..7e6cab69e0 100644 --- a/mdop/appv-v4/log-file-for-the-application-virtualization-client.md +++ b/mdop/appv-v4/log-file-for-the-application-virtualization-client.md @@ -1,7 +1,7 @@ --- title: Log File for the Application Virtualization Client description: Log File for the Application Virtualization Client -author: eavena +author: dansimp ms.assetid: ac4b3e4a-a220-4c06-bd60-af7dc318b3a9 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md b/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md index 62fe4015f9..3c484c5336 100644 --- a/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md +++ b/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md @@ -1,7 +1,7 @@ --- title: Log Files for the Application Virtualization Sequencer description: Log Files for the Application Virtualization Sequencer -author: eavena +author: dansimp ms.assetid: 1a296544-eab4-46f9-82ce-3136f8b578af ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md b/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md index 9842c91c7b..8b053caac1 100644 --- a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md +++ b/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md @@ -1,7 +1,7 @@ --- title: Microsoft Application Virtualization 4.6 Service Pack 1 Privacy Statement description: Microsoft Application Virtualization 4.6 Service Pack 1 Privacy Statement -author: eavena +author: dansimp ms.assetid: e82c57ea-885d-4761-96db-4d80b1c3e1ae ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md b/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md index f7ffd9de24..e22f6404e8 100644 --- a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md +++ b/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md @@ -1,7 +1,7 @@ --- title: Microsoft Application Virtualization 4.6 Service Pack 2 Privacy Statement description: Microsoft Application Virtualization 4.6 Service Pack 2 Privacy Statement -author: eavena +author: dansimp ms.assetid: 4ee569b2-7711-475a-9f17-70247f00b1b7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- @@ -76,7 +76,7 @@ This section is divided into two parts: (1) features in all versions of App-V an Microsoft Error Reporting provides a service that allows you to report problems you may be having with App-V to Microsoft and to receive information that may help you avoid or solve such problems. -**Information Collected, Processed, or Transmitted: ** +**Information Collected, Processed, or Transmitted:** For information about the information collected, processed, or transmitted by Microsoft Error Reporting, see the Microsoft Error Reporting privacy statement at . @@ -84,7 +84,7 @@ For information about the information collected, processed, or transmitted by Mi We use the error reporting data to solve customer problems and improve our software and services. -**Choice/Control: ** +**Choice/Control:** App-V does not change your Microsoft Error Reporting settings. If you previously turned on error reporting, it will send Microsoft the information about the errors you encountered. When Microsoft needs additional data to analyze the problem, you will be prompted to review the data and choose whether or not to send it.  App-V will always respect your Microsoft Error Reporting settings. @@ -98,7 +98,7 @@ Enterprise customers can use Group Policy to configure how Microsoft Error Repor Microsoft Update is a service that provides Windows updates as well as updates for other Microsoft software, including App-V.  For details about what information is collected, how it is used and how to change your settings, see the Update Services Privacy Statement at . -**Choice/Control: ** +**Choice/Control:** If Microsoft Update is not enabled, you can opt-in during setup and subsequent checks for updates will follow the machine-wide schedule. You can update this option from the Microsoft Update Control Panel item. @@ -108,7 +108,7 @@ If Microsoft Update is not enabled, you can opt-in during setup and subsequent c The product will collect various configuration items, including UserID, MachineID and SecurityGroup details, to be able to enforce settings on managed nodes. The data is stored in the App-V SQL database and transmitted across the App-V server and client components to enforce the configuration on the managed node. -**Information Collected, Processed, or Transmitted: ** +**Information Collected, Processed, or Transmitted:** User and machine information and configuration content @@ -116,7 +116,7 @@ User and machine information and configuration content The information is used to enforce the application access configuration on the managed nodes within the enterprise. The information does not leave the enterprise. -**Choice/Control: ** +**Choice/Control:** By default, the product does not have any data. All data is entered and enabled by the admin and can be viewed in the Management console. The feature cannot be disabled as this is the product functionality. To disable this, App-V will need to be uninstalled. @@ -130,7 +130,7 @@ None of this information is sent out of the enterprise. It captures package history and asset information as part of the package. -**Information Collected, Processed, or Transmitted: ** +**Information Collected, Processed, or Transmitted:** Information about the package and the sequencing environment is collected and stored in the package manifest during sequencing. @@ -138,7 +138,7 @@ Information about the package and the sequencing environment is collected and st The information will be used by the admin to track the updates done to a package during its lifecycle. It will also be used by software deployment systems to track the package deployments within the organization. -**Choice/Control: ** +**Choice/Control:** This feature is always enabled and cannot be turned off. @@ -152,7 +152,7 @@ This administrator information will be stored in the package and can be viewed b The product will collect a variety of reporting data points, including the username, to allow reporting on the usage of the product. -**Information Collected, Processed, or Transmitted: ** +**Information Collected, Processed, or Transmitted:** Information about the machine, package and application usage are collected from every machine that reporting is enabled on. @@ -160,7 +160,7 @@ Information about the machine, package and application usage are collected from The information is used to report on application usage within the enterprise. The information does not leave the enterprise. -**Choice/Control: ** +**Choice/Control:** By default, the product does not have any data. Data is only collected once the reporting feature is enabled on the App-V Client. To disable the collection of reporting data, the reporting feature must be disabled on all clients. @@ -178,7 +178,7 @@ This section addresses specific features available in App-V 4.6 SP1 and later. The Customer Experience Improvement Program (“CEIP”) collects basic information about your hardware configuration and how you use our software and services in order to identify trends and usage patterns. CEIP also collects the type and number of errors you encounter, software and hardware performance, and the speed of services. We will not collect your name, address, or other contact information. -**Information Collected, Processed, or Transmitted: ** +**Information Collected, Processed, or Transmitted:** For more information about the information collected, processed, or transmitted by CEIP, see the CEIP privacy statement at . @@ -186,7 +186,7 @@ For more information about the information collected, processed, or transmitted We use this information to improve the quality, reliability, and performance of Microsoft software and services. -**Choice/Control: ** +**Choice/Control:** CEIP is optional and the opt-in status can be updated during install or post install from the GUI.   @@ -196,7 +196,7 @@ CEIP is optional and the opt-in status can be updated during install or post ins Customers can use Application Package Accelerators to automatically package complex applications without installing the application. The App-V sequencer allows you to create package accelerators for each virtual package. You can then use these package accelerators to automatically re-create the same virtual package in the future. You may also use package accelerators released by Microsoft or other third parties to simplify and automate packaging of complex applications. -**Information Collected, Processed, or Transmitted: ** +**Information Collected, Processed, or Transmitted:** Application Package Accelerators may contain information such as computer names, user account information, and information about applications included in the Package Accelerator file. diff --git a/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md b/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md index 8b5c8b1759..7d3ac53771 100644 --- a/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md +++ b/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md @@ -1,7 +1,7 @@ --- title: Microsoft Application Virtualization Client Management Help description: Microsoft Application Virtualization Client Management Help -author: eavena +author: dansimp ms.assetid: 449eebda-70eb-48b7-855a-db965a680923 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md b/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md index d581ace524..e80f51864a 100644 --- a/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md +++ b/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md @@ -1,7 +1,7 @@ --- title: Microsoft Application Virtualization Getting Started Guide description: Microsoft Application Virtualization Getting Started Guide -author: eavena +author: dansimp ms.assetid: 6cd9a212-e270-4d7c-bd0a-bd6af9a5c3ba ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md b/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md index 1e8882dde6..6e2ac2c22c 100644 --- a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md +++ b/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md @@ -1,7 +1,7 @@ --- title: Microsoft Application Virtualization Management System Release Notes 4.5 SP1 description: Microsoft Application Virtualization Management System Release Notes 4.5 SP1 -author: eavena +author: dansimp ms.assetid: 5d6b11ea-7b87-4084-9a7c-0d831f247aa3 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md b/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md index 34494bd042..f44ba1b0d9 100644 --- a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md +++ b/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md @@ -1,7 +1,7 @@ --- title: Microsoft Application Virtualization Management System Release Notes description: Microsoft Application Virtualization Management System Release Notes -author: eavena +author: dansimp ms.assetid: e1a4d5ee-53c7-4b48-814c-a34ce0e698dc ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/microsoft-application-virtualization-security-guide.md b/mdop/appv-v4/microsoft-application-virtualization-security-guide.md index c57610a611..001edd2ecd 100644 --- a/mdop/appv-v4/microsoft-application-virtualization-security-guide.md +++ b/mdop/appv-v4/microsoft-application-virtualization-security-guide.md @@ -1,7 +1,7 @@ --- title: Microsoft Application Virtualization Security Guide description: Microsoft Application Virtualization Security Guide -author: eavena +author: dansimp ms.assetid: 5e794316-cc4f-459e-90ef-79fc9841ba4e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/monitoring-application-virtualization-servers.md b/mdop/appv-v4/monitoring-application-virtualization-servers.md index 9058c5bf3d..86d245cdb9 100644 --- a/mdop/appv-v4/monitoring-application-virtualization-servers.md +++ b/mdop/appv-v4/monitoring-application-virtualization-servers.md @@ -1,7 +1,7 @@ --- title: Monitoring Application Virtualization Servers description: Monitoring Application Virtualization Servers -author: eavena +author: dansimp ms.assetid: d84355ae-4fe4-41d9-ac3a-3eaa32d9a61f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/online-help-for-application-virtualization.md b/mdop/appv-v4/online-help-for-application-virtualization.md index 5607572347..78f73ff686 100644 --- a/mdop/appv-v4/online-help-for-application-virtualization.md +++ b/mdop/appv-v4/online-help-for-application-virtualization.md @@ -1,7 +1,7 @@ --- title: Online Help for Application Virtualization description: Online Help for Application Virtualization -author: eavena +author: dansimp ms.assetid: 261ede48-976f-473c-84bc-452577efdcdf ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md b/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md index cf155ad5c7..1905d978d9 100644 --- a/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md +++ b/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md @@ -1,7 +1,7 @@ --- title: Open Package Wizard (AppV 4.6 SP1) description: Open Package Wizard (AppV 4.6 SP1) -author: eavena +author: dansimp ms.assetid: 26bdef59-2ea3-4e30-9095-0ee0d0085b2d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md b/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md index 7537dd9052..9c61fc7e12 100644 --- a/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md +++ b/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md @@ -1,7 +1,7 @@ --- title: Operations Guide for the Application Virtualization System description: Operations Guide for the Application Virtualization System -author: eavena +author: dansimp ms.assetid: 686f2b75-7fba-4410-89b2-a539984b6ef2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/osd-file-elements.md b/mdop/appv-v4/osd-file-elements.md index 77e35c6c8f..1d0283818c 100644 --- a/mdop/appv-v4/osd-file-elements.md +++ b/mdop/appv-v4/osd-file-elements.md @@ -1,7 +1,7 @@ --- title: OSD File Elements description: OSD File Elements -author: eavena +author: dansimp ms.assetid: 8211b562-7549-4331-8321-144f52574e99 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/osd-tab-keep.md b/mdop/appv-v4/osd-tab-keep.md index 256b47eed2..ccdcfd3633 100644 --- a/mdop/appv-v4/osd-tab-keep.md +++ b/mdop/appv-v4/osd-tab-keep.md @@ -1,7 +1,7 @@ --- title: OSD Tab description: OSD Tab -author: eavena +author: dansimp ms.assetid: e66f1384-1753-4216-b9ee-77e99af93c74 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md index e088b5a477..b29db6ac31 100644 --- a/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md +++ b/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md @@ -1,7 +1,7 @@ --- title: Oversized Package Dialog Box (App-V 4.6 SP1) description: Oversized Package Dialog Box (App-V 4.6 SP1) -author: eavena +author: dansimp ms.assetid: 8973a493-6509-4d52-afb6-a9f47d1c5c26 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/overview-of-application-virtualization.md b/mdop/appv-v4/overview-of-application-virtualization.md index 60b9846d7a..022d6b07b1 100644 --- a/mdop/appv-v4/overview-of-application-virtualization.md +++ b/mdop/appv-v4/overview-of-application-virtualization.md @@ -1,7 +1,7 @@ --- title: Overview of Application Virtualization description: Overview of Application Virtualization -author: eavena +author: dansimp ms.assetid: 80545ef4-cf4c-420c-88d6-48e9f226051f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md b/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md index cdd61b6351..eb607d81e1 100644 --- a/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md +++ b/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md @@ -1,7 +1,7 @@ --- title: Overview of the Application Virtualization System Components description: Overview of the Application Virtualization System Components -author: eavena +author: dansimp ms.assetid: 75d88ef7-44d8-4fa7-b7f5-9153f37e570d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/package-name-page---learn-more-.md b/mdop/appv-v4/package-name-page---learn-more-.md index 2ec6a13682..3295f947df 100644 --- a/mdop/appv-v4/package-name-page---learn-more-.md +++ b/mdop/appv-v4/package-name-page---learn-more-.md @@ -1,7 +1,7 @@ --- title: Package Name Page (Learn More) description: Package Name Page (Learn More) -author: eavena +author: dansimp ms.assetid: ee75b8f0-bd9d-4460-a256-016ff97c2386 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/package-name-page--app-v-46-sp1.md b/mdop/appv-v4/package-name-page--app-v-46-sp1.md index d6a33e85ab..a8989e3452 100644 --- a/mdop/appv-v4/package-name-page--app-v-46-sp1.md +++ b/mdop/appv-v4/package-name-page--app-v-46-sp1.md @@ -1,7 +1,7 @@ --- title: Package Name Page description: Package Name Page -author: eavena +author: dansimp ms.assetid: 1cea36b7-737d-4c5e-9294-5feba02a3e7d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/package-results-pane-columns.md b/mdop/appv-v4/package-results-pane-columns.md index 2197976bc7..bc11c1fabe 100644 --- a/mdop/appv-v4/package-results-pane-columns.md +++ b/mdop/appv-v4/package-results-pane-columns.md @@ -1,7 +1,7 @@ --- title: Package Results Pane Columns description: Package Results Pane Columns -author: eavena +author: dansimp ms.assetid: 4ed3a06a-656d-497a-b62d-21684396e2b0 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/package-results-pane.md b/mdop/appv-v4/package-results-pane.md index d9670bd51d..8b8dab1add 100644 --- a/mdop/appv-v4/package-results-pane.md +++ b/mdop/appv-v4/package-results-pane.md @@ -1,7 +1,7 @@ --- title: Package Results Pane description: Package Results Pane -author: eavena +author: dansimp ms.assetid: 07b7f737-f26f-4feb-88aa-3d8009c5622d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/packages-node.md b/mdop/appv-v4/packages-node.md index 548eea3031..a8bcf5560e 100644 --- a/mdop/appv-v4/packages-node.md +++ b/mdop/appv-v4/packages-node.md @@ -1,7 +1,7 @@ --- title: Packages Node description: Packages Node -author: eavena +author: dansimp ms.assetid: 3465168c-012f-4e9f-905d-611418d2975a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/packaging-method--learn-more-.md b/mdop/appv-v4/packaging-method--learn-more-.md index b1016bf355..193e825c51 100644 --- a/mdop/appv-v4/packaging-method--learn-more-.md +++ b/mdop/appv-v4/packaging-method--learn-more-.md @@ -1,7 +1,7 @@ --- title: Packaging Method (Learn More) description: Packaging Method (Learn More) -author: eavena +author: dansimp ms.assetid: 3975a640-1ffd-4b4c-95fd-608469f4c205 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/packaging-method-page--learn-more-.md b/mdop/appv-v4/packaging-method-page--learn-more-.md index dade78cf81..a009435f20 100644 --- a/mdop/appv-v4/packaging-method-page--learn-more-.md +++ b/mdop/appv-v4/packaging-method-page--learn-more-.md @@ -1,7 +1,7 @@ --- title: Packaging Method Page (Learn More) description: Packaging Method Page (Learn More) -author: eavena +author: dansimp ms.assetid: f405a293-bcd4-48a1-b4d9-b5e4cf73c5f4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/parse-items-tab-keep.md b/mdop/appv-v4/parse-items-tab-keep.md index 04e254d387..e2bd550ab2 100644 --- a/mdop/appv-v4/parse-items-tab-keep.md +++ b/mdop/appv-v4/parse-items-tab-keep.md @@ -1,7 +1,7 @@ --- title: Parse Items Tab description: Parse Items Tab -author: eavena +author: dansimp ms.assetid: bdf3fe0d-404a-4745-af52-f415fa321564 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md b/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md index 3e3b86e643..474424a086 100644 --- a/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md +++ b/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md @@ -1,7 +1,7 @@ --- title: Planning and Deployment Guide for the Application Virtualization System description: Planning and Deployment Guide for the Application Virtualization System -author: eavena +author: dansimp ms.assetid: 6c012e33-9ac6-4cd8-84ff-54f40973833f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md b/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md index 71f4d2d740..f40e560fdf 100644 --- a/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md +++ b/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md @@ -1,7 +1,7 @@ --- title: Planning for Application Virtualization Client Deployment description: Planning for Application Virtualization Client Deployment -author: eavena +author: dansimp ms.assetid: a352f80f-f0f9-4fbf-ac10-24c510b2d6be ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md b/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md index c76572d411..acb7830906 100644 --- a/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md +++ b/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md @@ -1,7 +1,7 @@ --- title: Planning for Application Virtualization System Deployment description: Planning for Application Virtualization System Deployment -author: eavena +author: dansimp ms.assetid: 8215269f-c083-468a-bf0b-886b0d2dd69e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/planning-for-client-security.md b/mdop/appv-v4/planning-for-client-security.md index 6050d3895b..8b6457f699 100644 --- a/mdop/appv-v4/planning-for-client-security.md +++ b/mdop/appv-v4/planning-for-client-security.md @@ -1,7 +1,7 @@ --- title: Planning for Client Security description: Planning for Client Security -author: eavena +author: dansimp ms.assetid: 4840a60f-4c91-489c-ad0b-6671882abf9b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- @@ -34,7 +34,7 @@ By default, at installation the App-V client is configured with the minimum perm By default, the installation of the client registers file type associations (FTAs) for OSD files, which enables users to start applications directly from OSD files instead of the published shortcuts. If a user with local administrator rights receives an OSD file containing malicious code, either in e-mail or downloaded from a Web site, the user can open the OSD file and start the application even if the client has been set to restrict the **Add Application** permission. You can unregister the FTAs for the OSD to reduce this risk. Also, consider blocking this extension in the e-mail system and at the firewall. For more information about configuring Outlook to block extensions, see . -**Security Note:  ** +**Security Note:** Starting with App-V version 4.6, the file type association is no longer created for OSD files during a new installation of the client, although the existing settings will be maintained during an upgrade from version 4.2 or 4.5 of the App-V client. If for any reason it is essential to create the file type association, you can create the following registry keys and set their values as shown: @@ -50,7 +50,7 @@ During installation, you can use the **RequireAuthorizationIfCached** parameter Antivirus software running on an App-V Client computer can detect and report an infected file in the virtual environment. However, it cannot disinfect the file. If a virus is detected in the virtual environment, the antivirus software would perform the configured quarantine or repair operation in the cache, not in the actual package. Configure the antivirus software with an exception for the sftfs.fsd file. This file is the cache file that stores packages on the App-V Client. -**Security Note:  ** +**Security Note:** If a virus is detected in an application or package deployed in the production environment, replace the application or package with a virus-free version. diff --git a/mdop/appv-v4/planning-for-migration-from-previous-versions.md b/mdop/appv-v4/planning-for-migration-from-previous-versions.md index c999a32a70..80ed54ee4b 100644 --- a/mdop/appv-v4/planning-for-migration-from-previous-versions.md +++ b/mdop/appv-v4/planning-for-migration-from-previous-versions.md @@ -1,7 +1,7 @@ --- title: Planning for Migration from Previous Versions description: Planning for Migration from Previous Versions -author: eavena +author: dansimp ms.assetid: 62967bf1-542f-41b0-838f-c62f3430ac73 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/planning-for-security-and-protection.md b/mdop/appv-v4/planning-for-security-and-protection.md index b750a27dca..92ff750703 100644 --- a/mdop/appv-v4/planning-for-security-and-protection.md +++ b/mdop/appv-v4/planning-for-security-and-protection.md @@ -1,7 +1,7 @@ --- title: Planning for Security and Protection description: Planning for Security and Protection -author: eavena +author: dansimp ms.assetid: d0e2ef81-c197-4020-ad85-8d66fe5c178f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/planning-for-sequencer-security.md b/mdop/appv-v4/planning-for-sequencer-security.md index d3ad4052ec..9e8655200f 100644 --- a/mdop/appv-v4/planning-for-sequencer-security.md +++ b/mdop/appv-v4/planning-for-sequencer-security.md @@ -1,7 +1,7 @@ --- title: Planning for Sequencer Security description: Planning for Sequencer Security -author: eavena +author: dansimp ms.assetid: 8043cb02-476d-4c28-a850-903a8ac5b2d3 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/planning-for-server-security.md b/mdop/appv-v4/planning-for-server-security.md index 7f51cc0fc6..31f57ecb6d 100644 --- a/mdop/appv-v4/planning-for-server-security.md +++ b/mdop/appv-v4/planning-for-server-security.md @@ -1,7 +1,7 @@ --- title: Planning for Server Security description: Planning for Server Security -author: eavena +author: dansimp ms.assetid: c7cd8227-b359-41e7-a8ae-d0d5718a76a2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- @@ -31,7 +31,7 @@ The content directory contains all of the packages that are to be streamed to cl Keep the number of users with administrative privileges to a minimum to reduce possible threats to the data in the data store and to avoid publishing malicious applications into the infrastructure. -## Application Virtualization Security +## Application Virtualization Security App-V uses several methods of communication between the various components of the infrastructure. When you plan your App-V infrastructure, securing the communications between servers can reduce the security risks that might already be present on the existing network. diff --git a/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md b/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md index fe295dc2f6..8825c4306e 100644 --- a/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md +++ b/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md @@ -1,7 +1,7 @@ --- title: Planning the Application Virtualization Sequencer Implementation description: Planning the Application Virtualization Sequencer Implementation -author: eavena +author: dansimp ms.assetid: 052f32fe-ad13-4921-a8ce-4a657eb2b2bf ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md b/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md index 15a00e586c..2fa2f11deb 100644 --- a/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md +++ b/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md @@ -1,7 +1,7 @@ --- title: Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation description: Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation -author: eavena +author: dansimp ms.assetid: 3a57306e-5c54-4fde-8593-fe3b788f18d3 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md b/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md index a166551ed1..885a566c91 100644 --- a/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md +++ b/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md @@ -1,7 +1,7 @@ --- title: Planning Your Streaming Solution in an Electronic Software Distribution Implementation description: Planning Your Streaming Solution in an Electronic Software Distribution Implementation -author: eavena +author: dansimp ms.assetid: bc18772a-f169-486f-adb1-7af1a31845aa ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/prepare-computer-page--learn-more-.md b/mdop/appv-v4/prepare-computer-page--learn-more-.md index d1b9f19800..508985a3fb 100644 --- a/mdop/appv-v4/prepare-computer-page--learn-more-.md +++ b/mdop/appv-v4/prepare-computer-page--learn-more-.md @@ -1,7 +1,7 @@ --- title: Prepare Computer Page (Learn More) description: Prepare Computer Page (Learn More) -author: eavena +author: dansimp ms.assetid: a401ce3d-b8f7-4b3f-9be9-ecf6d8b544fd ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/properties-tab-keep.md b/mdop/appv-v4/properties-tab-keep.md index f6f72144b0..8f068996f6 100644 --- a/mdop/appv-v4/properties-tab-keep.md +++ b/mdop/appv-v4/properties-tab-keep.md @@ -1,7 +1,7 @@ --- title: Properties Tab description: Properties Tab -author: eavena +author: dansimp ms.assetid: 6ff20678-6766-4f0d-8bbb-f19b224682a1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/provider-policies-node.md b/mdop/appv-v4/provider-policies-node.md index 38f417e3a1..68130e6575 100644 --- a/mdop/appv-v4/provider-policies-node.md +++ b/mdop/appv-v4/provider-policies-node.md @@ -1,7 +1,7 @@ --- title: Provider Policies Node description: Provider Policies Node -author: eavena +author: dansimp ms.assetid: 89b47076-7732-4128-93cc-8e6d5b671c8e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/provider-policies-results-pane-columns.md b/mdop/appv-v4/provider-policies-results-pane-columns.md index 2b83fbccc2..d570b23283 100644 --- a/mdop/appv-v4/provider-policies-results-pane-columns.md +++ b/mdop/appv-v4/provider-policies-results-pane-columns.md @@ -1,7 +1,7 @@ --- title: Provider Policies Results Pane Columns description: Provider Policies Results Pane Columns -author: eavena +author: dansimp ms.assetid: f9456f17-3106-4e5a-9a8c-df3af66986e1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/provider-policies-results-pane.md b/mdop/appv-v4/provider-policies-results-pane.md index 8bad9dc1e4..da6df828bd 100644 --- a/mdop/appv-v4/provider-policies-results-pane.md +++ b/mdop/appv-v4/provider-policies-results-pane.md @@ -1,7 +1,7 @@ --- title: Provider Policies Results Pane description: Provider Policies Results Pane -author: eavena +author: dansimp ms.assetid: 17ea0836-bfb5-4966-8778-155444d81e64 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/publish-app.md b/mdop/appv-v4/publish-app.md index 365bd869f4..cc0c253c2f 100644 --- a/mdop/appv-v4/publish-app.md +++ b/mdop/appv-v4/publish-app.md @@ -1,7 +1,7 @@ --- title: PUBLISH APP description: PUBLISH APP -author: eavena +author: dansimp ms.assetid: f25f06a8-ca23-435b-a0c2-16a5f39b6b97 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/publish-package.md b/mdop/appv-v4/publish-package.md index 0ddf0d20e8..f0fb1da684 100644 --- a/mdop/appv-v4/publish-package.md +++ b/mdop/appv-v4/publish-package.md @@ -1,7 +1,7 @@ --- title: PUBLISH PACKAGE description: PUBLISH PACKAGE -author: eavena +author: dansimp ms.assetid: a33e72dd-194f-4283-8e99-4584ab13de53 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/publishing-servers-node.md b/mdop/appv-v4/publishing-servers-node.md index bc9ef99098..1c6ffd8268 100644 --- a/mdop/appv-v4/publishing-servers-node.md +++ b/mdop/appv-v4/publishing-servers-node.md @@ -1,7 +1,7 @@ --- title: Publishing Servers Node description: Publishing Servers Node -author: eavena +author: dansimp ms.assetid: b5823c6c-15bc-4e8d-aeeb-acc366ffedd1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/publishing-servers-results-pane-columns.md b/mdop/appv-v4/publishing-servers-results-pane-columns.md index ef1b0fcca5..18c1671c57 100644 --- a/mdop/appv-v4/publishing-servers-results-pane-columns.md +++ b/mdop/appv-v4/publishing-servers-results-pane-columns.md @@ -1,7 +1,7 @@ --- title: Publishing Servers Results Pane Columns description: Publishing Servers Results Pane Columns -author: eavena +author: dansimp ms.assetid: ad875715-50b3-4881-a6b3-586238d12527 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/publishing-servers-results-pane.md b/mdop/appv-v4/publishing-servers-results-pane.md index 9ed534f85d..e812805dd8 100644 --- a/mdop/appv-v4/publishing-servers-results-pane.md +++ b/mdop/appv-v4/publishing-servers-results-pane.md @@ -1,7 +1,7 @@ --- title: Publishing Servers Results Pane description: Publishing Servers Results Pane -author: eavena +author: dansimp ms.assetid: ee0662e8-9623-4a7c-b6dc-657fa3f56161 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md b/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md index 8b19e64174..f2b259d4e6 100644 --- a/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md +++ b/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md @@ -1,7 +1,7 @@ --- title: Publishing Virtual Applications Using Application Virtualization Management Servers description: Publishing Virtual Applications Using Application Virtualization Management Servers -author: eavena +author: dansimp ms.assetid: f3d79284-3f82-4ca3-b741-1a80b61490da ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md b/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md index 7587f1b537..744cdd05d9 100644 --- a/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md +++ b/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md @@ -1,7 +1,7 @@ --- title: Publishing Virtual Applications Using Electronic Software Distribution description: Publishing Virtual Applications Using Electronic Software Distribution -author: eavena +author: dansimp ms.assetid: 295fbc1d-ed1c-43b4-aeee-0df384d4e630 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/query-obj.md b/mdop/appv-v4/query-obj.md index 21de4d2dc6..3c9adf095a 100644 --- a/mdop/appv-v4/query-obj.md +++ b/mdop/appv-v4/query-obj.md @@ -1,7 +1,7 @@ --- title: QUERY OBJ description: QUERY OBJ -author: eavena +author: dansimp ms.assetid: 55abf0d1-c779-4172-8357-552ab010933b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/refresh-server.md b/mdop/appv-v4/refresh-server.md index bb227a1cc9..ae5e986c4f 100644 --- a/mdop/appv-v4/refresh-server.md +++ b/mdop/appv-v4/refresh-server.md @@ -1,7 +1,7 @@ --- title: REFRESH SERVER description: REFRESH SERVER -author: eavena +author: dansimp ms.assetid: 232df842-a160-46cd-b60b-f464cd9a0086 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/repair-app.md b/mdop/appv-v4/repair-app.md index 7d6f2d1ea2..65bc1db344 100644 --- a/mdop/appv-v4/repair-app.md +++ b/mdop/appv-v4/repair-app.md @@ -1,7 +1,7 @@ --- title: REPAIR APP description: REPAIR APP -author: eavena +author: dansimp ms.assetid: 892b556b-612d-4531-890e-4cfc2ac88d9f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/reports-node.md b/mdop/appv-v4/reports-node.md index 8ba7e786a8..c6969fb115 100644 --- a/mdop/appv-v4/reports-node.md +++ b/mdop/appv-v4/reports-node.md @@ -1,7 +1,7 @@ --- title: Reports Node description: Reports Node -author: eavena +author: dansimp ms.assetid: b7fdc52d-f112-4a65-af25-134398810e9b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/reports-results-pane-columns.md b/mdop/appv-v4/reports-results-pane-columns.md index 760dc1d0cf..7c6bc3a0c3 100644 --- a/mdop/appv-v4/reports-results-pane-columns.md +++ b/mdop/appv-v4/reports-results-pane-columns.md @@ -1,7 +1,7 @@ --- title: Reports Results Pane Columns description: Reports Results Pane Columns -author: eavena +author: dansimp ms.assetid: 907360ca-6a55-4e42-88d2-db1a24cd2a28 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/reports-results-pane.md b/mdop/appv-v4/reports-results-pane.md index c885db722e..57a5bb2b3e 100644 --- a/mdop/appv-v4/reports-results-pane.md +++ b/mdop/appv-v4/reports-results-pane.md @@ -1,7 +1,7 @@ --- title: Reports Results Pane description: Reports Results Pane -author: eavena +author: dansimp ms.assetid: 66beac62-fa55-4ab9-ac19-b9e1772e2d20 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md index 38956d73ff..2ecb94c6fd 100644 --- a/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md +++ b/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md @@ -1,7 +1,7 @@ --- title: Restart Task Failure Dialog Box (App-V 4.6 SP1) description: Restart Task Failure Dialog Box (App-V 4.6 SP1) -author: eavena +author: dansimp ms.assetid: 1933fe71-8aa0-4e43-b6f7-060050001edd ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md b/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md index 14baba4904..7fc9be9f19 100644 --- a/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md +++ b/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md @@ -1,7 +1,7 @@ --- title: Run Each Program Page description: Run Each Program Page -author: eavena +author: dansimp ms.assetid: 4f09a64e-9545-47aa-bc43-fda0089f7adb ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/security-and-protection-overview.md b/mdop/appv-v4/security-and-protection-overview.md index fc4bd7ab49..6e0554598b 100644 --- a/mdop/appv-v4/security-and-protection-overview.md +++ b/mdop/appv-v4/security-and-protection-overview.md @@ -1,7 +1,7 @@ --- title: Security and Protection Overview description: Security and Protection Overview -author: eavena +author: dansimp ms.assetid: a43e1c53-7936-4d48-a110-0be26c8e9d97 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- @@ -21,7 +21,7 @@ Microsoft Application Virtualization 4.5 provides the following enhanced securi - Application Virtualization now supports Transport Layer Security (TLS) using X.509 V3 certificates. Provided that a server certificate has been provisioned to the planned Application Virtualization Management or Streaming Server, the installation will default to secure, using the RTSPS protocol over port 322. Using RTSPS ensures that communication between the Application Virtualization Servers and the Application Virtualization Clients is signed and encrypted. If no certificate is assigned to the server during the Application Virtualization Server installation, the communication will be set to RTSP over port 554. - **Security Note:  ** + **Security Note:** To help provide a secure setup of the server, you must make sure that RTSP ports are disabled even if you have all packages configured to use RTSPS. diff --git a/mdop/appv-v4/select-files-page.md b/mdop/appv-v4/select-files-page.md index 01baa300ba..d4bfc181fb 100644 --- a/mdop/appv-v4/select-files-page.md +++ b/mdop/appv-v4/select-files-page.md @@ -1,7 +1,7 @@ --- title: Select Files Page description: Select Files Page -author: eavena +author: dansimp ms.assetid: 6d1524ca-6306-4a28-b65f-3ded9d487e75 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/select-guidance-page--package-accelerators-.md b/mdop/appv-v4/select-guidance-page--package-accelerators-.md index 77b089953b..680d508314 100644 --- a/mdop/appv-v4/select-guidance-page--package-accelerators-.md +++ b/mdop/appv-v4/select-guidance-page--package-accelerators-.md @@ -1,7 +1,7 @@ --- title: Select Guidance Page (Package Accelerators) description: Select Guidance Page (Package Accelerators) -author: eavena +author: dansimp ms.assetid: 608b8823-6eac-40c0-a6dc-2f0bfc0d42a1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md b/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md index 69735eb53e..0a26f2e4c6 100644 --- a/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md +++ b/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md @@ -1,7 +1,7 @@ --- title: Select Installation Files Page description: Select Installation Files Page -author: eavena +author: dansimp ms.assetid: 4c8cd49e-ba39-4918-9863-5b3c315d14a5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/select-installer-page--learn-more-.md b/mdop/appv-v4/select-installer-page--learn-more-.md index 56c3d2df7d..ade2d58d1f 100644 --- a/mdop/appv-v4/select-installer-page--learn-more-.md +++ b/mdop/appv-v4/select-installer-page--learn-more-.md @@ -1,7 +1,7 @@ --- title: Select Installer Page (Learn More) description: Select Installer Page (Learn More) -author: eavena +author: dansimp ms.assetid: da05e756-d23e-4557-8ff6-313d695a78a1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/select-package--learn-more--page.md b/mdop/appv-v4/select-package--learn-more--page.md index c23544c5fb..2dac258cff 100644 --- a/mdop/appv-v4/select-package--learn-more--page.md +++ b/mdop/appv-v4/select-package--learn-more--page.md @@ -1,7 +1,7 @@ --- title: Select Package (Learn More) Page description: Select Package (Learn More) Page -author: eavena +author: dansimp ms.assetid: 0b3d4ca4-ff65-4aa5-87a9-61cbe2ffc8be ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/select-package-accelerator--learn-more--page.md b/mdop/appv-v4/select-package-accelerator--learn-more--page.md index 3e387a8a14..887f03367c 100644 --- a/mdop/appv-v4/select-package-accelerator--learn-more--page.md +++ b/mdop/appv-v4/select-package-accelerator--learn-more--page.md @@ -1,7 +1,7 @@ --- title: Select Package Accelerator (Learn More) Page description: Select Package Accelerator (Learn More) Page -author: eavena +author: dansimp ms.assetid: 2db51514-8695-4b5e-b3e5-1e96e3ee4cc7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/select-package-accelerator-page.md b/mdop/appv-v4/select-package-accelerator-page.md index 8969a6ffaf..e455a69f63 100644 --- a/mdop/appv-v4/select-package-accelerator-page.md +++ b/mdop/appv-v4/select-package-accelerator-page.md @@ -1,7 +1,7 @@ --- title: Select Package Accelerator Page description: Select Package Accelerator Page -author: eavena +author: dansimp ms.assetid: 865c2702-4dfd-41ae-8cfc-3514d5f41f76 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/select-primary-page--learn-more-.md b/mdop/appv-v4/select-primary-page--learn-more-.md index 1a1ed7a346..38a6d0748c 100644 --- a/mdop/appv-v4/select-primary-page--learn-more-.md +++ b/mdop/appv-v4/select-primary-page--learn-more-.md @@ -1,7 +1,7 @@ --- title: Select Primary Page (Learn More) description: Select Primary Page (Learn More) -author: eavena +author: dansimp ms.assetid: 17c779da-f683-4967-b136-94fe65373c1b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/select-task-page--learn-more-.md b/mdop/appv-v4/select-task-page--learn-more-.md index 1f5037a3e4..18b296a24e 100644 --- a/mdop/appv-v4/select-task-page--learn-more-.md +++ b/mdop/appv-v4/select-task-page--learn-more-.md @@ -1,7 +1,7 @@ --- title: Select Task Page (Learn More) description: Select Task Page (Learn More) -author: eavena +author: dansimp ms.assetid: 09534c40-bf6c-4b3f-be9a-8624965c9c18 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/sequencer-command-line-error-codes.md b/mdop/appv-v4/sequencer-command-line-error-codes.md index a328fb293d..3f60bfec5b 100644 --- a/mdop/appv-v4/sequencer-command-line-error-codes.md +++ b/mdop/appv-v4/sequencer-command-line-error-codes.md @@ -1,7 +1,7 @@ --- title: Sequencer Command-Line Error Codes description: Sequencer Command-Line Error Codes -author: eavena +author: dansimp ms.assetid: 3d491314-4923-45fd-9839-c541c5e620bd ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/sequencer-command-line-parameters.md b/mdop/appv-v4/sequencer-command-line-parameters.md index f0a873d666..7731e1d5ea 100644 --- a/mdop/appv-v4/sequencer-command-line-parameters.md +++ b/mdop/appv-v4/sequencer-command-line-parameters.md @@ -1,7 +1,7 @@ --- title: Sequencer Command-Line Parameters description: Sequencer Command-Line Parameters -author: eavena +author: dansimp ms.assetid: 28fb875a-c302-4d95-b2e0-8dc0c5dbb0f8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/sequencer-console.md b/mdop/appv-v4/sequencer-console.md index 075bbf4f05..49d86a316d 100644 --- a/mdop/appv-v4/sequencer-console.md +++ b/mdop/appv-v4/sequencer-console.md @@ -1,7 +1,7 @@ --- title: Sequencer Console description: Sequencer Console -author: eavena +author: dansimp ms.assetid: 69e0202d-be2c-41cc-99cb-2a08a034e804 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/sequencer-dialog-boxes.md b/mdop/appv-v4/sequencer-dialog-boxes.md index 796ed43e5a..2f48597aa3 100644 --- a/mdop/appv-v4/sequencer-dialog-boxes.md +++ b/mdop/appv-v4/sequencer-dialog-boxes.md @@ -1,7 +1,7 @@ --- title: Sequencer Dialog Boxes description: Sequencer Dialog Boxes -author: eavena +author: dansimp ms.assetid: f660d56b-0244-4167-b077-96ad482e6b36 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/sequencer-hardware-and-software-requirements.md b/mdop/appv-v4/sequencer-hardware-and-software-requirements.md index 47e3854169..bc08faf80a 100644 --- a/mdop/appv-v4/sequencer-hardware-and-software-requirements.md +++ b/mdop/appv-v4/sequencer-hardware-and-software-requirements.md @@ -1,7 +1,7 @@ --- title: Sequencer Hardware and Software Requirements description: Sequencer Hardware and Software Requirements -author: eavena +author: dansimp ms.assetid: 36084e12-831d-452f-a4a4-45f07f9ce471 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md b/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md index 49a306d35f..1ef34e3837 100644 --- a/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md +++ b/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md @@ -1,7 +1,7 @@ --- title: Sequencer Wizard - Package Accelerator (AppV 4.6 SP1) description: Sequencer Wizard - Package Accelerator (AppV 4.6 SP1) -author: eavena +author: dansimp ms.assetid: 1f75f5ba-0707-48fb-b0b8-ba94a5159e36 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/sequencing-wizard.md b/mdop/appv-v4/sequencing-wizard.md index b439b83d0a..6d6e869a11 100644 --- a/mdop/appv-v4/sequencing-wizard.md +++ b/mdop/appv-v4/sequencing-wizard.md @@ -1,7 +1,7 @@ --- title: Sequencing Wizard description: Sequencing Wizard -author: eavena +author: dansimp ms.assetid: 81e2f4fa-b06e-4cbe-aeb8-6ceb8f0543a5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/server-groups-node.md b/mdop/appv-v4/server-groups-node.md index 449204c5da..991741f07e 100644 --- a/mdop/appv-v4/server-groups-node.md +++ b/mdop/appv-v4/server-groups-node.md @@ -1,7 +1,7 @@ --- title: Server Groups Node description: Server Groups Node -author: eavena +author: dansimp ms.assetid: 6b2ed086-9100-47d0-be7f-0c5fb4fa55c6 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/server-groups-results-pane-columns.md b/mdop/appv-v4/server-groups-results-pane-columns.md index 33042df361..3777434491 100644 --- a/mdop/appv-v4/server-groups-results-pane-columns.md +++ b/mdop/appv-v4/server-groups-results-pane-columns.md @@ -1,7 +1,7 @@ --- title: Server Groups Results Pane Columns description: Server Groups Results Pane Columns -author: eavena +author: dansimp ms.assetid: e91b1b9b-e58c-4274-ad18-8b157936b9be ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/server-groups-results-pane.md b/mdop/appv-v4/server-groups-results-pane.md index 1d2a446726..43aca80bf7 100644 --- a/mdop/appv-v4/server-groups-results-pane.md +++ b/mdop/appv-v4/server-groups-results-pane.md @@ -1,7 +1,7 @@ --- title: Server Groups Results Pane description: Server Groups Results Pane -author: eavena +author: dansimp ms.assetid: ac7b0525-5946-4728-9cf1-c65007852ebe ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/server-management-console-about-dialog-boxes.md b/mdop/appv-v4/server-management-console-about-dialog-boxes.md index 5ab178a36b..28765cec65 100644 --- a/mdop/appv-v4/server-management-console-about-dialog-boxes.md +++ b/mdop/appv-v4/server-management-console-about-dialog-boxes.md @@ -1,7 +1,7 @@ --- title: Server Management Console About Dialog Boxes description: Server Management Console About Dialog Boxes -author: eavena +author: dansimp ms.assetid: b5fdee0b-4269-4a48-98a0-ed3f06cff041 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/server-management-console-administrators-node.md b/mdop/appv-v4/server-management-console-administrators-node.md index 9394274f33..c8d25650e4 100644 --- a/mdop/appv-v4/server-management-console-administrators-node.md +++ b/mdop/appv-v4/server-management-console-administrators-node.md @@ -1,7 +1,7 @@ --- title: Server Management Console Administrators Node description: Server Management Console Administrators Node -author: eavena +author: dansimp ms.assetid: ab421454-69d1-4c10-8f58-2a35ae89c8b1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/server-management-console-application-licenses-node.md b/mdop/appv-v4/server-management-console-application-licenses-node.md index 2a8a97906f..7673a67fdd 100644 --- a/mdop/appv-v4/server-management-console-application-licenses-node.md +++ b/mdop/appv-v4/server-management-console-application-licenses-node.md @@ -1,7 +1,7 @@ --- title: Server Management Console Application Licenses Node description: Server Management Console Application Licenses Node -author: eavena +author: dansimp ms.assetid: ad3fa486-2b3c-4efd-91f5-507e9c5057d5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/server-management-console-application-virtualization-system-node.md b/mdop/appv-v4/server-management-console-application-virtualization-system-node.md index 527349e8e6..2d708a6647 100644 --- a/mdop/appv-v4/server-management-console-application-virtualization-system-node.md +++ b/mdop/appv-v4/server-management-console-application-virtualization-system-node.md @@ -1,7 +1,7 @@ --- title: Server Management Console Application Virtualization System Node description: Server Management Console Application Virtualization System Node -author: eavena +author: dansimp ms.assetid: 9450832e-335c-41e7-af24-fddb8ffc327c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/server-management-console-applications-node.md b/mdop/appv-v4/server-management-console-applications-node.md index 4b4463745a..b673e056f0 100644 --- a/mdop/appv-v4/server-management-console-applications-node.md +++ b/mdop/appv-v4/server-management-console-applications-node.md @@ -1,7 +1,7 @@ --- title: Server Management Console Applications Node description: Server Management Console Applications Node -author: eavena +author: dansimp ms.assetid: e465f816-032d-4824-9924-f2dcf30f2a2c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/server-management-console-file-type-associations-node.md b/mdop/appv-v4/server-management-console-file-type-associations-node.md index e40517eb0a..f3d64be8f3 100644 --- a/mdop/appv-v4/server-management-console-file-type-associations-node.md +++ b/mdop/appv-v4/server-management-console-file-type-associations-node.md @@ -1,7 +1,7 @@ --- title: Server Management Console File Type Associations Node description: Server Management Console File Type Associations Node -author: eavena +author: dansimp ms.assetid: c22168be-6601-4154-b36b-9ca0fa87e5e0 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/server-management-console-packages-node.md b/mdop/appv-v4/server-management-console-packages-node.md index 2bd20d93df..43d502c939 100644 --- a/mdop/appv-v4/server-management-console-packages-node.md +++ b/mdop/appv-v4/server-management-console-packages-node.md @@ -1,7 +1,7 @@ --- title: Server Management Console Packages Node description: Server Management Console Packages Node -author: eavena +author: dansimp ms.assetid: 458424f6-d586-4fa8-bf61-44c5028a4490 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/server-management-console-provider-policies-node.md b/mdop/appv-v4/server-management-console-provider-policies-node.md index 6d899befab..0b55fe35db 100644 --- a/mdop/appv-v4/server-management-console-provider-policies-node.md +++ b/mdop/appv-v4/server-management-console-provider-policies-node.md @@ -1,7 +1,7 @@ --- title: Server Management Console Provider Policies Node description: Server Management Console Provider Policies Node -author: eavena +author: dansimp ms.assetid: a5b99158-9af8-45bb-b3b8-61e220529e14 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/server-management-console-reports-node.md b/mdop/appv-v4/server-management-console-reports-node.md index 1b6808031b..2d44db2032 100644 --- a/mdop/appv-v4/server-management-console-reports-node.md +++ b/mdop/appv-v4/server-management-console-reports-node.md @@ -1,7 +1,7 @@ --- title: Server Management Console Reports Node description: Server Management Console Reports Node -author: eavena +author: dansimp ms.assetid: 9dde6332-5882-40dd-8a8f-857216df80ed ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/server-management-console-server-groups-node.md b/mdop/appv-v4/server-management-console-server-groups-node.md index 7b3cc68876..73f5c2f80b 100644 --- a/mdop/appv-v4/server-management-console-server-groups-node.md +++ b/mdop/appv-v4/server-management-console-server-groups-node.md @@ -1,7 +1,7 @@ --- title: Server Management Console Server Groups Node description: Server Management Console Server Groups Node -author: eavena +author: dansimp ms.assetid: 83b86fc5-3f77-4470-985a-cf0bb8686067 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: eravena ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/sftmime--command-reference.md b/mdop/appv-v4/sftmime--command-reference.md index 1f2d7d6407..732b47bafc 100644 --- a/mdop/appv-v4/sftmime--command-reference.md +++ b/mdop/appv-v4/sftmime--command-reference.md @@ -1,7 +1,7 @@ --- title: SFTMIME Command Reference description: SFTMIME Command Reference -author: manikadhiman +author: dansimp ms.assetid: a4a69228-9dd3-4623-b773-899d03c0cf10 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/sfttray-command-reference.md b/mdop/appv-v4/sfttray-command-reference.md index 38b1c28072..9e7dc93e91 100644 --- a/mdop/appv-v4/sfttray-command-reference.md +++ b/mdop/appv-v4/sfttray-command-reference.md @@ -1,7 +1,7 @@ --- title: SFTTRAY Command Reference description: SFTTRAY Command Reference -author: manikadhiman +author: dansimp ms.assetid: 6fa3a939-b047-4d6c-bd1d-dfb93e065eb2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md index 2148e9742b..ced6882390 100644 --- a/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md +++ b/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md @@ -1,7 +1,7 @@ --- title: Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1) description: Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1) -author: manikadhiman +author: dansimp ms.assetid: bcdb9b82-b53d-4a36-9f5d-71c021d4be28 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/software-audit-reportserver.md b/mdop/appv-v4/software-audit-reportserver.md index 4d147072ea..9efbb49955 100644 --- a/mdop/appv-v4/software-audit-reportserver.md +++ b/mdop/appv-v4/software-audit-reportserver.md @@ -1,7 +1,7 @@ --- title: Software Audit Report description: Software Audit Report -author: manikadhiman +author: dansimp ms.assetid: 55a49ed2-f331-40d3-add6-8e5fcd6816fd ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md b/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md index ca951538f7..224b3b7a04 100644 --- a/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md +++ b/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md @@ -1,7 +1,7 @@ --- title: Stand-Alone Delivery Scenario for Application Virtualization Clients description: Stand-Alone Delivery Scenario for Application Virtualization Clients -author: manikadhiman +author: dansimp ms.assetid: 7545b468-f58a-4504-a6d5-3c2d303731c4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/stand-alone-delivery-scenario-overview.md b/mdop/appv-v4/stand-alone-delivery-scenario-overview.md index 7ac815d680..d01a132c43 100644 --- a/mdop/appv-v4/stand-alone-delivery-scenario-overview.md +++ b/mdop/appv-v4/stand-alone-delivery-scenario-overview.md @@ -1,7 +1,7 @@ --- title: Stand-Alone Delivery Scenario Overview description: Stand-Alone Delivery Scenario Overview -author: manikadhiman +author: dansimp ms.assetid: b109f309-f3c1-43af-996f-2a9b138dd171 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/streaming-page-learn-more.md b/mdop/appv-v4/streaming-page-learn-more.md index 690d651a6b..f46ecd595d 100644 --- a/mdop/appv-v4/streaming-page-learn-more.md +++ b/mdop/appv-v4/streaming-page-learn-more.md @@ -1,7 +1,7 @@ --- title: Streaming Page description: Streaming Page -author: manikadhiman +author: dansimp ms.assetid: a69a57a0-1bbe-4604-840d-bfa87ec463e1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/support-for-client-reporting-over-http.md b/mdop/appv-v4/support-for-client-reporting-over-http.md index 1afa6d3679..23aa56eca5 100644 --- a/mdop/appv-v4/support-for-client-reporting-over-http.md +++ b/mdop/appv-v4/support-for-client-reporting-over-http.md @@ -1,7 +1,7 @@ --- title: Support for Client Reporting over HTTP description: Support for Client Reporting over HTTP -author: manikadhiman +author: dansimp ms.assetid: 4a26ac80-1fb5-4c05-83de-4d06793f7bf2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md index 03fc10a7d3..8e3965c0c2 100644 --- a/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md +++ b/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md @@ -1,7 +1,7 @@ --- title: SXS Conflict Detected Dialog Box (App-V 4.6 SP1) description: SXS Conflict Detected Dialog Box (App-V 4.6 SP1) -author: manikadhiman +author: dansimp ms.assetid: 7cbb67ba-cc11-4f10-b903-4a6af233eacb ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/system-error-reportserver.md b/mdop/appv-v4/system-error-reportserver.md index a981fa9bd2..b94b419d2f 100644 --- a/mdop/appv-v4/system-error-reportserver.md +++ b/mdop/appv-v4/system-error-reportserver.md @@ -1,7 +1,7 @@ --- title: System Error Report description: System Error Report -author: manikadhiman +author: dansimp ms.assetid: 4081db2f-92a6-4928-a26b-757048159094 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/system-utilization-reportserver.md b/mdop/appv-v4/system-utilization-reportserver.md index 7251ff513b..5bccc4c9ab 100644 --- a/mdop/appv-v4/system-utilization-reportserver.md +++ b/mdop/appv-v4/system-utilization-reportserver.md @@ -1,7 +1,7 @@ --- title: System Utilization Report description: System Utilization Report -author: manikadhiman +author: dansimp ms.assetid: 4d490d15-2d1f-4f2c-99bb-0685447c0672 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/target-os-page-learn-more.md b/mdop/appv-v4/target-os-page-learn-more.md index ef9fb2aa79..34db517496 100644 --- a/mdop/appv-v4/target-os-page-learn-more.md +++ b/mdop/appv-v4/target-os-page-learn-more.md @@ -1,7 +1,7 @@ --- title: Target OS Page description: Target OS Page -author: manikadhiman +author: dansimp ms.assetid: 003fd992-0a7e-494e-9e75-4dd5e0927e15 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md b/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md index d7a550ba6b..f3df4eb7f8 100644 --- a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md +++ b/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md @@ -1,7 +1,7 @@ --- title: Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1) description: Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1) -author: manikadhiman +author: dansimp ms.assetid: 58597af9-6a62-4588-ab41-dbf6b7026267 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md b/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md index 736d4abb06..88d5d425f0 100644 --- a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md +++ b/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md @@ -1,7 +1,7 @@ --- title: Tasks for the Application Virtualization Sequencer description: Tasks for the Application Virtualization Sequencer -author: manikadhiman +author: dansimp ms.assetid: 398018f4-297a-440d-b614-23f0ab03e7bd ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md b/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md index d518b6dd1c..c7285083d5 100644 --- a/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md +++ b/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md @@ -1,7 +1,7 @@ --- title: Troubleshooting Application Virtualization Sequencer Issues description: Troubleshooting Application Virtualization Sequencer Issues -author: manikadhiman +author: dansimp ms.assetid: 2712094b-a0bc-4643-aced-5415535f3fec ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/troubleshooting-certificate-permission-issues.md b/mdop/appv-v4/troubleshooting-certificate-permission-issues.md index 62d5a6e274..9b05d6624b 100644 --- a/mdop/appv-v4/troubleshooting-certificate-permission-issues.md +++ b/mdop/appv-v4/troubleshooting-certificate-permission-issues.md @@ -1,7 +1,7 @@ --- title: Troubleshooting Certificate Permission Issues description: Troubleshooting Certificate Permission Issues -author: manikadhiman +author: dansimp ms.assetid: 06b8cbbc-93fd-44aa-af39-2d780792d3c3 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md b/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md index 37f2f88e78..a8b8781132 100644 --- a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md +++ b/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md @@ -1,7 +1,7 @@ --- title: Troubleshooting Information for the Application Virtualization Client description: Troubleshooting Information for the Application Virtualization Client -author: manikadhiman +author: dansimp ms.assetid: 260a8dad-847f-4ec0-b7dd-6e6bc52017ed ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md b/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md index 80485a8023..df335aaec7 100644 --- a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md +++ b/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md @@ -1,7 +1,7 @@ --- title: Troubleshooting Information for the Application Virtualization Server description: Troubleshooting Information for the Application Virtualization Server -author: manikadhiman +author: dansimp ms.assetid: e9d43d9b-84f2-4d1b-bb90-a13740151e0c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md b/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md index de5af9194f..c832ebe830 100644 --- a/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md +++ b/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md @@ -1,7 +1,7 @@ --- title: Troubleshooting the Application Virtualization Sequencer description: Troubleshooting the Application Virtualization Sequencer -author: manikadhiman +author: dansimp ms.assetid: 12ea8367-0b84-44e1-a885-e0539486556b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/type-of-application-page--learn-more-.md b/mdop/appv-v4/type-of-application-page--learn-more-.md index 72e6772aa9..529c2aac7d 100644 --- a/mdop/appv-v4/type-of-application-page--learn-more-.md +++ b/mdop/appv-v4/type-of-application-page--learn-more-.md @@ -1,7 +1,7 @@ --- title: Type of Application Page (Learn More) description: Type of Application Page (Learn More) -author: manikadhiman +author: dansimp ms.assetid: d1262d16-7b14-441e-8500-7974bf68d196 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/unload-app.md b/mdop/appv-v4/unload-app.md index a2748ee100..e9b1a2c013 100644 --- a/mdop/appv-v4/unload-app.md +++ b/mdop/appv-v4/unload-app.md @@ -1,7 +1,7 @@ --- title: UNLOAD APP description: UNLOAD APP -author: manikadhiman +author: dansimp ms.assetid: f0d729ae-8772-498b-be11-1a4b35499c53 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/unload-package.md b/mdop/appv-v4/unload-package.md index 03039cbbfe..8c8678569e 100644 --- a/mdop/appv-v4/unload-package.md +++ b/mdop/appv-v4/unload-package.md @@ -1,7 +1,7 @@ --- title: UNLOAD PACKAGE description: UNLOAD PACKAGE -author: manikadhiman +author: dansimp ms.assetid: a076eb5a-ce3d-49e4-ac7a-4d4df10e3477 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/unlock-app.md b/mdop/appv-v4/unlock-app.md index 8d20a7f7a3..91940cb378 100644 --- a/mdop/appv-v4/unlock-app.md +++ b/mdop/appv-v4/unlock-app.md @@ -1,7 +1,7 @@ --- title: UNLOCK APP description: UNLOCK APP -author: manikadhiman +author: dansimp ms.assetid: 91fc8ceb-b4f5-4a06-8193-05189f830943 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/unpublish-package.md b/mdop/appv-v4/unpublish-package.md index 4111a75383..34f5a16083 100644 --- a/mdop/appv-v4/unpublish-package.md +++ b/mdop/appv-v4/unpublish-package.md @@ -1,7 +1,7 @@ --- title: UNPUBLISH PACKAGE description: UNPUBLISH PACKAGE -author: manikadhiman +author: dansimp ms.assetid: 1651427c-72a5-4701-bb57-71e14a7a3803 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md b/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md index 37f72f87ed..b5823c5aa0 100644 --- a/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md +++ b/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md @@ -1,7 +1,7 @@ --- title: User Access Permissions in Application Virtualization Client description: User Access Permissions in Application Virtualization Client -author: manikadhiman +author: dansimp ms.assetid: 7459374c-810c-45e3-b205-fdd1f8514f80 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md b/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md index 11a9533a37..e41d0cb21b 100644 --- a/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md +++ b/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md @@ -1,7 +1,7 @@ --- title: Using Application Virtualization Servers as a Package Management Solution description: Using Application Virtualization Servers as a Package Management Solution -author: manikadhiman +author: dansimp ms.assetid: 41597355-e7bb-45e2-b300-7b1724419975 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md b/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md index 6f8e379deb..af5b7a4cfc 100644 --- a/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md +++ b/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md @@ -1,7 +1,7 @@ --- title: Using Electronic Software Distribution as a Package Management Solution description: Using Electronic Software Distribution as a Package Management Solution -author: manikadhiman +author: dansimp ms.assetid: 7d96ea70-3e7e-49fa-89cc-586804a10657 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/verify-applications-page--package-accelerators-.md b/mdop/appv-v4/verify-applications-page--package-accelerators-.md index 6cb0bdd47e..fa38068d5e 100644 --- a/mdop/appv-v4/verify-applications-page--package-accelerators-.md +++ b/mdop/appv-v4/verify-applications-page--package-accelerators-.md @@ -1,7 +1,7 @@ --- title: Verify Applications Page (Package Accelerators) description: Verify Applications Page (Package Accelerators) -author: manikadhiman +author: dansimp ms.assetid: e58a37db-d042-453f-aa0d-2f324600a35b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/virtual-application-package-additional-components.md b/mdop/appv-v4/virtual-application-package-additional-components.md index e44d919586..8fe48620bc 100644 --- a/mdop/appv-v4/virtual-application-package-additional-components.md +++ b/mdop/appv-v4/virtual-application-package-additional-components.md @@ -1,7 +1,7 @@ --- title: Virtual Application Package Additional Components description: Virtual Application Package Additional Components -author: manikadhiman +author: dansimp ms.assetid: 476b0f40-ebd6-4296-92fa-61fa9495c03c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/appv-v4/virtual-file-system-tab-keep.md b/mdop/appv-v4/virtual-file-system-tab-keep.md index 9d50f3a15c..290e0a1d2a 100644 --- a/mdop/appv-v4/virtual-file-system-tab-keep.md +++ b/mdop/appv-v4/virtual-file-system-tab-keep.md @@ -1,7 +1,7 @@ --- title: Virtual File System Tab description: Virtual File System Tab -author: manikadhiman +author: dansimp ms.assetid: 9d084e2a-720d-4a25-9cd5-d0d70868b413 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/virtual-registry-tab-keep.md b/mdop/appv-v4/virtual-registry-tab-keep.md index ab7b437cfd..cd9e9a01da 100644 --- a/mdop/appv-v4/virtual-registry-tab-keep.md +++ b/mdop/appv-v4/virtual-registry-tab-keep.md @@ -1,7 +1,7 @@ --- title: Virtual Registry Tab description: Virtual Registry Tab -author: manikadhiman +author: dansimp ms.assetid: 25833383-24c4-40a1-b34c-73b2bd3f11e1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/virtual-services-tab-keep.md b/mdop/appv-v4/virtual-services-tab-keep.md index 2314727dbd..360df6d0a5 100644 --- a/mdop/appv-v4/virtual-services-tab-keep.md +++ b/mdop/appv-v4/virtual-services-tab-keep.md @@ -1,7 +1,7 @@ --- title: Virtual Services Tab description: Virtual Services Tab -author: manikadhiman +author: dansimp ms.assetid: 9fc4679d-ccb5-4df7-99de-dd7d3a367ecc ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v4/wizard-pages--appv-46-sp1-.md b/mdop/appv-v4/wizard-pages--appv-46-sp1-.md index 8ea9090de2..a0a4219295 100644 --- a/mdop/appv-v4/wizard-pages--appv-46-sp1-.md +++ b/mdop/appv-v4/wizard-pages--appv-46-sp1-.md @@ -1,7 +1,7 @@ --- title: Wizard Pages (AppV 4.6 SP1) description: Wizard Pages (AppV 4.6 SP1) -author: manikadhiman +author: dansimp ms.assetid: dadab8cf-fe6d-4cff-8f6c-e9676f244872 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/appv-v5/about-app-v-50-dynamic-configuration.md b/mdop/appv-v5/about-app-v-50-dynamic-configuration.md index 103b44d92c..8a54d8a0da 100644 --- a/mdop/appv-v5/about-app-v-50-dynamic-configuration.md +++ b/mdop/appv-v5/about-app-v-50-dynamic-configuration.md @@ -1,7 +1,7 @@ --- title: About App-V 5.0 Dynamic Configuration description: About App-V 5.0 Dynamic Configuration -author: manikadhiman +author: dansimp ms.assetid: 88afaca1-68c5-45c4-a074-9371c56b5804 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-app-v-50-reporting.md b/mdop/appv-v5/about-app-v-50-reporting.md index a050c4a164..f5bce3e29a 100644 --- a/mdop/appv-v5/about-app-v-50-reporting.md +++ b/mdop/appv-v5/about-app-v-50-reporting.md @@ -1,7 +1,7 @@ --- title: About App-V 5.0 Reporting description: About App-V 5.0 Reporting -author: manikadhiman +author: dansimp ms.assetid: 27c33dda-f017-41e3-8a78-1b681543ec4f ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-app-v-50-sp1.md b/mdop/appv-v5/about-app-v-50-sp1.md index d77515d490..2222333447 100644 --- a/mdop/appv-v5/about-app-v-50-sp1.md +++ b/mdop/appv-v5/about-app-v-50-sp1.md @@ -1,7 +1,7 @@ --- title: About App-V 5.0 SP1 description: About App-V 5.0 SP1 -author: manikadhiman +author: dansimp ms.assetid: 2848a51b-452e-4c70-b465-f6717cfa667f ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-app-v-50-sp2.md b/mdop/appv-v5/about-app-v-50-sp2.md index 9da2057ae1..f3f167d10a 100644 --- a/mdop/appv-v5/about-app-v-50-sp2.md +++ b/mdop/appv-v5/about-app-v-50-sp2.md @@ -1,7 +1,7 @@ --- title: About App-V 5.0 SP2 description: About App-V 5.0 SP2 -author: manikadhiman +author: dansimp ms.assetid: 16ca8452-cef2-464e-b4b5-c10d4630fa6a ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-app-v-50-sp3.md b/mdop/appv-v5/about-app-v-50-sp3.md index 404ea88933..a784b0b574 100644 --- a/mdop/appv-v5/about-app-v-50-sp3.md +++ b/mdop/appv-v5/about-app-v-50-sp3.md @@ -1,7 +1,7 @@ --- title: About App-V 5.0 SP3 description: About App-V 5.0 SP3 -author: manikadhiman +author: dansimp ms.assetid: 67b5268b-edc1-4027-98b0-b3937dd70a6b ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-app-v-50.md b/mdop/appv-v5/about-app-v-50.md index 76b86ac82d..a81421348c 100644 --- a/mdop/appv-v5/about-app-v-50.md +++ b/mdop/appv-v5/about-app-v-50.md @@ -1,7 +1,7 @@ --- title: About App-V 5.0 description: About App-V 5.0 -author: manikadhiman +author: dansimp ms.assetid: 5799141b-44bc-4033-afcc-212235e15f00 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-app-v-51-dynamic-configuration.md b/mdop/appv-v5/about-app-v-51-dynamic-configuration.md index b66bfce583..663c596d68 100644 --- a/mdop/appv-v5/about-app-v-51-dynamic-configuration.md +++ b/mdop/appv-v5/about-app-v-51-dynamic-configuration.md @@ -1,7 +1,7 @@ --- title: About App-V 5.1 dynamic configuration description: You can use the dynamic configuration to customize an App-V 5.1 package for a user. Use the following information to create or edit an existing dynamic configuration file. -author: manikadhiman +author: dansimp ms.assetid: 35bc9908-d502-4a9c-873f-8ee17b6d9d74 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-app-v-51-reporting.md b/mdop/appv-v5/about-app-v-51-reporting.md index 05c85668ea..b37f88f1db 100644 --- a/mdop/appv-v5/about-app-v-51-reporting.md +++ b/mdop/appv-v5/about-app-v-51-reporting.md @@ -1,7 +1,7 @@ --- title: About App-V 5.1 Reporting description: About App-V 5.1 Reporting -author: manikadhiman +author: dansimp ms.assetid: 385dca00-7178-4e35-8d86-c58867ebd65c ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-app-v-51.md b/mdop/appv-v5/about-app-v-51.md index 199fc19259..f52bcf1b64 100644 --- a/mdop/appv-v5/about-app-v-51.md +++ b/mdop/appv-v5/about-app-v-51.md @@ -1,7 +1,7 @@ --- title: About App-V 5.1 description: About App-V 5.1 -author: manikadhiman +author: dansimp ms.assetid: 35bc9908-d502-4a9c-873f-8ee17b6d9d74 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-client-configuration-settings.md b/mdop/appv-v5/about-client-configuration-settings.md index 8671a0c754..9ba08f850a 100644 --- a/mdop/appv-v5/about-client-configuration-settings.md +++ b/mdop/appv-v5/about-client-configuration-settings.md @@ -1,7 +1,7 @@ --- title: About Client Configuration Settings description: About Client Configuration Settings -author: manikadhiman +author: dansimp ms.assetid: cc7ae28c-b2ac-4f68-b992-5ccdbd5316a4 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-client-configuration-settings51.md b/mdop/appv-v5/about-client-configuration-settings51.md index b0af200279..0ea5586f2b 100644 --- a/mdop/appv-v5/about-client-configuration-settings51.md +++ b/mdop/appv-v5/about-client-configuration-settings51.md @@ -1,7 +1,7 @@ --- title: About Client Configuration Settings description: About Client Configuration Settings -author: manikadhiman +author: dansimp ms.assetid: 18bb307a-7eda-4dd6-a83e-6afaefd99470 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-the-connection-group-file.md b/mdop/appv-v5/about-the-connection-group-file.md index a46bdbf5ea..6052eca8c9 100644 --- a/mdop/appv-v5/about-the-connection-group-file.md +++ b/mdop/appv-v5/about-the-connection-group-file.md @@ -1,7 +1,7 @@ --- title: About the Connection Group File description: About the Connection Group File -author: manikadhiman +author: dansimp ms.assetid: bfeb6013-a7ca-4e36-9fe3-229702e83f0d ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-the-connection-group-file51.md b/mdop/appv-v5/about-the-connection-group-file51.md index f8949ce649..4b7274562f 100644 --- a/mdop/appv-v5/about-the-connection-group-file51.md +++ b/mdop/appv-v5/about-the-connection-group-file51.md @@ -1,7 +1,7 @@ --- title: About the Connection Group File description: About the Connection Group File -author: manikadhiman +author: dansimp ms.assetid: 1f4df515-f5f6-4b58-91a8-c71598cb3ea4 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-the-connection-group-virtual-environment.md b/mdop/appv-v5/about-the-connection-group-virtual-environment.md index d8d9974471..5b7e566fae 100644 --- a/mdop/appv-v5/about-the-connection-group-virtual-environment.md +++ b/mdop/appv-v5/about-the-connection-group-virtual-environment.md @@ -1,7 +1,7 @@ --- title: About the Connection Group Virtual Environment description: About the Connection Group Virtual Environment -author: manikadhiman +author: dansimp ms.assetid: 535fa640-cbd9-425e-8437-94650a70c264 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/about-the-connection-group-virtual-environment51.md b/mdop/appv-v5/about-the-connection-group-virtual-environment51.md index 3489f151b7..3acd54097c 100644 --- a/mdop/appv-v5/about-the-connection-group-virtual-environment51.md +++ b/mdop/appv-v5/about-the-connection-group-virtual-environment51.md @@ -1,7 +1,7 @@ --- title: About the Connection Group Virtual Environment description: About the Connection Group Virtual Environment -author: manikadhiman +author: dansimp ms.assetid: b7bb0e3d-8cd5-45a9-b84e-c9ab4196a18c ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/accessibility-for-app-v-50.md b/mdop/appv-v5/accessibility-for-app-v-50.md index 1f11859823..4cc6cd8431 100644 --- a/mdop/appv-v5/accessibility-for-app-v-50.md +++ b/mdop/appv-v5/accessibility-for-app-v-50.md @@ -1,7 +1,7 @@ --- title: Accessibility for App-V 5.0 description: Accessibility for App-V 5.0 -author: manikadhiman +author: dansimp ms.assetid: 56696523-6332-4bbe-8ddf-32b1dfe38131 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/accessibility-for-app-v-51.md b/mdop/appv-v5/accessibility-for-app-v-51.md index bae1242c01..30d29b8cd1 100644 --- a/mdop/appv-v5/accessibility-for-app-v-51.md +++ b/mdop/appv-v5/accessibility-for-app-v-51.md @@ -1,7 +1,7 @@ --- title: Accessibility for App-V 5.1 description: Accessibility for App-V 5.1 -author: manikadhiman +author: dansimp ms.assetid: ef3f7742-f2e9-4748-ad60-74e0961b1bd9 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md b/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md index cb135d1d39..d0bcc87058 100644 --- a/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md +++ b/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md @@ -1,7 +1,7 @@ --- title: Administering App-V 5.0 Virtual Applications by Using the Management Console description: Administering App-V 5.0 Virtual Applications by Using the Management Console -author: manikadhiman +author: dansimp ms.assetid: e9280dbd-782b-493a-b495-daab25247795 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/administering-app-v-51-by-using-powershell.md b/mdop/appv-v5/administering-app-v-51-by-using-powershell.md index 877702cf37..be798c4983 100644 --- a/mdop/appv-v5/administering-app-v-51-by-using-powershell.md +++ b/mdop/appv-v5/administering-app-v-51-by-using-powershell.md @@ -1,7 +1,7 @@ --- title: Administering App-V 5.1 by Using PowerShell description: Administering App-V 5.1 by Using PowerShell -author: manikadhiman +author: dansimp ms.assetid: 9e10ff07-2cd9-4dc1-9e99-582f90c36081 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md b/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md index 72a7e81f82..9431f2a486 100644 --- a/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md +++ b/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md @@ -1,7 +1,7 @@ --- title: Administering App-V 5.1 Virtual Applications by Using the Management Console description: Administering App-V 5.1 Virtual Applications by Using the Management Console -author: manikadhiman +author: dansimp ms.assetid: a4d078aa-ec54-4fa4-9463-bfb3b971d724 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/administering-app-v-by-using-powershell.md b/mdop/appv-v5/administering-app-v-by-using-powershell.md index 42d3dcaa27..8d6b8071a3 100644 --- a/mdop/appv-v5/administering-app-v-by-using-powershell.md +++ b/mdop/appv-v5/administering-app-v-by-using-powershell.md @@ -1,7 +1,7 @@ --- title: Administering App-V by Using PowerShell description: Administering App-V by Using PowerShell -author: manikadhiman +author: dansimp ms.assetid: 1ff4686a-1e19-4eff-b648-ada091281094 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-50-capacity-planning.md b/mdop/appv-v5/app-v-50-capacity-planning.md index 457f754602..3fe507eacf 100644 --- a/mdop/appv-v5/app-v-50-capacity-planning.md +++ b/mdop/appv-v5/app-v-50-capacity-planning.md @@ -1,7 +1,7 @@ --- title: App-V 5.0 Capacity Planning description: App-V 5.0 Capacity Planning -author: manikadhiman +author: dansimp ms.assetid: 56f48b00-cd91-4280-9481-5372a0e2e792 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-50-deployment-checklist.md b/mdop/appv-v5/app-v-50-deployment-checklist.md index 811e99527d..2b84226c10 100644 --- a/mdop/appv-v5/app-v-50-deployment-checklist.md +++ b/mdop/appv-v5/app-v-50-deployment-checklist.md @@ -1,7 +1,7 @@ --- title: App-V 5.0 Deployment Checklist description: App-V 5.0 Deployment Checklist -author: manikadhiman +author: dansimp ms.assetid: d6d93152-82b4-4b02-8b11-ed21d3331f00 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-50-planning-checklist.md b/mdop/appv-v5/app-v-50-planning-checklist.md index 4dbf695034..3eeb21f0b8 100644 --- a/mdop/appv-v5/app-v-50-planning-checklist.md +++ b/mdop/appv-v5/app-v-50-planning-checklist.md @@ -1,7 +1,7 @@ --- title: App-V 5.0 Planning Checklist description: App-V 5.0 Planning Checklist -author: manikadhiman +author: dansimp ms.assetid: 81d3fa62-3c9e-4de7-a9da-cd13112b0862 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-50-prerequisites.md b/mdop/appv-v5/app-v-50-prerequisites.md index 2ecd8abb24..1d1dcd7770 100644 --- a/mdop/appv-v5/app-v-50-prerequisites.md +++ b/mdop/appv-v5/app-v-50-prerequisites.md @@ -1,7 +1,7 @@ --- title: App-V 5.0 Prerequisites description: App-V 5.0 Prerequisites -author: manikadhiman +author: dansimp ms.assetid: 9756b571-c785-4ce6-a95c-d4e134e89429 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-50-security-considerations.md b/mdop/appv-v5/app-v-50-security-considerations.md index f7291b163e..3425e93637 100644 --- a/mdop/appv-v5/app-v-50-security-considerations.md +++ b/mdop/appv-v5/app-v-50-security-considerations.md @@ -1,7 +1,7 @@ --- title: App-V 5.0 Security Considerations description: App-V 5.0 Security Considerations -author: manikadhiman +author: dansimp ms.assetid: 1e7292a0-7972-4b4f-85a9-eaf33f6c563a ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-50-sp3-prerequisites.md b/mdop/appv-v5/app-v-50-sp3-prerequisites.md index fb281d9f9f..4b92ce66e0 100644 --- a/mdop/appv-v5/app-v-50-sp3-prerequisites.md +++ b/mdop/appv-v5/app-v-50-sp3-prerequisites.md @@ -1,7 +1,7 @@ --- title: App-V 5.0 SP3 Prerequisites description: App-V 5.0 SP3 Prerequisites -author: manikadhiman +author: dansimp ms.assetid: fa8d5578-3a53-4e8a-95c7-e7a5f6e4a31c ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-50-sp3-supported-configurations.md b/mdop/appv-v5/app-v-50-sp3-supported-configurations.md index ce1e2700d6..8341bc668d 100644 --- a/mdop/appv-v5/app-v-50-sp3-supported-configurations.md +++ b/mdop/appv-v5/app-v-50-sp3-supported-configurations.md @@ -1,7 +1,7 @@ --- title: App-V 5.0 SP3 Supported Configurations description: App-V 5.0 SP3 Supported Configurations -author: manikadhiman +author: dansimp ms.assetid: 08ced79a-0ed3-43c3-82e7-de01c1f33e81 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-50-supported-configurations.md b/mdop/appv-v5/app-v-50-supported-configurations.md index d8aebe5e0d..4b23a3738a 100644 --- a/mdop/appv-v5/app-v-50-supported-configurations.md +++ b/mdop/appv-v5/app-v-50-supported-configurations.md @@ -1,7 +1,7 @@ --- title: App-V 5.0 Supported Configurations description: App-V 5.0 Supported Configurations -author: manikadhiman +author: dansimp ms.assetid: 3787ff63-7ce7-45a8-8f01-81b4b6dced34 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-51-capacity-planning.md b/mdop/appv-v5/app-v-51-capacity-planning.md index 81fe9f8d6c..0473ec9858 100644 --- a/mdop/appv-v5/app-v-51-capacity-planning.md +++ b/mdop/appv-v5/app-v-51-capacity-planning.md @@ -1,7 +1,7 @@ --- title: App-V 5.1 Capacity Planning description: App-V 5.1 Capacity Planning -author: manikadhiman +author: dansimp ms.assetid: 7a98062f-5a60-49d6-ab40-dc6057e1dd5a ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-51-deployment-checklist.md b/mdop/appv-v5/app-v-51-deployment-checklist.md index 59236f1c84..955988dde1 100644 --- a/mdop/appv-v5/app-v-51-deployment-checklist.md +++ b/mdop/appv-v5/app-v-51-deployment-checklist.md @@ -1,7 +1,7 @@ --- title: App-V 5.1 Deployment Checklist description: App-V 5.1 Deployment Checklist -author: manikadhiman +author: dansimp ms.assetid: 44bed85a-e4f5-49d7-a308-a2b681f76372 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-51-planning-checklist.md b/mdop/appv-v5/app-v-51-planning-checklist.md index c662fbb94c..52ac3984ce 100644 --- a/mdop/appv-v5/app-v-51-planning-checklist.md +++ b/mdop/appv-v5/app-v-51-planning-checklist.md @@ -1,7 +1,7 @@ --- title: App-V 5.1 Planning Checklist description: App-V 5.1 Planning Checklist -author: manikadhiman +author: dansimp ms.assetid: 1e26a861-0612-43a6-972f-375a40a8dcbc ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-51-prerequisites.md b/mdop/appv-v5/app-v-51-prerequisites.md index 037f317f8d..f9709263ec 100644 --- a/mdop/appv-v5/app-v-51-prerequisites.md +++ b/mdop/appv-v5/app-v-51-prerequisites.md @@ -1,7 +1,7 @@ --- title: App-V 5.1 Prerequisites description: App-V 5.1 Prerequisites -author: manikadhiman +author: dansimp ms.assetid: 1bfa03c1-a4ae-45ec-8a2b-b10c2b94bfb0 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-51-security-considerations.md b/mdop/appv-v5/app-v-51-security-considerations.md index dac917b699..cf442e5690 100644 --- a/mdop/appv-v5/app-v-51-security-considerations.md +++ b/mdop/appv-v5/app-v-51-security-considerations.md @@ -1,7 +1,7 @@ --- title: App-V 5.1 Security Considerations description: App-V 5.1 Security Considerations -author: manikadhiman +author: dansimp ms.assetid: 6bc6c1fc-f813-47d4-b763-06fd4faf6a72 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/app-v-51-supported-configurations.md b/mdop/appv-v5/app-v-51-supported-configurations.md index 63e4f12d3c..aa2a35a202 100644 --- a/mdop/appv-v5/app-v-51-supported-configurations.md +++ b/mdop/appv-v5/app-v-51-supported-configurations.md @@ -1,7 +1,7 @@ --- title: App-V 5.1 Supported Configurations description: App-V 5.1 Supported Configurations -author: manikadhiman +author: dansimp ms.assetid: 8b8db63b-f71c-4ae9-80e7-a6752334e1f6 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/application-publishing-and-client-interaction.md b/mdop/appv-v5/application-publishing-and-client-interaction.md index 6623e796d2..6c060982f7 100644 --- a/mdop/appv-v5/application-publishing-and-client-interaction.md +++ b/mdop/appv-v5/application-publishing-and-client-interaction.md @@ -1,7 +1,7 @@ --- title: Application Publishing and Client Interaction description: Application Publishing and Client Interaction -author: manikadhiman +author: dansimp ms.assetid: c69a724a-85d1-4e2d-94a2-7ffe0b47d971 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/application-publishing-and-client-interaction51.md b/mdop/appv-v5/application-publishing-and-client-interaction51.md index 257cbe8a43..ba6d7e8fe7 100644 --- a/mdop/appv-v5/application-publishing-and-client-interaction51.md +++ b/mdop/appv-v5/application-publishing-and-client-interaction51.md @@ -1,7 +1,7 @@ --- title: Application Publishing and Client Interaction description: Application Publishing and Client Interaction -author: manikadhiman +author: dansimp ms.assetid: 36a4bf6f-a917-41a6-9856-6248686df352 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/check-reg-key-svr.md b/mdop/appv-v5/check-reg-key-svr.md index 84fc0d654a..44498c1829 100644 --- a/mdop/appv-v5/check-reg-key-svr.md +++ b/mdop/appv-v5/check-reg-key-svr.md @@ -1,7 +1,7 @@ --- title: Check Registry Keys before installing App-V 5.x Server description: Check Registry Keys before installing App-V 5.x Server -author: manikadhiman +author: dansimp ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library diff --git a/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md b/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md index 89f4fc49d7..fda09c81df 100644 --- a/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md +++ b/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md @@ -1,7 +1,7 @@ --- title: Creating and Managing App-V 5.0 Virtualized Applications description: Creating and Managing App-V 5.0 Virtualized Applications -author: manikadhiman +author: dansimp ms.assetid: 66bab403-d7e0-4e7b-bc8f-a29a98a7160a ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md index 203086f71b..4dbf7f3b64 100644 --- a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md +++ b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md @@ -222,7 +222,7 @@ The XML file that is included in the Office Deployment Tool specifies the produc 2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the configuration.xml file: - ``` syntax + ```xml @@ -633,7 +633,7 @@ You may want to disable specific applications in your Office App-V package. For 5. Add the Office 2016 App-V Package with the new Deployment Configuration File. - ``` syntax + ```xml Lync 2016 diff --git a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md index 7bc0c4e2c1..e1e6432a8a 100644 --- a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md +++ b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md @@ -43,9 +43,7 @@ You must configure the package converter to always save the package ingredients Import-Module AppVPkgConverter ``` -3. - - The following cmdlets are available: +3. The following cmdlets are available: - Test-AppvLegacyPackage – This cmdlet is designed to check packages. It will return information about any failures with the package such as missing **.sft** files, an invalid source, **.osd** file errors, or invalid package version. This cmdlet will not parse the **.sft** file or do any in depth validation. For information about options and basic functionality for this cmdlet, using the PowerShell cmdline, type `Test-AppvLegacyPackage -?`. diff --git a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md b/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md index 5cabf37196..ed4ef04eb0 100644 --- a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md +++ b/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md @@ -3,7 +3,7 @@ title: How to Install the App-V Databases and Convert the Associated Security Id description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell author: dansimp ms.assetid: 2be6fb72-f3a6-4550-bba1-6defa78ca08a -ms.reviewer: +ms.reviewer: manager: dansimp ms.author: dansimp ms.pagetype: mdop, appcompat, virtualization diff --git a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md b/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md index f69cd05803..8652ce06d6 100644 --- a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md +++ b/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md @@ -143,11 +143,11 @@ Click **Next**. 11. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. To perform either of the following customizations, select **Customize**. - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. + - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - Specify the operating systems that can run this package. + - Specify the operating systems that can run this package. - Click **Next**. + Click **Next**. 12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. @@ -234,11 +234,11 @@ Click **Next**. 10. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 12 of this procedure. To perform either of the following customizations, select **Customize**. - - Optimize how the package will run across a slow or unreliable network. + - Optimize how the package will run across a slow or unreliable network. - - Specify the operating systems that can run this package. + - Specify the operating systems that can run this package. - Click **Next**. + Click **Next**. 11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. Streaming improves the experience when the virtual application package is run on target computers on high-latency networks. It can take several minutes for all the applications to run. After all applications have run, close each of the applications. You can also configure the package to be required to be fully downloaded before opening by selecting the **Force applications to be downloaded** check-box. Click **Next**. diff --git a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md b/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md index 5143059379..ba6d5a807d 100644 --- a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md +++ b/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md @@ -128,11 +128,11 @@ Click **Next**. 11. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. To perform either of the following customizations, select **Customize**. - - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. + - Prepare the virtual package for streaming. Streaming improves the experience when the virtual application package is run on target computers. - - Specify the operating systems that can run this package. + - Specify the operating systems that can run this package. - Click **Next**. + Click **Next**. 12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**. @@ -210,11 +210,11 @@ On the computer that runs the sequencer, click **All Programs**, and then Click 10. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 12 of this procedure. To perform either of the following customizations, select **Customize**. - - Optimize how the package will run across a slow or unreliable network. + - Optimize how the package will run across a slow or unreliable network. - - Specify the operating systems that can run this package. + - Specify the operating systems that can run this package. - Click **Next**. + Click **Next**. 11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. Streaming improves the experience when the virtual application package is run on target computers on high-latency networks. It can take several minutes for all the applications to run. After all applications have run, close each of the applications. You can also configure the package to be required to be fully downloaded before opening by selecting the **Force applications to be downloaded** check-box. Click **Next**. diff --git a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md b/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md index 06eb564ecc..51f82f6674 100644 --- a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md +++ b/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md @@ -1,7 +1,7 @@ --- title: How to Use an App-V 4.6 Application From an App-V 5.1 Application description: How to Use an App-V 4.6 Application From an App-V 5.1 Application -author: msfttracyp +author: dansimp ms.assetid: 909b4391-762b-4988-b0cf-32b67f1fcf0e ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md b/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md index 3f0e318e6e..6ce7d696b3 100644 --- a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md +++ b/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md @@ -1,7 +1,7 @@ --- title: How to Use Optional Packages in Connection Groups description: How to Use Optional Packages in Connection Groups -author: msfttracyp +author: dansimp ms.assetid: 4d08a81b-55e5-471a-91dc-9a684fb3c9a1 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md b/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md index d507575d2e..ed95d88c35 100644 --- a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md +++ b/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md @@ -1,7 +1,7 @@ --- title: How to Use Optional Packages in Connection Groups description: How to Use Optional Packages in Connection Groups -author: msfttracyp +author: dansimp ms.assetid: 67666f18-b704-4852-a1e4-d13633bd2baf ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md b/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md index 0dbc87a5e6..a33b56e4c3 100644 --- a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md +++ b/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md @@ -1,7 +1,7 @@ --- title: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console description: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console -author: msfttracyp +author: dansimp ms.assetid: 1e1941d3-fb22-4077-8ec6-7a0cb80335d8 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md b/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md index b7b66d2e47..0c2e254447 100644 --- a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md +++ b/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md @@ -1,7 +1,7 @@ --- title: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console description: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console -author: msfttracyp +author: dansimp ms.assetid: c77e6662-7a18-4da1-8da8-b58068b65fa1 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/index.md b/mdop/appv-v5/index.md index ca33b4be38..c51ad7bc30 100644 --- a/mdop/appv-v5/index.md +++ b/mdop/appv-v5/index.md @@ -1,7 +1,7 @@ --- title: Application Virtualization 5 description: Application Virtualization 5 -author: jamiejdt +author: dansimp ms.assetid: e82eb44b-9ccd-41aa-923b-71400230ad23 ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy diff --git a/mdop/appv-v5/maintaining-app-v-50.md b/mdop/appv-v5/maintaining-app-v-50.md index 21a91e196a..44f18c8769 100644 --- a/mdop/appv-v5/maintaining-app-v-50.md +++ b/mdop/appv-v5/maintaining-app-v-50.md @@ -1,7 +1,7 @@ --- title: Maintaining App-V 5.0 description: Maintaining App-V 5.0 -author: msfttracyp +author: dansimp ms.assetid: 66851ec3-c674-493b-ad6d-db8fcbf1956c ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/maintaining-app-v-51.md b/mdop/appv-v5/maintaining-app-v-51.md index f972cbfdae..5ac415223c 100644 --- a/mdop/appv-v5/maintaining-app-v-51.md +++ b/mdop/appv-v5/maintaining-app-v-51.md @@ -1,7 +1,7 @@ --- title: Maintaining App-V 5.1 description: Maintaining App-V 5.1 -author: msfttracyp +author: dansimp ms.assetid: 5abd17d3-e8af-4261-b914-741ae116b0e7 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/managing-connection-groups.md b/mdop/appv-v5/managing-connection-groups.md index baca427994..1b293614ae 100644 --- a/mdop/appv-v5/managing-connection-groups.md +++ b/mdop/appv-v5/managing-connection-groups.md @@ -1,7 +1,7 @@ --- title: Managing Connection Groups description: Managing Connection Groups -author: msfttracyp +author: dansimp ms.assetid: 1a9c8f26-f421-4b70-b7e2-da8118e8198c ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/managing-connection-groups51.md b/mdop/appv-v5/managing-connection-groups51.md index 06ecc8b46b..f13c732883 100644 --- a/mdop/appv-v5/managing-connection-groups51.md +++ b/mdop/appv-v5/managing-connection-groups51.md @@ -1,7 +1,7 @@ --- title: Managing Connection Groups description: Managing Connection Groups -author: msfttracyp +author: dansimp ms.assetid: 22c9d3cb-7246-4173-9742-4ba1c24b0a6a ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md b/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md index bcad0aeea4..f6f7a5cd96 100644 --- a/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md +++ b/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md @@ -1,7 +1,7 @@ --- title: Microsoft Application Virtualization 5.0 Administrator's Guide description: Microsoft Application Virtualization 5.0 Administrator's Guide -author: msfttracyp +author: dansimp ms.assetid: c46e94b5-32cd-4377-8dc3-8163539be897 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md b/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md index f854875229..ec8eeadee2 100644 --- a/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md +++ b/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md @@ -1,7 +1,7 @@ --- title: Microsoft Application Virtualization 5.1 Administrator's Guide description: Microsoft Application Virtualization 5.1 Administrator's Guide -author: msfttracyp +author: dansimp ms.assetid: 3049996a-7253-4599-a29a-1b58f9ab14a4 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md b/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md index b990ad8485..a659ae2142 100644 --- a/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md +++ b/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md @@ -1,7 +1,7 @@ --- title: Migrating from a Previous Version description: Migrating from a Previous Version -author: msfttracyp +author: dansimp ms.assetid: a13cd353-b22a-48f7-af1e-5d54ede2a7e5 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md b/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md index 33eb8f92b7..cde64171ab 100644 --- a/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md +++ b/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md @@ -1,7 +1,7 @@ --- title: Migrating to App-V 5.1 from a Previous Version description: Migrating to App-V 5.1 from a Previous Version -author: msfttracyp +author: dansimp ms.assetid: e7ee0edc-7544-4c0a-aaca-d922a33bc1bb ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/operations-for-app-v-50.md b/mdop/appv-v5/operations-for-app-v-50.md index 040240cc28..ce80cf068a 100644 --- a/mdop/appv-v5/operations-for-app-v-50.md +++ b/mdop/appv-v5/operations-for-app-v-50.md @@ -1,7 +1,7 @@ --- title: Operations for App-V 5.0 description: Operations for App-V 5.0 -author: msfttracyp +author: dansimp ms.assetid: 4d0d41a6-f7da-4a2f-8ac9-2d67cc18ea93 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/operations-for-app-v-51.md b/mdop/appv-v5/operations-for-app-v-51.md index 4add886780..bbb273612e 100644 --- a/mdop/appv-v5/operations-for-app-v-51.md +++ b/mdop/appv-v5/operations-for-app-v-51.md @@ -1,7 +1,7 @@ --- title: Operations for App-V 5.1 description: Operations for App-V 5.1 -author: msfttracyp +author: dansimp ms.assetid: dd13b5c9-2d1e-442f-91e4-43dec7f17ea2 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md b/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md index 8c33b0c43a..2dfc27c239 100644 --- a/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md +++ b/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md @@ -1,7 +1,7 @@ --- title: Performance Guidance for Application Virtualization 5.0 description: Performance Guidance for Application Virtualization 5.0 -author: msfttracyp +author: dansimp ms.assetid: 6b3a3255-b957-4b9b-8bfc-a93fe8438a81 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md b/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md index adeaf0e07f..03b2a5a2dc 100644 --- a/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md +++ b/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md @@ -1,7 +1,7 @@ --- title: Performance Guidance for Application Virtualization 5.1 description: Performance Guidance for Application Virtualization 5.1 -author: msfttracyp +author: dansimp ms.assetid: 5f2643c7-5cf7-4a29-adb7-45bf9f5b0364 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-for-app-v-50-rc.md b/mdop/appv-v5/planning-for-app-v-50-rc.md index a9830b1c28..57f79d8ada 100644 --- a/mdop/appv-v5/planning-for-app-v-50-rc.md +++ b/mdop/appv-v5/planning-for-app-v-50-rc.md @@ -1,7 +1,7 @@ --- title: Planning for App-V 5.0 description: Planning for App-V 5.0 -author: msfttracyp +author: dansimp ms.assetid: 69df85b3-06c7-4123-af05-29d537a687ec ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-for-app-v-51.md b/mdop/appv-v5/planning-for-app-v-51.md index c32ba654cf..4184e228ca 100644 --- a/mdop/appv-v5/planning-for-app-v-51.md +++ b/mdop/appv-v5/planning-for-app-v-51.md @@ -1,7 +1,7 @@ --- title: Planning for App-V 5.1 description: Planning for App-V 5.1 -author: msfttracyp +author: dansimp ms.assetid: 8d84e679-0bd3-4864-976b-a3cbe6eafba6 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md b/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md index b861440d22..964dd5abc6 100644 --- a/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md +++ b/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md @@ -1,7 +1,7 @@ --- title: Planning for High Availability with App-V 5.0 description: Planning for High Availability with App-V 5.0 -author: msfttracyp +author: dansimp ms.assetid: 6d9a6492-23f8-465c-82e5-49c863594156 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md b/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md index c3e0e18888..39470aa4c7 100644 --- a/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md +++ b/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md @@ -1,7 +1,7 @@ --- title: Planning for High Availability with App-V 5.1 description: Planning for High Availability with App-V 5.1 -author: msfttracyp +author: dansimp ms.assetid: 1f190a0e-10ee-4fbe-a602-7e807e943033 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md index 0413cff809..1ba223f790 100644 --- a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md +++ b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md @@ -1,7 +1,7 @@ --- title: Planning for Migrating from a Previous Version of App-V description: Planning for Migrating from a Previous Version of App-V -author: msfttracyp +author: dansimp ms.assetid: d4ca8f09-86fd-456f-8ec2-242ff94ae9a0 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md index a895f50b35..34e606a7ab 100644 --- a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md +++ b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md @@ -1,7 +1,7 @@ --- title: Planning for Migrating from a Previous Version of App-V description: Planning for Migrating from a Previous Version of App-V -author: msfttracyp +author: dansimp ms.assetid: 4a058047-9674-41bc-8050-c58c97a80a9b ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md b/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md index d27170ec67..03ea39b207 100644 --- a/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md +++ b/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md @@ -1,7 +1,7 @@ --- title: Planning for the App-V 5.0 Sequencer and Client Deployment description: Planning for the App-V 5.0 Sequencer and Client Deployment -author: msfttracyp +author: dansimp ms.assetid: 57a604ad-90e1-4d32-86bb-eafff59aa43a ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md b/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md index a86ccf90cc..4522f9435f 100644 --- a/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md +++ b/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md @@ -1,7 +1,7 @@ --- title: Planning for the App-V 5.0 Server Deployment description: Planning for the App-V 5.0 Server Deployment -author: msfttracyp +author: dansimp ms.assetid: fd89b324-3961-471a-ad90-c8f9ae7a8155 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md b/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md index 03e04d5ec3..58f53e2c2b 100644 --- a/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md +++ b/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md @@ -1,7 +1,7 @@ --- title: Planning for the App-V 5.1 Sequencer and Client Deployment description: Planning for the App-V 5.1 Sequencer and Client Deployment -author: msfttracyp +author: dansimp ms.assetid: d92f8773-fa7d-4926-978a-433978f91202 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md b/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md index 7d2ec754d2..68c44e65f6 100644 --- a/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md +++ b/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md @@ -1,7 +1,7 @@ --- title: Planning for the App-V 5.1 Server Deployment description: Planning for the App-V 5.1 Server Deployment -author: msfttracyp +author: dansimp ms.assetid: eedd97c9-bee0-4749-9d1e-ab9528fba398 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-for-using-app-v-with-office.md b/mdop/appv-v5/planning-for-using-app-v-with-office.md index 76440328d4..8ca81ecded 100644 --- a/mdop/appv-v5/planning-for-using-app-v-with-office.md +++ b/mdop/appv-v5/planning-for-using-app-v-with-office.md @@ -1,7 +1,7 @@ --- title: Planning for Using App-V with Office description: Planning for Using App-V with Office -author: msfttracyp +author: dansimp ms.assetid: c4371869-4bfc-4d13-9198-ef19f99fc192 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-for-using-app-v-with-office51.md b/mdop/appv-v5/planning-for-using-app-v-with-office51.md index cb8f378a54..5d54fd6311 100644 --- a/mdop/appv-v5/planning-for-using-app-v-with-office51.md +++ b/mdop/appv-v5/planning-for-using-app-v-with-office51.md @@ -1,7 +1,7 @@ --- title: Planning for Using App-V with Office description: Planning for Using App-V with Office -author: msfttracyp +author: dansimp ms.assetid: e7a19b43-1746-469f-bad6-8e75cf4b3f67 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md b/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md index 4b5ea563cd..7357c45ff4 100644 --- a/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md +++ b/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md @@ -1,7 +1,7 @@ --- title: Planning to Deploy App-V 5.0 with an Electronic Software Distribution System description: Planning to Deploy App-V 5.0 with an Electronic Software Distribution System -author: msfttracyp +author: dansimp ms.assetid: 8cd3f1fb-b84e-4260-9e72-a14d01e7cadf ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md b/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md index 4a91a19040..aedb86f2c2 100644 --- a/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md +++ b/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md @@ -1,7 +1,7 @@ --- title: Planning to Deploy App-V 5.1 with an Electronic Software Distribution System description: Planning to Deploy App-V 5.1 with an Electronic Software Distribution System -author: msfttracyp +author: dansimp ms.assetid: c26602c2-5e8d-44e6-90df-adacc593607e ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-to-deploy-app-v.md b/mdop/appv-v5/planning-to-deploy-app-v.md index 832c964236..a85bcc8922 100644 --- a/mdop/appv-v5/planning-to-deploy-app-v.md +++ b/mdop/appv-v5/planning-to-deploy-app-v.md @@ -1,7 +1,7 @@ --- title: Planning to Deploy App-V description: Planning to Deploy App-V -author: msfttracyp +author: dansimp ms.assetid: 28d3035c-3805-4339-90fc-6c3fd3b1123e ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-to-deploy-app-v51.md b/mdop/appv-v5/planning-to-deploy-app-v51.md index 55b4441b42..76d04602d4 100644 --- a/mdop/appv-v5/planning-to-deploy-app-v51.md +++ b/mdop/appv-v5/planning-to-deploy-app-v51.md @@ -1,7 +1,7 @@ --- title: Planning to Deploy App-V description: Planning to Deploy App-V -author: msfttracyp +author: dansimp ms.assetid: 39cbf981-d9c6-457f-b047-f9046e1a6442 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md index e5be2f3b21..798a2dac4b 100644 --- a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md +++ b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md @@ -1,7 +1,7 @@ --- title: Planning to Use Folder Redirection with App-V description: Planning to Use Folder Redirection with App-V -author: msfttracyp +author: dansimp ms.assetid: 2a4deeed-fdc0-465c-b88a-3a2fbbf27436 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md index b64d421000..e5bc5e526b 100644 --- a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md +++ b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md @@ -1,7 +1,7 @@ --- title: Planning to Use Folder Redirection with App-V description: Planning to Use Folder Redirection with App-V -author: msfttracyp +author: dansimp ms.assetid: 6bea9a8f-a915-4d7d-be67-ef1cca1398ed ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/preparing-your-environment-for-app-v-50.md b/mdop/appv-v5/preparing-your-environment-for-app-v-50.md index f20ba14b11..3470db8ec4 100644 --- a/mdop/appv-v5/preparing-your-environment-for-app-v-50.md +++ b/mdop/appv-v5/preparing-your-environment-for-app-v-50.md @@ -1,7 +1,7 @@ --- title: Preparing Your Environment for App-V 5.0 description: Preparing Your Environment for App-V 5.0 -author: msfttracyp +author: dansimp ms.assetid: 119d990e-a6c6-47b7-a7b0-52f88205e5ec ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/preparing-your-environment-for-app-v-51.md b/mdop/appv-v5/preparing-your-environment-for-app-v-51.md index 3cef8f78e3..8c2fee5a36 100644 --- a/mdop/appv-v5/preparing-your-environment-for-app-v-51.md +++ b/mdop/appv-v5/preparing-your-environment-for-app-v-51.md @@ -1,7 +1,7 @@ --- title: Preparing Your Environment for App-V 5.1 description: Preparing Your Environment for App-V 5.1 -author: msfttracyp +author: dansimp ms.assetid: 64b2e1ac-1561-4c99-9815-b4688a0ff48a ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/release-notes-for-app-v-50-sp1.md b/mdop/appv-v5/release-notes-for-app-v-50-sp1.md index 2437a3abaa..9336bced97 100644 --- a/mdop/appv-v5/release-notes-for-app-v-50-sp1.md +++ b/mdop/appv-v5/release-notes-for-app-v-50-sp1.md @@ -1,7 +1,7 @@ --- title: Release Notes for App-V 5.0 SP1 description: Release Notes for App-V 5.0 SP1 -author: msfttracyp +author: dansimp ms.assetid: 21a859cd-41b4-4cc4-9c9c-7ba236084bb0 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/release-notes-for-app-v-50-sp2.md b/mdop/appv-v5/release-notes-for-app-v-50-sp2.md index 5f24db040f..f7d43521a3 100644 --- a/mdop/appv-v5/release-notes-for-app-v-50-sp2.md +++ b/mdop/appv-v5/release-notes-for-app-v-50-sp2.md @@ -1,7 +1,7 @@ --- title: Release Notes for App-V 5.0 SP2 description: Release Notes for App-V 5.0 SP2 -author: msfttracyp +author: dansimp ms.assetid: fe73139d-240c-4ed5-8e59-6ae76ee8e80c ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/release-notes-for-app-v-50-sp3.md b/mdop/appv-v5/release-notes-for-app-v-50-sp3.md index a00754bd10..0f03b6bd95 100644 --- a/mdop/appv-v5/release-notes-for-app-v-50-sp3.md +++ b/mdop/appv-v5/release-notes-for-app-v-50-sp3.md @@ -1,7 +1,7 @@ --- title: Release Notes for App-V 5.0 SP3 description: Release Notes for App-V 5.0 SP3 -author: msfttracyp +author: dansimp ms.assetid: bc4806e0-2aba-4c7b-9ecc-1b2cc54af1d0 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/release-notes-for-app-v-50.md b/mdop/appv-v5/release-notes-for-app-v-50.md index 4e86811e9d..56a0e3150d 100644 --- a/mdop/appv-v5/release-notes-for-app-v-50.md +++ b/mdop/appv-v5/release-notes-for-app-v-50.md @@ -1,7 +1,7 @@ --- title: Release Notes for App-V 5.0 description: Release Notes for App-V 5.0 -author: msfttracyp +author: dansimp ms.assetid: 68a6a5a1-4b3c-4c09-b00c-9ca4237695d5 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/release-notes-for-app-v-51.md b/mdop/appv-v5/release-notes-for-app-v-51.md index 4f937ae374..5fe16584ad 100644 --- a/mdop/appv-v5/release-notes-for-app-v-51.md +++ b/mdop/appv-v5/release-notes-for-app-v-51.md @@ -1,7 +1,7 @@ --- title: Release Notes for App-V 5.1 description: Release Notes for App-V 5.1 -author: msfttracyp +author: dansimp ms.assetid: 62c5be3b-0a46-4512-93ed-97c23184f343 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md b/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md index 8fb9c2b17a..34bad73ae5 100644 --- a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md +++ b/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md @@ -1,7 +1,7 @@ --- title: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications description: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications -author: msfttracyp +author: dansimp ms.assetid: a8affa46-f1f7-416c-8125-9595cfbfdbc7 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md b/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md index 147684b66e..04f3189b55 100644 --- a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md +++ b/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md @@ -1,7 +1,7 @@ --- title: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications description: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications -author: msfttracyp +author: dansimp ms.assetid: 71baf193-a9e8-4ffa-aa7f-e0bffed2e4b2 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/technical-reference-for-app-v-50.md b/mdop/appv-v5/technical-reference-for-app-v-50.md index 27f47f513c..91d5e9c9db 100644 --- a/mdop/appv-v5/technical-reference-for-app-v-50.md +++ b/mdop/appv-v5/technical-reference-for-app-v-50.md @@ -1,7 +1,7 @@ --- title: Technical Reference for App-V 5.0 description: Technical Reference for App-V 5.0 -author: msfttracyp +author: dansimp ms.assetid: aa899158-41e8-47d3-882c-8c5b96018308 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/technical-reference-for-app-v-51.md b/mdop/appv-v5/technical-reference-for-app-v-51.md index 7920671469..5b6eb75ac8 100644 --- a/mdop/appv-v5/technical-reference-for-app-v-51.md +++ b/mdop/appv-v5/technical-reference-for-app-v-51.md @@ -1,7 +1,7 @@ --- title: Technical Reference for App-V 5.1 description: Technical Reference for App-V 5.1 -author: msfttracyp +author: dansimp ms.assetid: 2b9e8b2b-4cd1-46f3-ba08-e3bc8d5c6127 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/troubleshooting-app-v-50.md b/mdop/appv-v5/troubleshooting-app-v-50.md index 4ec64fd490..e8853b459c 100644 --- a/mdop/appv-v5/troubleshooting-app-v-50.md +++ b/mdop/appv-v5/troubleshooting-app-v-50.md @@ -1,7 +1,7 @@ --- title: Troubleshooting App-V 5.0 description: Troubleshooting App-V 5.0 -author: msfttracyp +author: dansimp ms.assetid: a713b345-25b7-4cdf-ba55-66df672a1f3a ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/troubleshooting-app-v-51.md b/mdop/appv-v5/troubleshooting-app-v-51.md index f9c03ad8f8..81fd93938a 100644 --- a/mdop/appv-v5/troubleshooting-app-v-51.md +++ b/mdop/appv-v5/troubleshooting-app-v-51.md @@ -1,7 +1,7 @@ --- title: Troubleshooting App-V 5.1 description: Troubleshooting App-V 5.1 -author: msfttracyp +author: dansimp ms.assetid: 435d0e56-0aa2-4168-b5a7-2f03a1f273d4 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/using-the-app-v-50-client-management-console.md b/mdop/appv-v5/using-the-app-v-50-client-management-console.md index bc2bbc0a7d..9789c793bc 100644 --- a/mdop/appv-v5/using-the-app-v-50-client-management-console.md +++ b/mdop/appv-v5/using-the-app-v-50-client-management-console.md @@ -1,7 +1,7 @@ --- title: Using the App-V 5.0 Client Management Console description: Using the App-V 5.0 Client Management Console -author: msfttracyp +author: dansimp ms.assetid: 36398307-57dd-40f3-9d4f-b09f44fd37c3 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/using-the-app-v-51-client-management-console.md b/mdop/appv-v5/using-the-app-v-51-client-management-console.md index ec85b78997..7113c44600 100644 --- a/mdop/appv-v5/using-the-app-v-51-client-management-console.md +++ b/mdop/appv-v5/using-the-app-v-51-client-management-console.md @@ -1,7 +1,7 @@ --- title: Using the App-V 5.1 Client Management Console description: Using the App-V 5.1 Client Management Console -author: msfttracyp +author: dansimp ms.assetid: be6d4e35-5701-4f9a-ba8a-bede12662cf1 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md b/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md index ab6061698c..6e3f7208f0 100644 --- a/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md +++ b/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md @@ -1,7 +1,7 @@ --- title: Viewing App-V Server Publishing Metadata description: Viewing App-V Server Publishing Metadata -author: msfttracyp +author: dansimp ms.assetid: 048dd42a-24d4-4cc4-81f6-7a919aadd9b2 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md b/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md index 9d1b578f94..499324a790 100644 --- a/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md +++ b/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md @@ -1,7 +1,7 @@ --- title: Viewing App-V Server Publishing Metadata description: Viewing App-V Server Publishing Metadata -author: msfttracyp +author: dansimp ms.assetid: d5fa9eb5-647c-478d-8a4d-0ecda018bce6 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/whats-new-in-app-v-50-sp1.md b/mdop/appv-v5/whats-new-in-app-v-50-sp1.md index 01777e0e36..26d07fc5ef 100644 --- a/mdop/appv-v5/whats-new-in-app-v-50-sp1.md +++ b/mdop/appv-v5/whats-new-in-app-v-50-sp1.md @@ -1,7 +1,7 @@ --- title: What's new in App-V 5.0 SP1 description: What's new in App-V 5.0 SP1 -author: msfttracyp +author: dansimp ms.assetid: e97c2dbb-7b40-46a0-8137-9ee4fc2bd071 ms.reviewer: manager: dansimp diff --git a/mdop/appv-v5/whats-new-in-app-v-50.md b/mdop/appv-v5/whats-new-in-app-v-50.md index 6f816996a0..2db8329b5f 100644 --- a/mdop/appv-v5/whats-new-in-app-v-50.md +++ b/mdop/appv-v5/whats-new-in-app-v-50.md @@ -1,7 +1,7 @@ --- title: What's New in App-V 5.0 description: What's New in App-V 5.0 -author: msfttracyp +author: dansimp ms.assetid: 79ff6e02-e926-4803-87d8-248a6b28099d ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/about-dart-10.md b/mdop/dart-v10/about-dart-10.md index ad6c4560a0..3751028fe6 100644 --- a/mdop/dart-v10/about-dart-10.md +++ b/mdop/dart-v10/about-dart-10.md @@ -1,7 +1,7 @@ --- title: About DaRT 10 description: About DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 02378035-58d1-4095-82fe-d60734a746fb ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/accessibility-for-dart-10.md b/mdop/dart-v10/accessibility-for-dart-10.md index 7414466c4f..fd19439e04 100644 --- a/mdop/dart-v10/accessibility-for-dart-10.md +++ b/mdop/dart-v10/accessibility-for-dart-10.md @@ -1,7 +1,7 @@ --- title: Accessibility for DaRT 10 description: Accessibility for DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 61d7a30c-3551-440d-bdcd-36333052c7b4 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/administering-dart-10-using-powershell.md b/mdop/dart-v10/administering-dart-10-using-powershell.md index fb6f1d06b6..bfedfe3006 100644 --- a/mdop/dart-v10/administering-dart-10-using-powershell.md +++ b/mdop/dart-v10/administering-dart-10-using-powershell.md @@ -1,7 +1,7 @@ --- title: Administering DaRT 10 Using PowerShell description: Administering DaRT 10 Using PowerShell -author: msfttracyp +author: dansimp ms.assetid: eefe992f-077b-4e4b-8a5d-45b451614d7b ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/creating-the-dart-10-recovery-image.md b/mdop/dart-v10/creating-the-dart-10-recovery-image.md index 3f47366774..0a8a5f353e 100644 --- a/mdop/dart-v10/creating-the-dart-10-recovery-image.md +++ b/mdop/dart-v10/creating-the-dart-10-recovery-image.md @@ -1,7 +1,7 @@ --- title: Creating the DaRT 10 Recovery Image description: Creating the DaRT 10 Recovery Image -author: msfttracyp +author: dansimp ms.assetid: 173556de-2f20-4ea6-9e29-fc5ccc71ebd7 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/dart-10--c--page.md b/mdop/dart-v10/dart-10--c--page.md index a0e3d60f0d..53300542ed 100644 --- a/mdop/dart-v10/dart-10--c--page.md +++ b/mdop/dart-v10/dart-10--c--page.md @@ -1,7 +1,7 @@ --- title: DaRT 10 description: DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 4f62abe6-d971-44b4-b1e7-9dcaf199ca31 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/dart-10-cover-page.md b/mdop/dart-v10/dart-10-cover-page.md index ab111cbe8e..2940b90d99 100644 --- a/mdop/dart-v10/dart-10-cover-page.md +++ b/mdop/dart-v10/dart-10-cover-page.md @@ -1,7 +1,7 @@ --- title: DaRT 10 description: DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 875f6dc4-13f4-4625-8c6a-38215c2daf01 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/dart-10-deployment-checklist.md b/mdop/dart-v10/dart-10-deployment-checklist.md index 3dfa45cfc5..d3a741a13f 100644 --- a/mdop/dart-v10/dart-10-deployment-checklist.md +++ b/mdop/dart-v10/dart-10-deployment-checklist.md @@ -1,7 +1,7 @@ --- title: DaRT 10 Deployment Checklist description: DaRT 10 Deployment Checklist -author: msfttracyp +author: dansimp ms.assetid: a6b7ba27-a969-4da9-bef0-d019739413cc ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/dart-10-planning-checklist.md b/mdop/dart-v10/dart-10-planning-checklist.md index f7fc8ef40c..0a65b1cc0b 100644 --- a/mdop/dart-v10/dart-10-planning-checklist.md +++ b/mdop/dart-v10/dart-10-planning-checklist.md @@ -1,7 +1,7 @@ --- title: DaRT 10 Planning Checklist description: DaRT 10 Planning Checklist -author: msfttracyp +author: dansimp ms.assetid: d6482534-cdf3-4997-bec0-33d0edf6924a ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/dart-10-privacy-statement.md b/mdop/dart-v10/dart-10-privacy-statement.md index 2b640d3109..c54a9d8d96 100644 --- a/mdop/dart-v10/dart-10-privacy-statement.md +++ b/mdop/dart-v10/dart-10-privacy-statement.md @@ -1,7 +1,7 @@ --- title: DaRT 10 Privacy Statement description: DaRT 10 Privacy Statement -author: msfttracyp +author: dansimp ms.assetid: 27ad36fe-6816-4fe8-8838-500c05b5b184 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/dart-10-supported-configurations.md b/mdop/dart-v10/dart-10-supported-configurations.md index e700bfa7fa..8e8e070106 100644 --- a/mdop/dart-v10/dart-10-supported-configurations.md +++ b/mdop/dart-v10/dart-10-supported-configurations.md @@ -1,7 +1,7 @@ --- title: DaRT 10 Supported Configurations description: DaRT 10 Supported Configurations -author: msfttracyp +author: dansimp ms.assetid: a07d6562-1fa9-499f-829c-9cc487ede0b7 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md b/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md index 0e84d83c2b..354f2d6320 100644 --- a/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md +++ b/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md @@ -1,7 +1,7 @@ --- title: Deploying DaRT 10 to Administrator Computers description: Deploying DaRT 10 to Administrator Computers -author: msfttracyp +author: dansimp ms.assetid: c1981cbe-10f8-41f6-8989-bcc9d57a2aa8 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/deploying-dart-10.md b/mdop/dart-v10/deploying-dart-10.md index b2b9f2ace3..4d485fe455 100644 --- a/mdop/dart-v10/deploying-dart-10.md +++ b/mdop/dart-v10/deploying-dart-10.md @@ -1,7 +1,7 @@ --- title: Deploying DaRT 10 description: Deploying DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 92cf70fd-006f-4fdc-9fb3-78d9d223148d ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md b/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md index 6367ad326e..4a1bd4540a 100644 --- a/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md +++ b/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md @@ -1,7 +1,7 @@ --- title: Deploying the DaRT Recovery Image description: Deploying the DaRT Recovery Image -author: msfttracyp +author: dansimp ms.assetid: 2b859da6-e31a-4240-8868-93a754328cf2 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md b/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md index 0e168029e5..dee2c4b198 100644 --- a/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md +++ b/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md @@ -1,7 +1,7 @@ --- title: Diagnosing System Failures with Crash Analyzer description: Diagnosing System Failures with Crash Analyzer -author: msfttracyp +author: dansimp ms.assetid: 7ebef49e-a294-4173-adb1-7e6994aa01ad ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/getting-started-with-dart-10.md b/mdop/dart-v10/getting-started-with-dart-10.md index 634c9a9c74..825d83b221 100644 --- a/mdop/dart-v10/getting-started-with-dart-10.md +++ b/mdop/dart-v10/getting-started-with-dart-10.md @@ -1,7 +1,7 @@ --- title: Getting Started with DaRT 10 description: Getting Started with DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 593dd317-4fba-4d51-8a80-951590acede6 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md b/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md index 166f07768a..c6b364316a 100644 --- a/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md +++ b/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md @@ -1,7 +1,7 @@ --- title: How to Change, Repair, or Remove DaRT 10 description: How to Change, Repair, or Remove DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: e7718c6f-06a1-48bb-b04b-1a0f659a0337 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/how-to-deploy-dart-10.md b/mdop/dart-v10/how-to-deploy-dart-10.md index 805de4c46d..e2a3e044e5 100644 --- a/mdop/dart-v10/how-to-deploy-dart-10.md +++ b/mdop/dart-v10/how-to-deploy-dart-10.md @@ -1,7 +1,7 @@ --- title: How to Deploy DaRT 10 description: How to Deploy DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 13e8ba20-21c3-4870-94ed-6d3106d69f21 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md b/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md index 16d8853966..beb89d6265 100644 --- a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md +++ b/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md @@ -1,7 +1,7 @@ --- title: How to Deploy the DaRT Recovery Image as a Remote Partition description: How to Deploy the DaRT Recovery Image as a Remote Partition -author: msfttracyp +author: dansimp ms.assetid: 06a5e250-b992-4f6a-ad74-e7715f9e96e7 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md b/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md index 4fa7467fc0..7bf15bf936 100644 --- a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md +++ b/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md @@ -1,7 +1,7 @@ --- title: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition description: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -author: msfttracyp +author: dansimp ms.assetid: 0d2192c1-4058-49fb-b0b6-baf4699ac7f5 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md b/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md index 3eeda04d28..6d46740189 100644 --- a/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md +++ b/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md @@ -1,7 +1,7 @@ --- title: How to Ensure that Crash Analyzer Can Access Symbol Files description: How to Ensure that Crash Analyzer Can Access Symbol Files -author: msfttracyp +author: dansimp ms.assetid: 39e307bd-5d21-4e44-bed6-bf532f580775 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md b/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md index 6fda5d22e9..fc0752f99e 100644 --- a/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md +++ b/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md @@ -1,7 +1,7 @@ --- title: How to Perform DaRT Tasks by Using PowerShell Commands description: How to Perform DaRT Tasks by Using PowerShell Commands -author: msfttracyp +author: dansimp ms.assetid: f5a5c5f9-d667-4c85-9e82-7baf0b2aec6e ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md b/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md index 688b37b172..b3bb7236d2 100644 --- a/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md +++ b/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md @@ -1,7 +1,7 @@ --- title: How to Recover Local Computers by Using the DaRT Recovery Image description: How to Recover Local Computers by Using the DaRT Recovery Image -author: msfttracyp +author: dansimp ms.assetid: a6adc717-827c-45e8-b9c3-06d0e919e0bd ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md b/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md index 2a8e35021d..e67ab0c1a4 100644 --- a/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md +++ b/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md @@ -1,7 +1,7 @@ --- title: How to Recover Remote Computers by Using the DaRT Recovery Image description: How to Recover Remote Computers by Using the DaRT Recovery Image -author: msfttracyp +author: dansimp ms.assetid: c0062208-39cd-4e01-adf8-36a11386e2ea ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md b/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md index c84297c5bf..853caccec0 100644 --- a/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md +++ b/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md @@ -1,7 +1,7 @@ --- title: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer description: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -author: msfttracyp +author: dansimp ms.assetid: 27c1e1c6-123a-4f8a-b7d2-5bddc9ca3249 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md b/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md index 7cf5e9a3d7..669547afa0 100644 --- a/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md +++ b/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md @@ -1,7 +1,7 @@ --- title: How to Run the Crash Analyzer on an End-user Computer description: How to Run the Crash Analyzer on an End-user Computer -author: msfttracyp +author: dansimp ms.assetid: 10334800-ff8e-43ac-a9c2-d28807473ec2 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md b/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md index ef8ed9be21..d617ce9d88 100644 --- a/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md +++ b/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md @@ -1,7 +1,7 @@ --- title: How to Use a PowerShell Script to Create the Recovery Image description: How to Use a PowerShell Script to Create the Recovery Image -author: msfttracyp +author: dansimp ms.assetid: cf5b0814-71a8-4f0b-b1f1-1ac6d8b51c4f ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/index.md b/mdop/dart-v10/index.md index ca199090fb..5d88fce5c0 100644 --- a/mdop/dart-v10/index.md +++ b/mdop/dart-v10/index.md @@ -1,7 +1,7 @@ --- title: Diagnostics and Recovery Toolset 10 description: Diagnostics and Recovery Toolset 10 -author: jamiejdt +author: dansimp ms.assetid: 64403eca-ff05-4327-ac33-bdcc96e706c8 ms.pagetype: mdop ms.mktglfcycl: support diff --git a/mdop/dart-v10/operations-for-dart-10.md b/mdop/dart-v10/operations-for-dart-10.md index fb618d7c09..553e6af77d 100644 --- a/mdop/dart-v10/operations-for-dart-10.md +++ b/mdop/dart-v10/operations-for-dart-10.md @@ -1,7 +1,7 @@ --- title: Operations for DaRT 10 description: Operations for DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 1776d5ed-96c6-4841-a097-721d8cf5c7f7 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/overview-of-the-tools-in-dart-10.md b/mdop/dart-v10/overview-of-the-tools-in-dart-10.md index 61ca954cfa..badd1ae5d7 100644 --- a/mdop/dart-v10/overview-of-the-tools-in-dart-10.md +++ b/mdop/dart-v10/overview-of-the-tools-in-dart-10.md @@ -1,7 +1,7 @@ --- title: Overview of the Tools in DaRT 10 description: Overview of the Tools in DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 752467dd-b646-4335-82ce-9090d4651f65 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/planning-for-dart-10.md b/mdop/dart-v10/planning-for-dart-10.md index b8b88230b8..c5d2620d01 100644 --- a/mdop/dart-v10/planning-for-dart-10.md +++ b/mdop/dart-v10/planning-for-dart-10.md @@ -1,7 +1,7 @@ --- title: Planning for DaRT 10 description: Planning for DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 2ca0249a-6a9f-4b4e-91f1-f1b34be7b16c ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md b/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md index 0b4856b406..2d2ba6bfb2 100644 --- a/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md +++ b/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md @@ -1,7 +1,7 @@ --- title: Planning How to Save and Deploy the DaRT 10 Recovery Image description: Planning How to Save and Deploy the DaRT 10 Recovery Image -author: msfttracyp +author: dansimp ms.assetid: 9a3e5413-2621-49ce-8bd2-992616691703 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md b/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md index 25cd1696fb..f38768416f 100644 --- a/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md +++ b/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md @@ -1,7 +1,7 @@ --- title: Planning to Create the DaRT 10 Recovery Image description: Planning to Create the DaRT 10 Recovery Image -author: msfttracyp +author: dansimp ms.assetid: a0087d93-b88f-454b-81b2-3c7ce3718023 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/planning-to-deploy-dart-10.md b/mdop/dart-v10/planning-to-deploy-dart-10.md index 8d3571fea4..7b28c7d329 100644 --- a/mdop/dart-v10/planning-to-deploy-dart-10.md +++ b/mdop/dart-v10/planning-to-deploy-dart-10.md @@ -1,7 +1,7 @@ --- title: Planning to Deploy DaRT 10 description: Planning to Deploy DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 32a39e97-a889-4aae-982c-b85cdc3d9134 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/recovering-computers-using-dart-10.md b/mdop/dart-v10/recovering-computers-using-dart-10.md index 1d901afe01..f1a9b0f856 100644 --- a/mdop/dart-v10/recovering-computers-using-dart-10.md +++ b/mdop/dart-v10/recovering-computers-using-dart-10.md @@ -1,7 +1,7 @@ --- title: Recovering Computers Using DaRT 10 description: Recovering Computers Using DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 2ad7fab0-c22d-4171-8b5a-b2b7d7c0ad2d ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/release-notes-for-dart-10.md b/mdop/dart-v10/release-notes-for-dart-10.md index 0308185c37..7fdf8e3d2f 100644 --- a/mdop/dart-v10/release-notes-for-dart-10.md +++ b/mdop/dart-v10/release-notes-for-dart-10.md @@ -1,7 +1,7 @@ --- title: Release Notes for DaRT 10 description: Release Notes for DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: eb996980-f9c4-42cb-bde9-6b3d4b82b58c ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/security-and-privacy-for-dart-10.md b/mdop/dart-v10/security-and-privacy-for-dart-10.md index 93b66f3a76..1e572fc05f 100644 --- a/mdop/dart-v10/security-and-privacy-for-dart-10.md +++ b/mdop/dart-v10/security-and-privacy-for-dart-10.md @@ -1,7 +1,7 @@ --- title: Security and Privacy for DaRT 10 description: Security and Privacy for DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 9ce5d555-c4e9-4482-a147-27b26579c935 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/security-considerations-for-dart-10.md b/mdop/dart-v10/security-considerations-for-dart-10.md index fc0621ba83..e5738d897d 100644 --- a/mdop/dart-v10/security-considerations-for-dart-10.md +++ b/mdop/dart-v10/security-considerations-for-dart-10.md @@ -1,7 +1,7 @@ --- title: Security Considerations for DaRT 10 description: Security Considerations for DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: c653daf1-f12a-4667-98cc-f0c89fa38e3f ms.reviewer: manager: dansimp diff --git a/mdop/dart-v10/troubleshooting-dart-10.md b/mdop/dart-v10/troubleshooting-dart-10.md index 181fef10dd..4f7ed7f393 100644 --- a/mdop/dart-v10/troubleshooting-dart-10.md +++ b/mdop/dart-v10/troubleshooting-dart-10.md @@ -1,7 +1,7 @@ --- title: Troubleshooting DaRT 10 description: Troubleshooting DaRT 10 -author: msfttracyp +author: dansimp ms.assetid: 76d42a00-3f6b-4730-8857-39fe49535d37 ms.reviewer: manager: dansimp diff --git a/mdop/dart-v65.md b/mdop/dart-v65.md index 050094ae6f..2ca38d849e 100644 --- a/mdop/dart-v65.md +++ b/mdop/dart-v65.md @@ -1,7 +1,7 @@ --- title: Diagnostics and Recovery Toolset 6.5 description: Diagnostics and Recovery Toolset 6.5 -author: eavena +author: dansimp ms.pagetype: mdop ms.mktglfcycl: manage ms.sitesec: library diff --git a/mdop/dart-v7/about-dart-70-new-ia.md b/mdop/dart-v7/about-dart-70-new-ia.md index 944c2bd884..11e8f7a440 100644 --- a/mdop/dart-v7/about-dart-70-new-ia.md +++ b/mdop/dart-v7/about-dart-70-new-ia.md @@ -1,7 +1,7 @@ --- title: About DaRT 7.0 description: About DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: 217ffafc-6d73-4b80-88d9-71870460d4ab ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/accessibility-for-dart-70.md b/mdop/dart-v7/accessibility-for-dart-70.md index 5335e76631..c85c2ce05f 100644 --- a/mdop/dart-v7/accessibility-for-dart-70.md +++ b/mdop/dart-v7/accessibility-for-dart-70.md @@ -1,7 +1,7 @@ --- title: Accessibility for DaRT 7.0 description: Accessibility for DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: 41f7bb72-4f1d-44fb-bc3f-8b66557fec2f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md b/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md index 0bb0012fb5..d5b5333691 100644 --- a/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md +++ b/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md @@ -1,7 +1,7 @@ --- title: Creating the DaRT 7.0 Recovery Image description: Creating the DaRT 7.0 Recovery Image -author: msfttracyp +author: dansimp ms.assetid: ebb2ec58-0349-469d-a23f-3f944fe4c1fa ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md b/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md index 2a1c1e2596..c312c985c2 100644 --- a/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md +++ b/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md @@ -1,7 +1,7 @@ --- title: DaRT 7.0 Deployment Checklist description: DaRT 7.0 Deployment Checklist -author: msfttracyp +author: dansimp ms.assetid: 2c68ec15-0624-4a75-8237-05c68b61ad07 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/dart-70-planning-checklist-dart-7.md b/mdop/dart-v7/dart-70-planning-checklist-dart-7.md index 7612462738..eabf1df737 100644 --- a/mdop/dart-v7/dart-70-planning-checklist-dart-7.md +++ b/mdop/dart-v7/dart-70-planning-checklist-dart-7.md @@ -1,7 +1,7 @@ --- title: DaRT 7.0 Planning Checklist description: DaRT 7.0 Planning Checklist -author: msfttracyp +author: dansimp ms.assetid: f97a2318-6597-4774-a854-bb546279a8fd ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/dart-70-supported-configurations-dart-7.md b/mdop/dart-v7/dart-70-supported-configurations-dart-7.md index 0bff4cebfc..19a84f8d6d 100644 --- a/mdop/dart-v7/dart-70-supported-configurations-dart-7.md +++ b/mdop/dart-v7/dart-70-supported-configurations-dart-7.md @@ -1,7 +1,7 @@ --- title: DaRT 7.0 Supported Configurations description: DaRT 7.0 Supported Configurations -author: msfttracyp +author: dansimp ms.assetid: e9ee87b0-3254-4625-b178-17b2f5b8f8c8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/deploying-dart-70-new-ia.md b/mdop/dart-v7/deploying-dart-70-new-ia.md index 455cfa5388..7f4c348ffb 100644 --- a/mdop/dart-v7/deploying-dart-70-new-ia.md +++ b/mdop/dart-v7/deploying-dart-70-new-ia.md @@ -1,7 +1,7 @@ --- title: Deploying DaRT 7.0 description: Deploying DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: 7bc99bce-b94f-4074-ba88-986ed76f8a6c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md b/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md index fa4f19d3d6..36d8f9c3e8 100644 --- a/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md +++ b/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md @@ -1,7 +1,7 @@ --- title: Deploying DaRT 7.0 to Administrator Computers description: Deploying DaRT 7.0 to Administrator Computers -author: msfttracyp +author: dansimp ms.assetid: 8baf26aa-b168-463c-810f-a165918b9d9f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md b/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md index fe84a514e2..aa6254e9df 100644 --- a/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md +++ b/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md @@ -1,7 +1,7 @@ --- title: Deploying the DaRT 7.0 Recovery Image description: Deploying the DaRT 7.0 Recovery Image -author: msfttracyp +author: dansimp ms.assetid: 6bba7bff-800f-44e4-bcfc-e143115607ca ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md b/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md index 77afc0423f..58e2665ca5 100644 --- a/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md +++ b/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md @@ -1,7 +1,7 @@ --- title: Diagnosing System Failures with Crash Analyzer description: Diagnosing System Failures with Crash Analyzer -author: msfttracyp +author: dansimp ms.assetid: 170d40ef-4edb-4a32-a349-c285c0ea5e56 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/getting-started-with-dart-70-new-ia.md b/mdop/dart-v7/getting-started-with-dart-70-new-ia.md index ac081ea5fb..576bc94e50 100644 --- a/mdop/dart-v7/getting-started-with-dart-70-new-ia.md +++ b/mdop/dart-v7/getting-started-with-dart-70-new-ia.md @@ -1,7 +1,7 @@ --- title: Getting Started with DaRT 7.0 description: Getting Started with DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: 796f52ce-0935-4d3d-9437-289b4c7b16c3 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md b/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md index a6b4c35913..efa405245e 100644 --- a/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md +++ b/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md @@ -1,7 +1,7 @@ --- title: How to Change, Repair, or Remove DaRT 7.0 description: How to Change, Repair, or Remove DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: a65ff4f3-2b6d-4105-a7a0-67c87e8e7300 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md b/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md index cadfb77d47..e5172164b5 100644 --- a/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md +++ b/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md @@ -1,7 +1,7 @@ --- title: How to Create a Time Limited Recovery Image description: How to Create a Time Limited Recovery Image -author: msfttracyp +author: dansimp ms.assetid: d2e29cac-c24c-4239-997f-0320b8a830ae ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/how-to-deploy-dart-70.md b/mdop/dart-v7/how-to-deploy-dart-70.md index 32254f2c60..2eaec78452 100644 --- a/mdop/dart-v7/how-to-deploy-dart-70.md +++ b/mdop/dart-v7/how-to-deploy-dart-70.md @@ -1,7 +1,7 @@ --- title: How to Deploy DaRT 7.0 description: How to Deploy DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: 30522441-40cb-4eca-99b4-dff758f5c647 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md index ec9f029614..f3c6234fce 100644 --- a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md +++ b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md @@ -1,7 +1,7 @@ --- title: How to Deploy the DaRT Recovery Image as a Remote Partition description: How to Deploy the DaRT Recovery Image as a Remote Partition -author: msfttracyp +author: dansimp ms.assetid: 757c9340-8eac-42e8-85de-4302e436713a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md index bb9b4e45b5..7484daf808 100644 --- a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md +++ b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md @@ -1,7 +1,7 @@ --- title: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition description: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -author: msfttracyp +author: dansimp ms.assetid: 462f2d08-f03b-4a07-b2d3-c69205dc6f70 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md index 8c9ec4eebf..6f2b4bfdc4 100644 --- a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md +++ b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md @@ -1,7 +1,7 @@ --- title: How to Deploy the DaRT Recovery Image Using a USB Flash Drive description: How to Deploy the DaRT Recovery Image Using a USB Flash Drive -author: msfttracyp +author: dansimp ms.assetid: 5b7aa843-731e-47e7-b5f9-48d08da732d6 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md b/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md index 04e664b006..003b9a25dd 100644 --- a/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md +++ b/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md @@ -1,7 +1,7 @@ --- title: How to Ensure that Crash Analyzer Can Access Symbol Files description: How to Ensure that Crash Analyzer Can Access Symbol Files -author: msfttracyp +author: dansimp ms.assetid: 150a2f88-68a5-40eb-8471-e5008488ab6e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md b/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md index f24b5b6941..aab5c32455 100644 --- a/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md +++ b/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md @@ -1,7 +1,7 @@ --- title: How to Recover Local Computers Using the DaRT Recovery Image description: How to Recover Local Computers Using the DaRT Recovery Image -author: msfttracyp +author: dansimp ms.assetid: be29b5a8-be08-4cf2-822e-77a51d3f3b65 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md b/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md index d8cdbc0ab0..42b1d76476 100644 --- a/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md +++ b/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md @@ -1,7 +1,7 @@ --- title: How to Recover Remote Computers Using the DaRT Recovery Image description: How to Recover Remote Computers Using the DaRT Recovery Image -author: msfttracyp +author: dansimp ms.assetid: 66bc45fb-dc40-4d47-b583-5bb1ff5c97a7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md b/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md index 2000d0e0f8..1bff3cde3b 100644 --- a/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md +++ b/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md @@ -1,7 +1,7 @@ --- title: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer description: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -author: msfttracyp +author: dansimp ms.assetid: 881d573f-2f18-4c5f-838e-2f5320179f94 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md b/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md index 4a03441b10..d2fa4e6cfd 100644 --- a/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md +++ b/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md @@ -1,7 +1,7 @@ --- title: How to Run the Crash Analyzer on an End-user Computer description: How to Run the Crash Analyzer on an End-user Computer -author: msfttracyp +author: dansimp ms.assetid: 40af4ead-6588-4a81-8eaa-3dc00c397e1d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md b/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md index 64a13002bc..c92cd507c9 100644 --- a/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md +++ b/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md @@ -1,7 +1,7 @@ --- title: How to Use the DaRT Recovery Image Wizard to Create the Recovery Image description: How to Use the DaRT Recovery Image Wizard to Create the Recovery Image -author: msfttracyp +author: dansimp ms.assetid: 1b8ef983-fff9-4d75-a2f6-53120c5c00c9 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v7/index.md b/mdop/dart-v7/index.md index 9dfe1fceaf..ba12a07c9d 100644 --- a/mdop/dart-v7/index.md +++ b/mdop/dart-v7/index.md @@ -1,12 +1,12 @@ --- title: Diagnostics and Recovery Toolset 7 Administrator's Guide description: Diagnostics and Recovery Toolset 7 Administrator's Guide -author: jamiejdt +author: dansimp ms.assetid: bf89eccd-fc03-48ff-9019-a8640e11dd99 ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 04/19/2017 --- diff --git a/mdop/dart-v7/operations-for-dart-70-new-ia.md b/mdop/dart-v7/operations-for-dart-70-new-ia.md index 4ab261ebe1..82e9a6262f 100644 --- a/mdop/dart-v7/operations-for-dart-70-new-ia.md +++ b/mdop/dart-v7/operations-for-dart-70-new-ia.md @@ -1,7 +1,7 @@ --- title: Operations for DaRT 7.0 description: Operations for DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: 5566d817-fc14-4408-ba01-1d87fbc132d9 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md b/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md index ccd74f662c..ca1639268e 100644 --- a/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md +++ b/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md @@ -1,7 +1,7 @@ --- title: Overview of the Tools in DaRT 7.0 description: Overview of the Tools in DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: 67c5991e-cbe6-4ce9-9fe5-f1761369d1fe ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/planning-for-dart-70-new-ia.md b/mdop/dart-v7/planning-for-dart-70-new-ia.md index d4227b88d2..45d4cba004 100644 --- a/mdop/dart-v7/planning-for-dart-70-new-ia.md +++ b/mdop/dart-v7/planning-for-dart-70-new-ia.md @@ -1,7 +1,7 @@ --- title: Planning for DaRT 7.0 description: Planning for DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: 9a60cb08-5efb-40fe-b1e3-9ece831f3b43 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md b/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md index f99585b92a..13a06edae1 100644 --- a/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md +++ b/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md @@ -1,7 +1,7 @@ --- title: Planning How to Save and Deploy the DaRT 7.0 Recovery Image description: Planning How to Save and Deploy the DaRT 7.0 Recovery Image -author: msfttracyp +author: dansimp ms.assetid: d96e9363-6186-4fc3-9b83-ba15ed9694a5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md b/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md index 7c19fc8845..76cdbc0311 100644 --- a/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md +++ b/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md @@ -1,7 +1,7 @@ --- title: Planning to Create the DaRT 7.0 Recovery Image description: Planning to Create the DaRT 7.0 Recovery Image -author: msfttracyp +author: dansimp ms.assetid: e5d49bee-ae4e-467b-9976-c1203f6355f9 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v7/planning-to-deploy-dart-70.md b/mdop/dart-v7/planning-to-deploy-dart-70.md index f1f21b158b..7ba9191fd7 100644 --- a/mdop/dart-v7/planning-to-deploy-dart-70.md +++ b/mdop/dart-v7/planning-to-deploy-dart-70.md @@ -1,7 +1,7 @@ --- title: Planning to Deploy DaRT 7.0 description: Planning to Deploy DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: 05e97cdb-a8c2-46e4-9c75-a7d12fe26fe8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md b/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md index 35e35b8a3e..b88da85ccc 100644 --- a/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md +++ b/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md @@ -1,7 +1,7 @@ --- title: Recovering Computers Using DaRT 7.0 description: Recovering Computers Using DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: bcded7ca-237b-4971-ac34-4394b05cbc50 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/release-notes-for-dart-70-new-ia.md b/mdop/dart-v7/release-notes-for-dart-70-new-ia.md index 87506ac590..23e9fb82bb 100644 --- a/mdop/dart-v7/release-notes-for-dart-70-new-ia.md +++ b/mdop/dart-v7/release-notes-for-dart-70-new-ia.md @@ -1,7 +1,7 @@ --- title: Release Notes for DaRT 7.0 description: Release Notes for DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: fad227d0-5c22-4efd-9187-0e5922f7250b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md b/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md index 7d51161f65..25be976fde 100644 --- a/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md +++ b/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md @@ -1,7 +1,7 @@ --- title: Security Considerations for DaRT 7.0 description: Security Considerations for DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: 52ad7e6c-c169-4ba4-aa76-56335a585eb8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md b/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md index 70e1a1fba6..9858906b24 100644 --- a/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md +++ b/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md @@ -1,7 +1,7 @@ --- title: Technical Reference for DaRT 7.0 description: Technical Reference for DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: f55c7e5e-713a-42d1-84c9-88370155f934 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v7/troubleshooting-dart-70-new-ia.md b/mdop/dart-v7/troubleshooting-dart-70-new-ia.md index 5e1d37af9e..5ed44e7e05 100644 --- a/mdop/dart-v7/troubleshooting-dart-70-new-ia.md +++ b/mdop/dart-v7/troubleshooting-dart-70-new-ia.md @@ -1,7 +1,7 @@ --- title: Troubleshooting DaRT 7.0 description: Troubleshooting DaRT 7.0 -author: msfttracyp +author: dansimp ms.assetid: 24c50efa-e9ac-45c4-aca2-b1dcfe834fdd ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/about-dart-80-dart-8.md b/mdop/dart-v8/about-dart-80-dart-8.md index 7de3d83f67..5c87367d20 100644 --- a/mdop/dart-v8/about-dart-80-dart-8.md +++ b/mdop/dart-v8/about-dart-80-dart-8.md @@ -1,7 +1,7 @@ --- title: About DaRT 8.0 description: About DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: ce91efd6-7d78-44cb-bb8f-1f43f768ebaa ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/about-dart-80-sp1.md b/mdop/dart-v8/about-dart-80-sp1.md index 9a2cf5c3a0..3ccade84b6 100644 --- a/mdop/dart-v8/about-dart-80-sp1.md +++ b/mdop/dart-v8/about-dart-80-sp1.md @@ -1,7 +1,7 @@ --- title: About DaRT 8.0 SP1 description: About DaRT 8.0 SP1 -author: msfttracyp +author: dansimp ms.assetid: 2e166444-4097-4b23-9f50-d8819f1f4960 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/about-dart-81.md b/mdop/dart-v8/about-dart-81.md index a2d81ba1e5..b91ed2b3f4 100644 --- a/mdop/dart-v8/about-dart-81.md +++ b/mdop/dart-v8/about-dart-81.md @@ -1,7 +1,7 @@ --- title: About DaRT 8.1 description: About DaRT 8.1 -author: msfttracyp +author: dansimp ms.assetid: dcaddc57-0111-4a9d-8be9-f5ada0eefa7d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/accessibility-for-dart-80-dart-8.md b/mdop/dart-v8/accessibility-for-dart-80-dart-8.md index 936d93ea7d..ce54a3a916 100644 --- a/mdop/dart-v8/accessibility-for-dart-80-dart-8.md +++ b/mdop/dart-v8/accessibility-for-dart-80-dart-8.md @@ -1,7 +1,7 @@ --- title: Accessibility for DaRT 8.0 description: Accessibility for DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: 95f426de-222c-4ec0-9b9b-af817c7fff9b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md b/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md index d400b3bd5d..7e837ccffc 100644 --- a/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md +++ b/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md @@ -1,7 +1,7 @@ --- title: Administering DaRT 8.0 Using PowerShell description: Administering DaRT 8.0 Using PowerShell -author: msfttracyp +author: dansimp ms.assetid: 776430e0-d5c9-4919-877a-fab503451b37 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md b/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md index 0dfd0b39f2..be944c9ff8 100644 --- a/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md +++ b/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md @@ -1,7 +1,7 @@ --- title: Creating the DaRT 8.0 Recovery Image description: Creating the DaRT 8.0 Recovery Image -author: msfttracyp +author: dansimp ms.assetid: 39001b8e-86c0-45ef-8f34-2d6199f9922d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/21/2017 --- diff --git a/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md b/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md index eca291304a..a3ef35e300 100644 --- a/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md +++ b/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md @@ -1,7 +1,7 @@ --- title: DaRT 8.0 Deployment Checklist description: DaRT 8.0 Deployment Checklist -author: msfttracyp +author: dansimp ms.assetid: 74e071fb-697c-463f-adce-d09b8d86495f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/dart-80-planning-checklist-dart-8.md b/mdop/dart-v8/dart-80-planning-checklist-dart-8.md index 7e29d01395..d9994dd3cc 100644 --- a/mdop/dart-v8/dart-80-planning-checklist-dart-8.md +++ b/mdop/dart-v8/dart-80-planning-checklist-dart-8.md @@ -1,7 +1,7 @@ --- title: DaRT 8.0 Planning Checklist description: DaRT 8.0 Planning Checklist -author: msfttracyp +author: dansimp ms.assetid: 0a0f5a71-b1d6-424c-8174-fc5aad506928 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/dart-80-privacy-statement-dart-8.md b/mdop/dart-v8/dart-80-privacy-statement-dart-8.md index 3446e85228..1adbc23901 100644 --- a/mdop/dart-v8/dart-80-privacy-statement-dart-8.md +++ b/mdop/dart-v8/dart-80-privacy-statement-dart-8.md @@ -1,7 +1,7 @@ --- title: DaRT 8.0 Privacy Statement description: DaRT 8.0 Privacy Statement -author: msfttracyp +author: dansimp ms.assetid: db474241-e44e-4bca-9be4-3557a3614c2a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/dart-80-supported-configurations-dart-8.md b/mdop/dart-v8/dart-80-supported-configurations-dart-8.md index 1498448738..f79919bdd4 100644 --- a/mdop/dart-v8/dart-80-supported-configurations-dart-8.md +++ b/mdop/dart-v8/dart-80-supported-configurations-dart-8.md @@ -1,7 +1,7 @@ --- title: DaRT 8.0 Supported Configurations description: DaRT 8.0 Supported Configurations -author: msfttracyp +author: dansimp ms.assetid: 95d68e5c-d202-4f4a-adef-d2098328172e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/deploying-dart-80-dart-8.md b/mdop/dart-v8/deploying-dart-80-dart-8.md index 36e9c02d25..253b69e28d 100644 --- a/mdop/dart-v8/deploying-dart-80-dart-8.md +++ b/mdop/dart-v8/deploying-dart-80-dart-8.md @@ -1,7 +1,7 @@ --- title: Deploying DaRT 8.0 description: Deploying DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: 5a976d4e-3372-4ef6-9095-1b48e99af21b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md b/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md index ecd56e83ee..e29f368dde 100644 --- a/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md +++ b/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md @@ -1,7 +1,7 @@ --- title: Deploying DaRT 8.0 to Administrator Computers description: Deploying DaRT 8.0 to Administrator Computers -author: msfttracyp +author: dansimp ms.assetid: f918ead8-742e-464a-8bf6-1fcedde66cae ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md b/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md index 99ebca995c..d06c1d699d 100644 --- a/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md +++ b/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md @@ -1,7 +1,7 @@ --- title: Deploying the DaRT Recovery Image description: Deploying the DaRT Recovery Image -author: msfttracyp +author: dansimp ms.assetid: df5cb54a-be8c-4ed2-89ea-d3c67c2ef4d4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md b/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md index d5e3945dc8..93d1cee294 100644 --- a/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md +++ b/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md @@ -1,7 +1,7 @@ --- title: Diagnosing System Failures with Crash Analyzer description: Diagnosing System Failures with Crash Analyzer -author: msfttracyp +author: dansimp ms.assetid: ce3d3186-54fb-45b2-b5ce-9bb7841db28f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/getting-started-with-dart-80-dart-8.md b/mdop/dart-v8/getting-started-with-dart-80-dart-8.md index faa25ee39e..f65f99da45 100644 --- a/mdop/dart-v8/getting-started-with-dart-80-dart-8.md +++ b/mdop/dart-v8/getting-started-with-dart-80-dart-8.md @@ -1,7 +1,7 @@ --- title: Getting Started with DaRT 8.0 description: Getting Started with DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: 579d18c5-7434-4a0e-9725-fb81ca5e3c6d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md b/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md index 0e90caab1d..2ec61410a0 100644 --- a/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md +++ b/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md @@ -1,7 +1,7 @@ --- title: How to Change, Repair, or Remove DaRT 8.0 description: How to Change, Repair, or Remove DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: a9737635-aaf5-45bd-861f-f9dff4f02336 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md b/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md index e31d87e179..a569e0ab61 100644 --- a/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md +++ b/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md @@ -1,7 +1,7 @@ --- title: How to Deploy DaRT 8.0 description: How to Deploy DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: ab772e7a-c02f-4847-acdf-8bd362769a77 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md b/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md index a717b3888e..e9ff959654 100644 --- a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md +++ b/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md @@ -1,7 +1,7 @@ --- title: How to Deploy the DaRT Recovery Image as a Remote Partition description: How to Deploy the DaRT Recovery Image as a Remote Partition -author: msfttracyp +author: dansimp ms.assetid: 58f4a6c6-6193-42bd-a095-0de868711af9 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md b/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md index c5d594b59c..e79d234f3a 100644 --- a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md +++ b/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md @@ -1,7 +1,7 @@ --- title: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition description: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition -author: msfttracyp +author: dansimp ms.assetid: 07c5d539-51d9-4759-adc7-72b40d5d7bb3 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md b/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md index afe2d17d1b..15135b16d0 100644 --- a/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md +++ b/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md @@ -1,7 +1,7 @@ --- title: How to Ensure that Crash Analyzer Can Access Symbol Files description: How to Ensure that Crash Analyzer Can Access Symbol Files -author: msfttracyp +author: dansimp ms.assetid: 99839013-1cd8-44d1-8484-0e15261c5a4b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md b/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md index c36fc90c84..7036e2173b 100644 --- a/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md +++ b/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md @@ -1,7 +1,7 @@ --- title: How to Perform DaRT Tasks by Using PowerShell Commands description: How to Perform DaRT Tasks by Using PowerShell Commands -author: msfttracyp +author: dansimp ms.assetid: bc788b00-38c7-4f57-a832-916b68264d89 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md b/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md index dca11766bc..76ac2f9600 100644 --- a/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md +++ b/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md @@ -1,7 +1,7 @@ --- title: How to Recover Local Computers by Using the DaRT Recovery Image description: How to Recover Local Computers by Using the DaRT Recovery Image -author: msfttracyp +author: dansimp ms.assetid: f679d522-49ab-429c-93d0-294c3f3e5639 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md b/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md index 5cf1247cb4..da40c73d47 100644 --- a/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md +++ b/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md @@ -1,7 +1,7 @@ --- title: How to Recover Remote Computers by Using the DaRT Recovery Image description: How to Recover Remote Computers by Using the DaRT Recovery Image -author: msfttracyp +author: dansimp ms.assetid: 363ccd48-6820-4b5b-a43a-323c0b208a9d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md b/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md index ad3b05cceb..2f82d060f4 100644 --- a/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md +++ b/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md @@ -1,7 +1,7 @@ --- title: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer description: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer -author: msfttracyp +author: dansimp ms.assetid: b2f87144-6379-478a-802b-9cfef5242f34 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md b/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md index c50f8d1d66..bcd43d11d1 100644 --- a/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md +++ b/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md @@ -1,7 +1,7 @@ --- title: How to Run the Crash Analyzer on an End-user Computer description: How to Run the Crash Analyzer on an End-user Computer -author: msfttracyp +author: dansimp ms.assetid: d36213e5-7719-44d7-be65-971c3ef7df2c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md b/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md index 34c8202a73..5ea2ed4af5 100644 --- a/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md +++ b/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md @@ -1,7 +1,7 @@ --- title: How to Use a PowerShell Script to Create the Recovery Image description: How to Use a PowerShell Script to Create the Recovery Image -author: msfttracyp +author: dansimp ms.assetid: d0c71092-535e-43b1-9b1d-6ac819508348 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/index.md b/mdop/dart-v8/index.md index 4f39c5a258..bcee6aaf64 100644 --- a/mdop/dart-v8/index.md +++ b/mdop/dart-v8/index.md @@ -1,12 +1,12 @@ --- title: Diagnostics and Recovery Toolset 8 Administrator's Guide description: Diagnostics and Recovery Toolset 8 Administrator's Guide -author: jamiejdt +author: dansimp ms.assetid: 33685dd7-844f-4864-b504-3ef384ef01de ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 04/19/2017 --- diff --git a/mdop/dart-v8/microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md b/mdop/dart-v8/microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md index 78b6e42da3..8d28155d2c 100644 --- a/mdop/dart-v8/microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md +++ b/mdop/dart-v8/microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md @@ -1,7 +1,7 @@ --- title: Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection description: Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection -author: msfttracyp +author: dansimp ms.assetid: 59678283-4b44-4d02-ba8f-0e7315efd5d1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/operations-for-dart-80-dart-8.md b/mdop/dart-v8/operations-for-dart-80-dart-8.md index c495ff0ffd..8b4d4064ac 100644 --- a/mdop/dart-v8/operations-for-dart-80-dart-8.md +++ b/mdop/dart-v8/operations-for-dart-80-dart-8.md @@ -1,7 +1,7 @@ --- title: Operations for DaRT 8.0 description: Operations for DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: a31615de-eb6e-41af-909c-d0b6f3eb3f2f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md b/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md index 7cffb8401b..4939913f2a 100644 --- a/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md +++ b/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md @@ -1,7 +1,7 @@ --- title: Overview of the Tools in DaRT 8.0 description: Overview of the Tools in DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: 1766c82e-c099-47d4-b186-4689b026a7e0 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/planning-for-dart-80-dart-8.md b/mdop/dart-v8/planning-for-dart-80-dart-8.md index a7ab30d88b..8c62020a06 100644 --- a/mdop/dart-v8/planning-for-dart-80-dart-8.md +++ b/mdop/dart-v8/planning-for-dart-80-dart-8.md @@ -1,7 +1,7 @@ --- title: Planning for DaRT 8.0 description: Planning for DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: c8be3ab3-dc54-43b9-b9ff-fbd5e1ef29a7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md b/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md index 4f95c0b2fa..4886b9d80d 100644 --- a/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md +++ b/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md @@ -1,7 +1,7 @@ --- title: Planning How to Save and Deploy the DaRT 8.0 Recovery Image description: Planning How to Save and Deploy the DaRT 8.0 Recovery Image -author: msfttracyp +author: dansimp ms.assetid: 939fbe17-0e30-4c85-8782-5b84d69442a7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md b/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md index 4acce8e180..4da66bd3aa 100644 --- a/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md +++ b/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md @@ -1,7 +1,7 @@ --- title: Planning to Create the DaRT 8.0 Recovery Image description: Planning to Create the DaRT 8.0 Recovery Image -author: msfttracyp +author: dansimp ms.assetid: cfd0e1e2-c379-4460-b545-3f7be9f33583 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md b/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md index 60c6e5d180..dffa452027 100644 --- a/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md +++ b/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md @@ -1,7 +1,7 @@ --- title: Planning to Deploy DaRT 8.0 description: Planning to Deploy DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: 36f2babb-9ac5-4ea2-932c-12c6211f5be2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md b/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md index 10b50735d0..3c321dd003 100644 --- a/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md +++ b/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md @@ -1,7 +1,7 @@ --- title: Recovering Computers Using DaRT 8.0 description: Recovering Computers Using DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: 0caeb7d9-c1e6-4f32-bc27-157b91630989 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/release-notes-for-dart-80--dart-8.md b/mdop/dart-v8/release-notes-for-dart-80--dart-8.md index 7ec6427eb0..31b1b71c8c 100644 --- a/mdop/dart-v8/release-notes-for-dart-80--dart-8.md +++ b/mdop/dart-v8/release-notes-for-dart-80--dart-8.md @@ -1,7 +1,7 @@ --- title: Release Notes for DaRT 8.0 description: Release Notes for DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: e8b373c8-7aa5-4930-a8f9-743d26145dad ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/release-notes-for-dart-80-sp1.md b/mdop/dart-v8/release-notes-for-dart-80-sp1.md index 4807afe2a9..15d2ce4009 100644 --- a/mdop/dart-v8/release-notes-for-dart-80-sp1.md +++ b/mdop/dart-v8/release-notes-for-dart-80-sp1.md @@ -1,7 +1,7 @@ --- title: Release Notes for DaRT 8.0 SP1 description: Release Notes for DaRT 8.0 SP1 -author: msfttracyp +author: dansimp ms.assetid: fa7512d8-fb00-4c27-8f65-c15f3a8ff1cc ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/release-notes-for-dart-81.md b/mdop/dart-v8/release-notes-for-dart-81.md index ed24c12ba0..05c3ced9ce 100644 --- a/mdop/dart-v8/release-notes-for-dart-81.md +++ b/mdop/dart-v8/release-notes-for-dart-81.md @@ -1,7 +1,7 @@ --- title: Release Notes for DaRT 8.1 description: Release Notes for DaRT 8.1 -author: msfttracyp +author: dansimp ms.assetid: 44303107-60f4-485c-848a-7e0529f142d4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/security-and-privacy-for-dart-80-dart-8.md b/mdop/dart-v8/security-and-privacy-for-dart-80-dart-8.md index 2cfe65b9fa..17a4641be1 100644 --- a/mdop/dart-v8/security-and-privacy-for-dart-80-dart-8.md +++ b/mdop/dart-v8/security-and-privacy-for-dart-80-dart-8.md @@ -1,7 +1,7 @@ --- title: Security and Privacy for DaRT 8.0 description: Security and Privacy for DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: 668188fc-d9e9-4607-b90a-9e50bf53bc88 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/security-considerations-for-dart-80--dart-8.md b/mdop/dart-v8/security-considerations-for-dart-80--dart-8.md index c89debf994..1899542b1e 100644 --- a/mdop/dart-v8/security-considerations-for-dart-80--dart-8.md +++ b/mdop/dart-v8/security-considerations-for-dart-80--dart-8.md @@ -1,7 +1,7 @@ --- title: Security Considerations for DaRT 8.0 description: Security Considerations for DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: 45ef8164-fee7-41a1-9a36-de4e3264e7a8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md b/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md index 98189c70c5..fb98efd9d0 100644 --- a/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md +++ b/mdop/dart-v8/technical-reference-for-dart-80-new-ia.md @@ -1,7 +1,7 @@ --- title: Technical Reference for DaRT 8.0 description: Technical Reference for DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: 1d0bf98b-b56b-4ce6-ad19-eb85e1ff1287 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/dart-v8/troubleshooting-dart-80-dart-8.md b/mdop/dart-v8/troubleshooting-dart-80-dart-8.md index d801caa77c..1e1dd715ba 100644 --- a/mdop/dart-v8/troubleshooting-dart-80-dart-8.md +++ b/mdop/dart-v8/troubleshooting-dart-80-dart-8.md @@ -1,7 +1,7 @@ --- title: Troubleshooting DaRT 8.0 description: Troubleshooting DaRT 8.0 -author: msfttracyp +author: dansimp ms.assetid: 0444a390-3251-47f4-b6c8-828d4a2e8af4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop ms.mktglfcycl: support ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/docfx.json b/mdop/docfx.json index f825997a00..252c242145 100644 --- a/mdop/docfx.json +++ b/mdop/docfx.json @@ -24,7 +24,12 @@ "globalMetadata": { "breadcrumb_path": "/microsoft-desktop-optimization-pack/breadcrumb/toc.json", "ROBOTS": "INDEX, FOLLOW", - "ms.technology": "mdop", + "ms.technology": "windows", + "audience": "ITPro", + "manager": "dansimp", + "ms.prod": "w10", + "ms.author": "dansimp", + "author": "dansimp", "ms.sitesec": "library", "ms.topic": "article", "ms.date": "04/05/2017", diff --git a/mdop/index.md b/mdop/index.md index 78fffc67fd..93ce634a80 100644 --- a/mdop/index.md +++ b/mdop/index.md @@ -2,7 +2,7 @@ title: MDOP Information Experience description: MDOP Information Experience ms.assetid: 12b8ab56-3267-450d-bb22-1c7e44cb8e52 -author: jamiejdt +author: dansimp ms.pagetype: mdop ms.mktglfcycl: manage ms.sitesec: library diff --git a/mdop/mbam-v1/about-mbam-10.md b/mdop/mbam-v1/about-mbam-10.md index 6649ff16d7..ca1ac44277 100644 --- a/mdop/mbam-v1/about-mbam-10.md +++ b/mdop/mbam-v1/about-mbam-10.md @@ -1,7 +1,7 @@ --- title: About MBAM 1.0 description: About MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: 99254aaa-2b30-4b2e-8365-0d4b67a89a0c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/accessibility-for-mbam-10.md b/mdop/mbam-v1/accessibility-for-mbam-10.md index 6e772a734a..d1622daf4f 100644 --- a/mdop/mbam-v1/accessibility-for-mbam-10.md +++ b/mdop/mbam-v1/accessibility-for-mbam-10.md @@ -1,7 +1,7 @@ --- title: Accessibility for MBAM 1.0 description: Accessibility for MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: 5c1bf1a3-76cf-458c-ac4a-cd343aace4de ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md b/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md index 11d991351f..045a75049c 100644 --- a/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md +++ b/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md @@ -1,7 +1,7 @@ --- title: Administering MBAM 1.0 by Using PowerShell description: Administering MBAM 1.0 by Using PowerShell -author: msfttracyp +author: dansimp ms.assetid: 3bf2eca5-4ab7-4e84-9e80-c0c7d709647b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/administering-mbam-10-features.md b/mdop/mbam-v1/administering-mbam-10-features.md index 86fabb6cde..d4ffc956e4 100644 --- a/mdop/mbam-v1/administering-mbam-10-features.md +++ b/mdop/mbam-v1/administering-mbam-10-features.md @@ -1,7 +1,7 @@ --- title: Administering MBAM 1.0 Features description: Administering MBAM 1.0 Features -author: msfttracyp +author: dansimp ms.assetid: dd9a9eff-f1ad-4af3-85d9-c19131a4ad22 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md b/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md index c6d78bd71f..43a045b042 100644 --- a/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md +++ b/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md @@ -1,7 +1,7 @@ --- title: Deploying MBAM 1.0 Group Policy Objects description: Deploying MBAM 1.0 Group Policy Objects -author: msfttracyp +author: dansimp ms.assetid: 2129291e-d2b2-41ed-b643-1e311c49fee7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/deploying-mbam-10.md b/mdop/mbam-v1/deploying-mbam-10.md index 9c54063330..738c0a8cf5 100644 --- a/mdop/mbam-v1/deploying-mbam-10.md +++ b/mdop/mbam-v1/deploying-mbam-10.md @@ -1,7 +1,7 @@ --- title: Deploying MBAM 1.0 description: Deploying MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: ff952ed6-08b2-4ed0-97b8-bf89f22cccbc ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/deploying-the-mbam-10-client.md b/mdop/mbam-v1/deploying-the-mbam-10-client.md index 3b9f55c539..2ea9421631 100644 --- a/mdop/mbam-v1/deploying-the-mbam-10-client.md +++ b/mdop/mbam-v1/deploying-the-mbam-10-client.md @@ -1,7 +1,7 @@ --- title: Deploying the MBAM 1.0 Client description: Deploying the MBAM 1.0 Client -author: msfttracyp +author: dansimp ms.assetid: f7ca233f-5035-4ff9-ab3a-f2453b4929d1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md b/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md index 1cf2e31d54..e78020f8c7 100644 --- a/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md +++ b/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md @@ -1,7 +1,7 @@ --- title: Deploying the MBAM 1.0 Language Release Update description: Deploying the MBAM 1.0 Language Release Update -author: msfttracyp +author: dansimp ms.assetid: 9dbd85c3-e470-4752-a90f-25754dd46dab ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md b/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md index 55c227b364..271902cccb 100644 --- a/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md +++ b/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md @@ -1,7 +1,7 @@ --- title: Deploying the MBAM 1.0 Server Infrastructure description: Deploying the MBAM 1.0 Server Infrastructure -author: msfttracyp +author: dansimp ms.assetid: 90529379-b70e-4c92-b188-3d7aaf1844af ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/evaluating-mbam-10.md b/mdop/mbam-v1/evaluating-mbam-10.md index a610d18cea..fdca62c06c 100644 --- a/mdop/mbam-v1/evaluating-mbam-10.md +++ b/mdop/mbam-v1/evaluating-mbam-10.md @@ -1,7 +1,7 @@ --- title: Evaluating MBAM 1.0 description: Evaluating MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: a1e2b674-eda9-4e1c-9b4c-e748470c71f2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/getting-started-with-mbam-10.md b/mdop/mbam-v1/getting-started-with-mbam-10.md index b54f281bf6..bea99f0a2d 100644 --- a/mdop/mbam-v1/getting-started-with-mbam-10.md +++ b/mdop/mbam-v1/getting-started-with-mbam-10.md @@ -1,7 +1,7 @@ --- title: Getting Started with MBAM 1.0 description: Getting Started with MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: 4fab4e4a-d25e-4661-b235-2b45bf5ac3e4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/high-availability-for-mbam-10.md b/mdop/mbam-v1/high-availability-for-mbam-10.md index a7f2f2a89a..5ed4167fde 100644 --- a/mdop/mbam-v1/high-availability-for-mbam-10.md +++ b/mdop/mbam-v1/high-availability-for-mbam-10.md @@ -1,7 +1,7 @@ --- title: High Availability for MBAM 1.0 description: High Availability for MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: 5869ecf8-1056-4c32-aecb-838a37e05d39 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/high-level-architecture-for-mbam-10.md b/mdop/mbam-v1/high-level-architecture-for-mbam-10.md index 73dfbdd35b..0ebd00df60 100644 --- a/mdop/mbam-v1/high-level-architecture-for-mbam-10.md +++ b/mdop/mbam-v1/high-level-architecture-for-mbam-10.md @@ -1,7 +1,7 @@ --- title: High Level Architecture for MBAM 1.0 description: High Level Architecture for MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: b1349196-88ed-4d6c-8a1d-998f18127b6b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md b/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md index a8ca4fbd5c..3d6704eaa2 100644 --- a/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md +++ b/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md @@ -1,7 +1,7 @@ --- title: How to Configure Network Load Balancing for MBAM description: How to Configure Network Load Balancing for MBAM -author: msfttracyp +author: dansimp ms.assetid: df2208c3-352b-4a48-9722-237b0c8cd6a5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md b/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md index d76d6481b6..503daa81b3 100644 --- a/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md +++ b/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Deploy the MBAM Client as Part of a Windows Deployment description: How to Deploy the MBAM Client as Part of a Windows Deployment -author: msfttracyp +author: dansimp ms.assetid: 8704bf33-535d-41da-b9b2-45b60754367e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md b/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md index ec94256a72..e04dee41a9 100644 --- a/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md +++ b/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Deploy the MBAM Client to Desktop or Laptop Computers description: How to Deploy the MBAM Client to Desktop or Laptop Computers -author: msfttracyp +author: dansimp ms.assetid: f32927a2-4c05-4da8-acca-1108d1dfdb7e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md b/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md index 1951352a23..5b8a997a81 100644 --- a/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md +++ b/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Determine the BitLocker Encryption State of a Lost Computers description: How to Determine the BitLocker Encryption State of a Lost Computers -author: msfttracyp +author: dansimp ms.assetid: 9440890a-9c63-463b-9113-f46071446388 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md b/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md index f7b3f615a5..638c95c3ca 100644 --- a/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md +++ b/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md @@ -1,7 +1,7 @@ --- title: How to Edit MBAM 1.0 GPO Settings description: How to Edit MBAM 1.0 GPO Settings -author: msfttracyp +author: dansimp ms.assetid: 03d12fbc-4302-43fc-9b38-440607d778a1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md b/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md index 62464e8014..f8ee9675f3 100644 --- a/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md +++ b/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Generate MBAM Reports description: How to Generate MBAM Reports -author: msfttracyp +author: dansimp ms.assetid: cdf4ae76-040c-447c-8736-c9e57068d221 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md b/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md index d10014b0d2..43b5fda53f 100644 --- a/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md +++ b/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md @@ -1,7 +1,7 @@ --- title: How to Hide Default BitLocker Encryption in The Windows Control Panel description: How to Hide Default BitLocker Encryption in The Windows Control Panel -author: msfttracyp +author: dansimp ms.assetid: c8503743-220c-497c-9785-e2feeca484d6 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md b/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md index 7761a0065c..55e383c7ac 100644 --- a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md +++ b/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Install and Configure MBAM on a Single Server description: How to Install and Configure MBAM on a Single Server -author: msfttracyp +author: dansimp ms.assetid: 55841c63-bad9-44e7-b7fd-ea7037febbd7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md b/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md index 668966c147..d58d1a28b7 100644 --- a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md +++ b/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Install and Configure MBAM on Distributed Servers description: How to Install and Configure MBAM on Distributed Servers -author: msfttracyp +author: dansimp ms.assetid: 9ee766aa-6339-422a-8d00-4f58e4646a5e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md b/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md index ca6defb7b6..825cfe0c61 100644 --- a/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md +++ b/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md @@ -1,7 +1,7 @@ --- title: How to Install the MBAM 1.0 Group Policy Template description: How to Install the MBAM 1.0 Group Policy Template -author: msfttracyp +author: dansimp ms.assetid: 451a50b0-939c-47ad-9248-a138deade550 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md b/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md index 978349f4d2..b425b9d9b2 100644 --- a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md +++ b/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Install the MBAM Language Update on a Single Server description: How to Install the MBAM Language Update on a Single Server -author: msfttracyp +author: dansimp ms.assetid: e6fe59a3-a3e1-455c-a059-1f23ee083cf6 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md b/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md index ec68e9b91a..9c23418768 100644 --- a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md +++ b/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Install the MBAM Language Update on Distributed Servers description: How to Install the MBAM Language Update on Distributed Servers -author: msfttracyp +author: dansimp ms.assetid: 5ddc64c6-0417-4a04-843e-b5e18d9f1a52 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md b/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md index 8dcdf2d88f..649d3d3719 100644 --- a/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md +++ b/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md @@ -1,7 +1,7 @@ --- title: How to Manage Computer BitLocker Encryption Exemptions description: How to Manage Computer BitLocker Encryption Exemptions -author: msfttracyp +author: dansimp ms.assetid: d4400a0d-b36b-4cf5-a294-1f53ec47f9ee ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md b/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md index f8a0500186..b429461024 100644 --- a/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md +++ b/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Manage Hardware Compatibility description: How to Manage Hardware Compatibility -author: msfttracyp +author: dansimp ms.assetid: c74b96b9-8161-49bc-b5bb-4838734e7df5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md b/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md index 7deb0b2e0a..7b1c2917a9 100644 --- a/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md +++ b/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Manage MBAM Administrator Roles description: How to Manage MBAM Administrator Roles -author: msfttracyp +author: dansimp ms.assetid: c0f25a42-dbff-418d-a776-4fe23ee07d16 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md b/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md index 02e890969a..40dd467712 100644 --- a/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md +++ b/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel description: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel -author: msfttracyp +author: dansimp ms.assetid: c08077e1-5529-468f-9370-c3b33fc258f3 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md b/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md index 3116ec7a92..e280f83a10 100644 --- a/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md +++ b/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Manage User BitLocker Encryption Exemptions description: How to Manage User BitLocker Encryption Exemptions -author: msfttracyp +author: dansimp ms.assetid: 48d69721-504f-4524-8a04-b9ce213ac9b4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md b/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md index e0dec01036..437ed73081 100644 --- a/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md +++ b/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md @@ -1,7 +1,7 @@ --- title: How to Move MBAM 1.0 Features to Another Computer description: How to Move MBAM 1.0 Features to Another Computer -author: msfttracyp +author: dansimp ms.assetid: e1907d92-6b42-4ba3-b0e4-60a9cc8285cc ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md b/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md index 4cface3663..078be72832 100644 --- a/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md +++ b/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Recover a Corrupted Drive description: How to Recover a Corrupted Drive -author: msfttracyp +author: dansimp ms.assetid: 715491ae-69c0-4fae-ad3f-3bd19a0db2f2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md b/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md index b1d3a350ea..4b15fb333a 100644 --- a/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md +++ b/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Recover a Drive in Recovery Mode description: How to Recover a Drive in Recovery Mode -author: msfttracyp +author: dansimp ms.assetid: 09d27e4b-57fa-47c7-a004-8b876a49f27e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md b/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md index 094d762b26..849c17e122 100644 --- a/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md +++ b/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Recover a Moved Drive description: How to Recover a Moved Drive -author: msfttracyp +author: dansimp ms.assetid: 0c7199d8-9463-4f44-9af3-b70eceeaff1d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md b/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md index bb5ddfe3f6..59b6761eb8 100644 --- a/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md +++ b/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md @@ -1,7 +1,7 @@ --- title: How to Reset a TPM Lockout description: How to Reset a TPM Lockout -author: msfttracyp +author: dansimp ms.assetid: 91ec6666-1ae2-4e76-9459-ad65c405f639 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/index.md b/mdop/mbam-v1/index.md index f7646af27e..b25186a196 100644 --- a/mdop/mbam-v1/index.md +++ b/mdop/mbam-v1/index.md @@ -1,55 +1,45 @@ --- title: Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide description: Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide -author: jamiejdt +author: dansimp ms.assetid: 4086e721-db24-4439-bdcd-ac5ef901811f ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 04/19/2017 --- - # Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide - Microsoft BitLocker Administration and Monitoring (MBAM) provides a simplified administrative interface that you can use to manage BitLocker drive encryption. With MBAM, you can select BitLocker encryption policy options that are appropriate to your enterprise and then use them to monitor client compliance with those policies. You can also report on the encryption status of an individual computer and on the entire enterprise. In addition, you can access recovery key information when users forget their PIN or password, or when their BIOS or boot record changes. -[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) - -[About MBAM 1.0](about-mbam-10.md)**|**[Evaluating MBAM 1.0](evaluating-mbam-10.md)**|**[High Level Architecture for MBAM 1.0](high-level-architecture-for-mbam-10.md)**|**[Accessibility for MBAM 1.0](accessibility-for-mbam-10.md)**|**[Privacy Statement for MBAM 1.0](privacy-statement-for-mbam-10.md) - -[Planning for MBAM 1.0](planning-for-mbam-10.md) - -[Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md)**|**[MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md)**|**[Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md)**|**[MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md)**|**[MBAM 1.0 Planning Checklist](mbam-10-planning-checklist.md) - -[Deploying MBAM 1.0](deploying-mbam-10.md) - -[Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md)**|**[Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md)**|**[Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md)**|**[Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md)**|**[MBAM 1.0 Deployment Checklist](mbam-10-deployment-checklist.md) - -[Operations for MBAM 1.0](operations-for-mbam-10.md) - -[Administering MBAM 1.0 Features](administering-mbam-10-features.md)**|**[Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md)**|**[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md)**|**[Administering MBAM 1.0 by Using PowerShell](administering-mbam-10-by-using-powershell.md) - -[Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) - -### More Information - -[Release Notes for MBAM 1.0](release-notes-for-mbam-10.md) -View updated product information and known issues for MBAM 1.0. - -[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) -Learn about the latest MDOP information and resources. - -[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) -Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -  - -  - - - - +- [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md) + - [About MBAM 1.0](about-mbam-10.md) + - [Release Notes for MBAM 1.0](release-notes-for-mbam-10.md) + - [Evaluating MBAM 1.0](evaluating-mbam-10.md) + - [High Level Architecture for MBAM 1.0](high-level-architecture-for-mbam-10.md) + - [Accessibility for MBAM 1.0](accessibility-for-mbam-10.md) + - [Privacy Statement for MBAM 1.0](privacy-statement-for-mbam-10.md) +- [Planning for MBAM 1.0](planning-for-mbam-10.md) + - [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md) + - [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) + - [Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md) + - [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md) + - [MBAM 1.0 Planning Checklist](mbam-10-planning-checklist.md) +- [Deploying MBAM 1.0](deploying-mbam-10.md) + - [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md) + - [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md) + - [Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md) + - [Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md) + - [MBAM 1.0 Deployment Checklist](mbam-10-deployment-checklist.md) +- [Operations for MBAM 1.0](operations-for-mbam-10.md) + - [Administering MBAM 1.0 Features](administering-mbam-10-features.md) + - [Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md) + - [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md) + - [Administering MBAM 1.0 by Using PowerShell](administering-mbam-10-by-using-powershell.md) +- [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md) +## More Information +- [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) + Find documentation, videos, and other resources for MDOP technologies. diff --git a/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md b/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md index 2bc9d1d30a..60ea674d89 100644 --- a/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md +++ b/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md @@ -1,7 +1,7 @@ --- title: Known Issues in the MBAM International Release description: Known Issues in the MBAM International Release -author: msfttracyp +author: dansimp ms.assetid: bbf888dc-93c1-4323-b43c-0ded098e9b93 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/maintaining-mbam-10.md b/mdop/mbam-v1/maintaining-mbam-10.md index 38d6ea5192..08d3397021 100644 --- a/mdop/mbam-v1/maintaining-mbam-10.md +++ b/mdop/mbam-v1/maintaining-mbam-10.md @@ -1,7 +1,7 @@ --- title: Maintaining MBAM 1.0 description: Maintaining MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: 02ffb093-c364-4837-bbe8-23d4c09fbd3d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/mbam-10-deployment-checklist.md b/mdop/mbam-v1/mbam-10-deployment-checklist.md index 24865d56ec..78811c5868 100644 --- a/mdop/mbam-v1/mbam-10-deployment-checklist.md +++ b/mdop/mbam-v1/mbam-10-deployment-checklist.md @@ -1,7 +1,7 @@ --- title: MBAM 1.0 Deployment Checklist description: MBAM 1.0 Deployment Checklist -author: msfttracyp +author: dansimp ms.assetid: 7e00be23-36a0-4b0f-8663-3c4f2c71546d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/mbam-10-deployment-prerequisites.md b/mdop/mbam-v1/mbam-10-deployment-prerequisites.md index 700410a63d..ffa50dd748 100644 --- a/mdop/mbam-v1/mbam-10-deployment-prerequisites.md +++ b/mdop/mbam-v1/mbam-10-deployment-prerequisites.md @@ -1,7 +1,7 @@ --- title: MBAM 1.0 Deployment Prerequisites description: MBAM 1.0 Deployment Prerequisites -author: msfttracyp +author: dansimp ms.assetid: bd9e1010-7d25-43e7-8dc6-b521226a659d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/mbam-10-planning-checklist.md b/mdop/mbam-v1/mbam-10-planning-checklist.md index 97e5d82a85..9517808983 100644 --- a/mdop/mbam-v1/mbam-10-planning-checklist.md +++ b/mdop/mbam-v1/mbam-10-planning-checklist.md @@ -1,7 +1,7 @@ --- title: MBAM 1.0 Planning Checklist description: MBAM 1.0 Planning Checklist -author: msfttracyp +author: dansimp ms.assetid: e9439f16-d68b-48ed-99ce-5949356b180b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/mbam-10-supported-configurations.md b/mdop/mbam-v1/mbam-10-supported-configurations.md index b15e8336ad..6b5599561b 100644 --- a/mdop/mbam-v1/mbam-10-supported-configurations.md +++ b/mdop/mbam-v1/mbam-10-supported-configurations.md @@ -1,7 +1,7 @@ --- title: MBAM 1.0 Supported Configurations description: MBAM 1.0 Supported Configurations -author: msfttracyp +author: dansimp ms.assetid: 1f5ac58e-6a3f-47df-8a9b-4b57631ab9ee ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md b/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md index 35db4e0f57..1d1aacab0b 100644 --- a/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md +++ b/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md @@ -1,7 +1,7 @@ --- title: Monitoring and Reporting BitLocker Compliance with MBAM 1.0 description: Monitoring and Reporting BitLocker Compliance with MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: fb497d3f-ff33-4747-8e34-366440ee25c2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/operations-for-mbam-10.md b/mdop/mbam-v1/operations-for-mbam-10.md index 4f6a0e333e..526fe9bdf5 100644 --- a/mdop/mbam-v1/operations-for-mbam-10.md +++ b/mdop/mbam-v1/operations-for-mbam-10.md @@ -1,7 +1,7 @@ --- title: Operations for MBAM 1.0 description: Operations for MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: 2c358fa1-4795-45ab-9316-02db4aaa6d5f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md b/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md index 0efb74fc83..b23666e4fb 100644 --- a/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md +++ b/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md @@ -1,7 +1,7 @@ --- title: Performing BitLocker Management with MBAM description: Performing BitLocker Management with MBAM -author: msfttracyp +author: dansimp ms.assetid: 2d24390a-87bf-48b3-96a9-3882d6f2a15c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md b/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md index cd65628a24..72bae93ade 100644 --- a/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md +++ b/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md @@ -1,7 +1,7 @@ --- title: Planning for MBAM 1.0 Administrator Roles description: Planning for MBAM 1.0 Administrator Roles -author: msfttracyp +author: dansimp ms.assetid: 95be0eb4-25e9-43ca-a8e7-27373d35544d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- @@ -19,7 +19,7 @@ ms.date: 06/16/2016 This topic includes and describes the administrator roles that are available in Microsoft BitLocker Administration and Monitoring (MBAM), as well as the server locations where the local groups are created. -## MBAM Administrator roles +## MBAM Administrator roles **MBAM System Administrators** diff --git a/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md b/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md index c493b0b251..d5195197e8 100644 --- a/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md +++ b/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md @@ -1,7 +1,7 @@ --- title: Planning for MBAM 1.0 Client Deployment description: Planning for MBAM 1.0 Client Deployment -author: msfttracyp +author: dansimp ms.assetid: 3af2e7f3-134b-4ab9-9847-b07474ca6ac3 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md b/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md index eb5ac48c44..0c384ae2d6 100644 --- a/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md +++ b/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md @@ -1,7 +1,7 @@ --- title: Planning for MBAM 1.0 Group Policy Requirements description: Planning for MBAM 1.0 Group Policy Requirements -author: msfttracyp +author: dansimp ms.assetid: 0fc9c509-7850-4a8e-bb82-b949025bcb02 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- @@ -141,7 +141,7 @@ This section describes the Client Management policy definitions for MBAM, found -## Fixed Drive policy definitions +## Fixed Drive policy definitions This section describes the Fixed Drive policy definitions for MBAM, which can be found at the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)** \\ **Fixed Drive**. diff --git a/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md b/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md index f8a81e0385..b2e492d53c 100644 --- a/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md +++ b/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md @@ -1,7 +1,7 @@ --- title: Planning for MBAM 1.0 Server Deployment description: Planning for MBAM 1.0 Server Deployment -author: msfttracyp +author: dansimp ms.assetid: 3cbef284-3092-4c42-9234-2826b18ddef1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/planning-for-mbam-10.md b/mdop/mbam-v1/planning-for-mbam-10.md index d962c67909..74f3e52c47 100644 --- a/mdop/mbam-v1/planning-for-mbam-10.md +++ b/mdop/mbam-v1/planning-for-mbam-10.md @@ -1,7 +1,7 @@ --- title: Planning for MBAM 1.0 description: Planning for MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: d4e8a42f-2836-48c8-83c1-40bd58270e19 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/planning-to-deploy-mbam-10.md b/mdop/mbam-v1/planning-to-deploy-mbam-10.md index 82f073a30e..a140ac107e 100644 --- a/mdop/mbam-v1/planning-to-deploy-mbam-10.md +++ b/mdop/mbam-v1/planning-to-deploy-mbam-10.md @@ -1,7 +1,7 @@ --- title: Planning to Deploy MBAM 1.0 description: Planning to Deploy MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: 30ad4304-45c6-427d-8e33-ebe8053c7871 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md b/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md index c1751b7247..e6f0d28e17 100644 --- a/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md +++ b/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md @@ -1,7 +1,7 @@ --- title: Preparing your Environment for MBAM 1.0 description: Preparing your Environment for MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: 915f7c3c-70ad-4a90-a434-73e7fba97ecb ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/privacy-statement-for-mbam-10.md b/mdop/mbam-v1/privacy-statement-for-mbam-10.md index cbb1202f49..c270853e2b 100644 --- a/mdop/mbam-v1/privacy-statement-for-mbam-10.md +++ b/mdop/mbam-v1/privacy-statement-for-mbam-10.md @@ -1,7 +1,7 @@ --- title: Privacy Statement for MBAM 1.0 description: Privacy Statement for MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: db18cc93-a1c1-44da-a450-a5399a4427b9 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/release-notes-for-mbam-10.md b/mdop/mbam-v1/release-notes-for-mbam-10.md index aec1c1dab8..aac64b73a3 100644 --- a/mdop/mbam-v1/release-notes-for-mbam-10.md +++ b/mdop/mbam-v1/release-notes-for-mbam-10.md @@ -1,7 +1,7 @@ --- title: Release Notes for MBAM 1.0 description: Release Notes for MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: d82fddde-c360-48ef-86a0-d9b5fe066861 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/security-and-privacy-for-mbam-10.md b/mdop/mbam-v1/security-and-privacy-for-mbam-10.md index 00c9e551f3..77f5bbac35 100644 --- a/mdop/mbam-v1/security-and-privacy-for-mbam-10.md +++ b/mdop/mbam-v1/security-and-privacy-for-mbam-10.md @@ -1,7 +1,7 @@ --- title: Security and Privacy for MBAM 1.0 description: Security and Privacy for MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: ba4497f1-b9e3-41be-8953-3637d1f83f01 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v1/security-considerations-for-mbam-10.md b/mdop/mbam-v1/security-considerations-for-mbam-10.md index 60d75c4b33..eff551a11c 100644 --- a/mdop/mbam-v1/security-considerations-for-mbam-10.md +++ b/mdop/mbam-v1/security-considerations-for-mbam-10.md @@ -1,7 +1,7 @@ --- title: Security Considerations for MBAM 1.0 description: Security Considerations for MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: 5e1c8b8c-235b-4a92-8b0b-da50dca17353 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/troubleshooting-mbam-10.md b/mdop/mbam-v1/troubleshooting-mbam-10.md index 9c07bf41b2..8fb6127377 100644 --- a/mdop/mbam-v1/troubleshooting-mbam-10.md +++ b/mdop/mbam-v1/troubleshooting-mbam-10.md @@ -1,7 +1,7 @@ --- title: Troubleshooting MBAM 1.0 description: Troubleshooting MBAM 1.0 -author: msfttracyp +author: dansimp ms.assetid: 7d47fbfe-51c0-4619-bed3-163dfd18cdec ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md b/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md index 069c0097c2..022175bb77 100644 --- a/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md +++ b/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md @@ -1,7 +1,7 @@ --- title: Understanding MBAM Reports description: Understanding MBAM Reports -author: msfttracyp +author: dansimp ms.assetid: 34e4aaeb-7f89-41a1-b816-c6fe8397b060 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/about-mbam-20-mbam-2.md b/mdop/mbam-v2/about-mbam-20-mbam-2.md index 403d43870d..397a35cb79 100644 --- a/mdop/mbam-v2/about-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/about-mbam-20-mbam-2.md @@ -1,7 +1,7 @@ --- title: About MBAM 2.0 description: About MBAM 2.0 -author: msfttracyp +author: dansimp ms.assetid: b43a0ba9-1c83-4854-a2c5-14eea0070e36 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v2/about-mbam-20-sp1.md b/mdop/mbam-v2/about-mbam-20-sp1.md index 8b27fe1388..b0c981921e 100644 --- a/mdop/mbam-v2/about-mbam-20-sp1.md +++ b/mdop/mbam-v2/about-mbam-20-sp1.md @@ -1,7 +1,7 @@ --- title: About MBAM 2.0 SP1 description: About MBAM 2.0 SP1 -author: msfttracyp +author: dansimp ms.assetid: 5ba89ed8-bb6e-407b-82c2-e2e36dd1078e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v2/about-the-computer-tpm-chip.md b/mdop/mbam-v2/about-the-computer-tpm-chip.md index 8fc5a07b1c..6c54503317 100644 --- a/mdop/mbam-v2/about-the-computer-tpm-chip.md +++ b/mdop/mbam-v2/about-the-computer-tpm-chip.md @@ -1,7 +1,7 @@ --- title: About the Computer TPM Chip description: About the Computer TPM Chip -author: msfttracyp +author: dansimp ms.assetid: 6f1cf18c-277a-4932-886d-14202ca8d175 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md b/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md index 62803ce9fd..7add613c67 100644 --- a/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md @@ -1,7 +1,7 @@ --- title: Accessibility for MBAM 2.0 description: Accessibility for MBAM 2.0 -author: msfttracyp +author: dansimp ms.assetid: 9cd628f1-f594-43ab-8095-4663272940a9 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md b/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md index 87e053a66b..7ee742c396 100644 --- a/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md +++ b/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md @@ -1,7 +1,7 @@ --- title: Administering MBAM 2.0 Features description: Administering MBAM 2.0 Features -author: msfttracyp +author: dansimp ms.assetid: 065e0704-069e-4372-9b86-0b57dd7638dd ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md b/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md index 38ce3f35cf..f43d38765a 100644 --- a/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md +++ b/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md @@ -1,7 +1,7 @@ --- title: Administering MBAM 2.0 Using PowerShell description: Administering MBAM 2.0 Using PowerShell -author: msfttracyp +author: dansimp ms.assetid: d785a8df-0a8c-4d70-abd2-93a762b4f3de ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md b/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md index fbbfcb6384..744345ad5d 100644 --- a/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md +++ b/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md @@ -1,7 +1,7 @@ --- title: Create or Edit the Sms\_def.mof File description: Create or Edit the Sms\_def.mof File -author: msfttracyp +author: dansimp ms.assetid: d1747e43-484e-4031-a63b-6342fe588aa2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/04/2017 --- diff --git a/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md b/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md index 01574c06fa..4b3e88d612 100644 --- a/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md +++ b/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md @@ -1,7 +1,7 @@ --- title: Deploying MBAM 2.0 Group Policy Objects description: Deploying MBAM 2.0 Group Policy Objects -author: msfttracyp +author: dansimp ms.assetid: f17f3897-73ab-431b-a6ec-5a6cff9f279a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/deploying-mbam-20-mbam-2.md b/mdop/mbam-v2/deploying-mbam-20-mbam-2.md index 4f391c02e0..80dc366d32 100644 --- a/mdop/mbam-v2/deploying-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/deploying-mbam-20-mbam-2.md @@ -1,7 +1,7 @@ --- title: Deploying MBAM 2.0 description: Deploying MBAM 2.0 -author: msfttracyp +author: dansimp ms.assetid: 4b0eaf10-81b4-427e-9d43-eb833de935a3 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md b/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md index d216401680..1c67a9c241 100644 --- a/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md +++ b/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md @@ -1,7 +1,7 @@ --- title: Deploying MBAM with Configuration Manager description: Deploying MBAM with Configuration Manager -author: msfttracyp +author: dansimp ms.assetid: 89d03e29-457a-471d-b893-e0b74a83ec50 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md b/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md index c9857d854e..aec7e23b95 100644 --- a/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md +++ b/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md @@ -1,7 +1,7 @@ --- title: Deploying the MBAM 2.0 Client description: Deploying the MBAM 2.0 Client -author: msfttracyp +author: dansimp ms.assetid: 3dd584fe-2a54-40f0-9bab-13ea74040b01 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md b/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md index 32a1b563d5..92009c59e2 100644 --- a/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md +++ b/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md @@ -1,7 +1,7 @@ --- title: Deploying the MBAM 2.0 Server Infrastructure description: Deploying the MBAM 2.0 Server Infrastructure -author: msfttracyp +author: dansimp ms.assetid: 52e68d94-e2b4-4b06-ae55-f900ea6cc59f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/edit-the-configurationmof-file.md b/mdop/mbam-v2/edit-the-configurationmof-file.md index e06a21728b..ac93e6c000 100644 --- a/mdop/mbam-v2/edit-the-configurationmof-file.md +++ b/mdop/mbam-v2/edit-the-configurationmof-file.md @@ -1,7 +1,7 @@ --- title: Edit the Configuration.mof File description: Edit the Configuration.mof File -author: msfttracyp +author: dansimp ms.assetid: 23e50ec9-4083-4b12-ad96-626cf30960bb ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/03/2017 --- diff --git a/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md b/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md index 4c52ea62b8..40d947f55d 100644 --- a/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md @@ -1,7 +1,7 @@ --- title: Evaluating MBAM 2.0 description: Evaluating MBAM 2.0 -author: msfttracyp +author: dansimp ms.assetid: bfc77eec-0fd7-4fec-9c78-6870afa87152 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md b/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md index c05335448c..5b542f196a 100644 --- a/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md +++ b/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md @@ -1,7 +1,7 @@ --- title: Getting Started - Using MBAM with Configuration Manager description: Getting Started - Using MBAM with Configuration Manager -author: msfttracyp +author: dansimp ms.assetid: b0a1d3cc-0b01-4b69-a2cd-fd09fb3beda4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md b/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md index e24afb3f59..625e1ee26f 100644 --- a/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md @@ -1,7 +1,7 @@ --- title: Getting Started with MBAM 2.0 description: Getting Started with MBAM 2.0 -author: msfttracyp +author: dansimp ms.assetid: 29f5c9af-5bbf-4d37-aa0f-0716046904af ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v2/helping-end-users-manage-bitlocker.md b/mdop/mbam-v2/helping-end-users-manage-bitlocker.md index 351f43c2ea..b3623cb9aa 100644 --- a/mdop/mbam-v2/helping-end-users-manage-bitlocker.md +++ b/mdop/mbam-v2/helping-end-users-manage-bitlocker.md @@ -1,7 +1,7 @@ --- title: Helping End Users Manage BitLocker description: Helping End Users Manage BitLocker -author: msfttracyp +author: dansimp ms.assetid: 47776fb3-2d94-4970-b687-c35ec3dd6c64 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md b/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md index ccf0d2efd2..a4caa36571 100644 --- a/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md @@ -1,7 +1,7 @@ --- title: High Availability for MBAM 2.0 description: High Availability for MBAM 2.0 -author: msfttracyp +author: dansimp ms.assetid: 244ee013-9e2a-48d2-b842-4e10594fd74f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md b/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md index 8e213175cb..27e1c2e644 100644 --- a/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md @@ -1,7 +1,7 @@ --- title: High-Level Architecture for MBAM 2.0 description: High-Level Architecture for MBAM 2.0 -author: msfttracyp +author: dansimp ms.assetid: 7f73dd3a-0b1f-4af6-a2f0-d0c5bc5d183a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-brand-the-self-service-portal.md b/mdop/mbam-v2/how-to-brand-the-self-service-portal.md index d50446e82d..f43a97e8c6 100644 --- a/mdop/mbam-v2/how-to-brand-the-self-service-portal.md +++ b/mdop/mbam-v2/how-to-brand-the-self-service-portal.md @@ -1,7 +1,7 @@ --- title: How to Brand the Self-Service Portal description: How to Brand the Self-Service Portal -author: msfttracyp +author: dansimp ms.assetid: 3ef9e951-7c42-4f7f-b131-3765d39b3207 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md b/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md index 5e92294d61..b47d44cf1c 100644 --- a/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md +++ b/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md @@ -1,7 +1,7 @@ --- title: How to Create or Edit the mof Files description: How to Create or Edit the mof Files -author: msfttracyp +author: dansimp ms.assetid: 4d19d707-b90f-4057-a6e9-e4221a607190 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md b/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md index 26ec642679..10910254bf 100644 --- a/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md +++ b/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Deploy the MBAM Client as Part of a Windows Deployment description: How to Deploy the MBAM Client as Part of a Windows Deployment -author: msfttracyp +author: dansimp ms.assetid: 67387de7-8b02-4412-9850-3b8d8e5c18af ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md b/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md index cd58d1213c..47593de55a 100644 --- a/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md +++ b/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Deploy the MBAM Client to Desktop or Laptop Computers description: How to Deploy the MBAM Client to Desktop or Laptop Computers -author: msfttracyp +author: dansimp ms.assetid: 56744922-bfdd-48f6-ae01-645ff53b64a8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md b/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md index be34c7735b..bb42e53b57 100644 --- a/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md +++ b/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Determine BitLocker Encryption State of Lost Computers description: How to Determine BitLocker Encryption State of Lost Computers -author: msfttracyp +author: dansimp ms.assetid: dbd23b64-dff3-4913-9acd-affe67b9462e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md b/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md index 1c4aec51cd..6e2e8a86b9 100644 --- a/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md +++ b/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Edit MBAM 2.0 GPO Settings description: How to Edit MBAM 2.0 GPO Settings -author: msfttracyp +author: dansimp ms.assetid: f5ffa93d-b4d2-4317-8a1c-7d2be0264fe3 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md b/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md index 7e100cc0b6..f316734c05 100644 --- a/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md +++ b/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Generate MBAM Reports description: How to Generate MBAM Reports -author: msfttracyp +author: dansimp ms.assetid: 083550cb-8c3f-49b3-a30e-97d85374d2f4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md b/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md index 94480977b1..38f047024f 100644 --- a/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md +++ b/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Hide Default BitLocker Encryption in the Windows Control Panel description: How to Hide Default BitLocker Encryption in the Windows Control Panel -author: msfttracyp +author: dansimp ms.assetid: 6674aa51-2b5d-4e4a-8b43-2cc18d008285 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md b/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md index db6508b8b3..27958ae9ea 100644 --- a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md +++ b/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Install and Configure MBAM on a Single Server description: How to Install and Configure MBAM on a Single Server -author: msfttracyp +author: dansimp ms.assetid: 45e6a012-6c8c-4d90-902c-d09de9a0cbea ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md b/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md index f7c562da25..1d8a7e2c2f 100644 --- a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md +++ b/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Install and Configure MBAM on Distributed Servers description: How to Install and Configure MBAM on Distributed Servers -author: msfttracyp +author: dansimp ms.assetid: 67b91e6b-ae2e-4e47-9ef2-6819aba95976 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md b/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md index a01c49e93e..c68683c237 100644 --- a/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md +++ b/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md @@ -1,7 +1,7 @@ --- title: How to Install MBAM with Configuration Manager description: How to Install MBAM with Configuration Manager -author: msfttracyp +author: dansimp ms.assetid: fd0832e4-3b79-4e56-9550-d2f396be6d09 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md b/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md index 44d57820c6..d8632fcd91 100644 --- a/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md +++ b/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Install the MBAM 2.0 Group Policy Template description: How to Install the MBAM 2.0 Group Policy Template -author: msfttracyp +author: dansimp ms.assetid: bc193232-d060-4285-842e-d194a74dd3c9 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md b/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md index 39812a5a36..a7e9b0e7ac 100644 --- a/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md +++ b/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Manage MBAM Administrator Roles description: How to Manage MBAM Administrator Roles -author: msfttracyp +author: dansimp ms.assetid: 813ac0c4-3cf9-47af-b4cb-9395fd915e5c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md b/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md index e449e25cfc..5f83c9dd0d 100644 --- a/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md +++ b/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel description: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel -author: msfttracyp +author: dansimp ms.assetid: e2ff153e-5770-4a12-b79d-cda998b8a8ab ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md b/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md index f338e9a016..e518a674e4 100644 --- a/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md +++ b/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Manage User BitLocker Encryption Exemptions description: How to Manage User BitLocker Encryption Exemptions -author: msfttracyp +author: dansimp ms.assetid: 1bfd9d66-6a9a-4d0e-b54a-e5a6627f5ada ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md b/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md index 7888f34d72..ed20b6e810 100644 --- a/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md +++ b/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Move MBAM 2.0 Features to Another Computer description: How to Move MBAM 2.0 Features to Another Computer -author: msfttracyp +author: dansimp ms.assetid: 49bc0792-60a4-473f-89cc-ada30191e04a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md b/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md index dd4da603f5..127ccb9fb5 100644 --- a/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md +++ b/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Recover a Corrupted Drive description: How to Recover a Corrupted Drive -author: msfttracyp +author: dansimp ms.assetid: b0457a00-f72e-4ad8-ab3b-7701851ca87e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md b/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md index 433c97297f..829e609d9a 100644 --- a/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md +++ b/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Recover a Drive in Recovery Mode description: How to Recover a Drive in Recovery Mode -author: msfttracyp +author: dansimp ms.assetid: 8b792bc8-b671-4345-9d37-0208db3e5b03 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md b/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md index c562f3e90c..ca34602795 100644 --- a/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md +++ b/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Recover a Moved Drive description: How to Recover a Moved Drive -author: msfttracyp +author: dansimp ms.assetid: 697cd78d-962c-411e-901a-2e9220ba6552 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md b/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md index 9736d6ac88..2cbe850d58 100644 --- a/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md +++ b/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md @@ -1,7 +1,7 @@ --- title: How to Reset a TPM Lockout description: How to Reset a TPM Lockout -author: msfttracyp +author: dansimp ms.assetid: 20719ab2-18ae-4d3b-989a-539341909816 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md b/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md index 0b67f68365..a0f768a971 100644 --- a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md +++ b/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md @@ -1,7 +1,7 @@ --- title: How to Use a Command Line to Install the MBAM Client description: How to Use a Command Line to Install the MBAM Client -author: msfttracyp +author: dansimp ms.assetid: 4dc8f944-c2fd-4d89-aed6-e9dc77de3ae4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md b/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md index e9c34d8cd9..3382609997 100644 --- a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md +++ b/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md @@ -1,7 +1,7 @@ --- title: How to Use a Command Line to Install the MBAM Server description: How to Use a Command Line to Install the MBAM Server -author: msfttracyp +author: dansimp ms.assetid: 6ffc6d41-a793-42c2-b997-95ba47550648 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-use-the-help-desk-portal.md b/mdop/mbam-v2/how-to-use-the-help-desk-portal.md index 285a8e790c..f072447022 100644 --- a/mdop/mbam-v2/how-to-use-the-help-desk-portal.md +++ b/mdop/mbam-v2/how-to-use-the-help-desk-portal.md @@ -1,7 +1,7 @@ --- title: How to Use the Help Desk Portal description: How to Use the Help Desk Portal -author: msfttracyp +author: dansimp ms.assetid: c27f7737-10c8-4164-9de8-57987292c89c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md b/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md index 298322fa61..26c119c021 100644 --- a/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md +++ b/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md @@ -1,7 +1,7 @@ --- title: How to Use the Self-Service Portal to Regain Access to a Computer description: How to Use the Self-Service Portal to Regain Access to a Computer -author: msfttracyp +author: dansimp ms.assetid: bcf095de-0237-4bb0-b450-da8fb6d6f3d0 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md b/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md index 06bda1be6f..841a83a734 100644 --- a/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md +++ b/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md @@ -1,7 +1,7 @@ --- title: How to Validate the MBAM Installation with Configuration Manager description: How to Validate the MBAM Installation with Configuration Manager -author: msfttracyp +author: dansimp ms.assetid: 8e268539-91c3-4e8a-baae-faf3605da818 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/index.md b/mdop/mbam-v2/index.md index 5337db9b65..ba76b06b55 100644 --- a/mdop/mbam-v2/index.md +++ b/mdop/mbam-v2/index.md @@ -1,52 +1,56 @@ --- title: Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide description: Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide -author: jamiejdt +author: dansimp ms.assetid: fdb43f62-960a-4811-8802-50efdf04b4af ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 04/19/2017 --- - # Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide - Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 provides a simplified administrative interface that you can use to manage BitLocker drive encryption. In BitLocker Administration and Monitoring 2.0, you can select BitLocker drive encryption policy options that are appropriate for your enterprise, and then use them to monitor client compliance with those policies. You can also report on the encryption status of an individual computer and on the enterprise as a whole. In addition, you can access recovery key information when users forget their PIN or password or when their BIOS or boot record changes. -[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) +## Outline -[About MBAM 2.0](about-mbam-20-mbam-2.md)**|**[Release Notes for MBAM 2.0](release-notes-for-mbam-20-mbam-2.md)**|**[About MBAM 2.0 SP1](about-mbam-20-sp1.md)**|**[Release Notes for MBAM 2.0 SP1](release-notes-for-mbam-20-sp1.md)**|**[Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md)**|**[High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md)**|**[Accessibility for MBAM 2.0](accessibility-for-mbam-20-mbam-2.md) +- [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md) + - [About MBAM 2.0](about-mbam-20-mbam-2.md) + - [Release Notes for MBAM 2.0](release-notes-for-mbam-20-mbam-2.md) + - [About MBAM 2.0 SP1](about-mbam-20-sp1.md) + - [Release Notes for MBAM 2.0 SP1](release-notes-for-mbam-20-sp1.md) + - [Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md) + - [High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md) + - [Accessibility for MBAM 2.0](accessibility-for-mbam-20-mbam-2.md) +- [Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) + - [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md) + - [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) + - [Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md) + - [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) + - [MBAM 2.0 Planning Checklist](mbam-20-planning-checklist-mbam-2.md) +- [Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) + - [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md) + - [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md) + - [Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md) + - [MBAM 2.0 Deployment Checklist](mbam-20-deployment-checklist-mbam-2.md) + - [Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md) +- [Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) + - [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md) + - [Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md) + - [Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md) + - [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md) + - [Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md) + - [Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md) + - [Administering MBAM 2.0 Using PowerShell](administering-mbam-20-using-powershell-mbam-2.md) +- [Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) -[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md) +## More Information -[Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md)**|**[MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md)**|**[Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md)**|**[MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md)**|**[MBAM 2.0 Planning Checklist](mbam-20-planning-checklist-mbam-2.md) +- [MDOP Information Experience](index.md) -[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md) - -[Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md)**|**[Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md)**|**[Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md)**|**[MBAM 2.0 Deployment Checklist](mbam-20-deployment-checklist-mbam-2.md)**|**[Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md) - -[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md) - -[Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md)**|**[Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md)**|**[Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md)**|**[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md)**|**[Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md)**|**[Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md)**|** [Administering MBAM 2.0 Using PowerShell](administering-mbam-20-using-powershell-mbam-2.md) - -[Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md) - -### More Information - -- [Release Notes for MBAM 2.0](release-notes-for-mbam-20-mbam-2.md) - - View updated product information and known issues for MBAM 2.0. - -- [MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) - - Learn about the latest MDOP information and resources. - -- [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) - - Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). + Find documentation, videos, and other resources for MDOP technologies.   diff --git a/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md b/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md index 054f13ffd9..aa1bef762a 100644 --- a/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md @@ -1,7 +1,7 @@ --- title: Maintaining MBAM 2.0 description: Maintaining MBAM 2.0 -author: msfttracyp +author: dansimp ms.assetid: 6479e093-840d-45d5-b759-1179aeeeefeb ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md b/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md index a4c029a574..8741f7ce42 100644 --- a/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md +++ b/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md @@ -1,7 +1,7 @@ --- title: MBAM 2.0 Deployment Checklist description: MBAM 2.0 Deployment Checklist -author: msfttracyp +author: dansimp ms.assetid: 7905d31d-f21c-4683-b9c4-95b815e08fab ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md b/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md index 2dab81a1ef..ed8e98f02c 100644 --- a/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md +++ b/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md @@ -1,7 +1,7 @@ --- title: MBAM 2.0 Deployment Prerequisites description: MBAM 2.0 Deployment Prerequisites -author: msfttracyp +author: dansimp ms.assetid: 57d1c2bb-5ea3-457e-badd-dd9206ff0f20 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md b/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md index 00ef5df75b..15ae83bc2e 100644 --- a/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md +++ b/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md @@ -1,7 +1,7 @@ --- title: MBAM 2.0 Planning Checklist description: MBAM 2.0 Planning Checklist -author: msfttracyp +author: dansimp ms.assetid: 16b27c27-5f5e-41e2-b526-89a036672fb8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md b/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md index cee951bd2f..85ede65e94 100644 --- a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md +++ b/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md @@ -1,7 +1,7 @@ --- title: MBAM 2.0 Privacy Statement description: MBAM 2.0 Privacy Statement -author: msfttracyp +author: dansimp ms.assetid: fce72ad4-a837-4d17-8d3b-4d93f1a399be ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md b/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md index 72c655763d..a6dcc8f87e 100644 --- a/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md +++ b/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md @@ -1,7 +1,7 @@ --- title: MBAM 2.0 Security Considerations description: MBAM 2.0 Security Considerations -author: msfttracyp +author: dansimp ms.assetid: 0aa5c6e2-d92c-4e30-9f6a-b48abb667ae5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md b/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md index 403a3d2d2a..8d160e3e80 100644 --- a/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md +++ b/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md @@ -1,7 +1,7 @@ --- title: MBAM 2.0 Supported Configurations description: MBAM 2.0 Supported Configurations -author: msfttracyp +author: dansimp ms.assetid: dca63391-39fe-4273-a570-76d0a2f8a0fd ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md b/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md index c66f0cea07..5e116a6f1f 100644 --- a/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md @@ -1,7 +1,7 @@ --- title: Monitoring and Reporting BitLocker Compliance with MBAM 2.0 description: Monitoring and Reporting BitLocker Compliance with MBAM 2.0 -author: msfttracyp +author: dansimp ms.assetid: 0b9ba701-0aad-4e16-9b32-73d358047ccc ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md b/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md index a82ac9a07c..1e1be481f3 100644 --- a/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md @@ -1,7 +1,7 @@ --- title: Operations for MBAM 2.0 description: Operations for MBAM 2.0 -author: msfttracyp +author: dansimp ms.assetid: ece72016-4ffa-48df-8c12-1e442ee9e980 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md b/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md index 218286507e..11954b890c 100644 --- a/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md +++ b/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md @@ -1,7 +1,7 @@ --- title: Performing BitLocker Management with MBAM description: Performing BitLocker Management with MBAM -author: msfttracyp +author: dansimp ms.assetid: 9bfc6c67-f12c-4daa-8f08-5884fb47443c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md index 129b9e694f..1e07104cc4 100644 --- a/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md +++ b/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md @@ -1,7 +1,7 @@ --- title: Planning for MBAM 2.0 Administrator Roles description: Planning for MBAM 2.0 Administrator Roles -author: msfttracyp +author: dansimp ms.assetid: 6f813297-6479-42d3-a21b-896d54466b5b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- @@ -19,7 +19,7 @@ ms.date: 06/16/2016 This topic lists and describes the available administrator roles that are available in Microsoft BitLocker Administration and Monitoring (MBAM) as well as the server locations where the local groups are created. -## MBAM Administrator Roles +## MBAM Administrator Roles **MBAM System Administrators** diff --git a/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md index b2f00742d9..b2cf23cc63 100644 --- a/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md +++ b/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md @@ -1,7 +1,7 @@ --- title: Planning for MBAM 2.0 Client Deployment description: Planning for MBAM 2.0 Client Deployment -author: msfttracyp +author: dansimp ms.assetid: 3a92cf29-092f-4cad-bdfa-d5f6aafe554b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md index cb5cb89526..ab9342bf18 100644 --- a/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md +++ b/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md @@ -1,7 +1,7 @@ --- title: Planning for MBAM 2.0 Group Policy Requirements description: Planning for MBAM 2.0 Group Policy Requirements -author: msfttracyp +author: dansimp ms.assetid: f5e19dcb-eb15-4722-bb71-0734b3799eb8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- @@ -142,7 +142,7 @@ This section describes Client Management policy definitions for Microsoft BitLoc -## Fixed Drive Policy Definitions +## Fixed Drive Policy Definitions This section describes Fixed Drive policy definitions for Microsoft BitLocker Administration and Monitoring found at the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**\\**Fixed Drive**. diff --git a/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md index f872aba1de..db0c53f609 100644 --- a/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md @@ -1,7 +1,7 @@ --- title: Planning for MBAM 2.0 description: Planning for MBAM 2.0 -author: msfttracyp +author: dansimp ms.assetid: 1206bd18-05ea-4ca8-9362-07e512503c3f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md index 65b9bccf65..70970945e1 100644 --- a/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md +++ b/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md @@ -1,7 +1,7 @@ --- title: Planning for MBAM 2.0 Server Deployment description: Planning for MBAM 2.0 Server Deployment -author: msfttracyp +author: dansimp ms.assetid: b57f1a42-134f-4997-8697-7fbed08e2fc4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md b/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md index e825d97948..e580efcc33 100644 --- a/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md @@ -1,7 +1,7 @@ --- title: Planning to Deploy MBAM 2.0 description: Planning to Deploy MBAM 2.0 -author: msfttracyp +author: dansimp ms.assetid: 2dc05fcd-aed9-4315-aeaf-92aaa9e0e955 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md b/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md index a125cec907..60833f65dd 100644 --- a/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md +++ b/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md @@ -1,7 +1,7 @@ --- title: Planning to Deploy MBAM with Configuration Manager description: Planning to Deploy MBAM with Configuration Manager -author: msfttracyp +author: dansimp ms.assetid: fb768306-48c2-40b4-ac4e-c279db987391 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md b/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md index ac91e39c60..287db04f99 100644 --- a/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md @@ -1,7 +1,7 @@ --- title: Preparing your Environment for MBAM 2.0 description: Preparing your Environment for MBAM 2.0 -author: msfttracyp +author: dansimp ms.assetid: 5fb01da9-620e-4992-9e54-2ed3fb69e6af ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: tracyp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md b/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md index 7cb8d1004c..2bbbd782ed 100644 --- a/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md b/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md index 003c3164cc..9fb4028a56 100644 --- a/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md +++ b/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md b/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md index 8b5396b89e..0a0a6f60c0 100644 --- a/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md b/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md index 6c66308f9f..7ea7004d1c 100644 --- a/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md +++ b/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md b/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md index a5bd540199..4e367f90d7 100644 --- a/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md +++ b/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md b/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md index 731bc11158..4e1f2addc4 100644 --- a/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md +++ b/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md b/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md index 7b3884f5c8..ab076703c4 100644 --- a/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md +++ b/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/using-mbam-with-configuration-manager.md b/mdop/mbam-v2/using-mbam-with-configuration-manager.md index 065e2ffd49..10be5afa15 100644 --- a/mdop/mbam-v2/using-mbam-with-configuration-manager.md +++ b/mdop/mbam-v2/using-mbam-with-configuration-manager.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v2/using-your-pin-or-password.md b/mdop/mbam-v2/using-your-pin-or-password.md index cdf27ed7a0..b2e8471007 100644 --- a/mdop/mbam-v2/using-your-pin-or-password.md +++ b/mdop/mbam-v2/using-your-pin-or-password.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, security ms.mktglfcycl: manage ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/mbam-v25/TOC.md b/mdop/mbam-v25/TOC.md index a33c126e12..01a083b8b8 100644 --- a/mdop/mbam-v25/TOC.md +++ b/mdop/mbam-v25/TOC.md @@ -83,6 +83,7 @@ #### [Monitoring Web Service Request Performance Counters](monitoring-web-service-request-performance-counters.md) ### [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md) ## [Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) +### [Upgrade from MBAM 2.5 to MBAM 2.5 SP1](upgrade-mbam2.5-sp1.md) ## [Applying hotfixes on MBAM 2.5 SP1](apply-hotfix-for-mbam-25-sp1.md) ## [Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) ### [Client Event Logs](client-event-logs.md) diff --git a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md b/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md index a24a6d32c9..3ed2c2c111 100644 --- a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md +++ b/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md @@ -2,7 +2,7 @@ title: Applying hotfixes on MBAM 2.5 SP1 description: Applying hotfixes on MBAM 2.5 SP1 ms.author: ppriya-msft -author: intothedarkness +author: dansimp ms.assetid: ms.reviewer: manager: dansimp @@ -19,7 +19,7 @@ author: shortpatti This topic describes the process for applying the hotfixes for Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 SP1 ### Before you begin, download the latest hotfix of Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 SP1 -[Desktop Optimization Pack](https://www.microsoft.com/en-us/download/details.aspx?id=57157) +[Desktop Optimization Pack](https://www.microsoft.com/download/details.aspx?id=58345) #### Steps to update the MBAM Server for existing MBAM environment 1. Remove MBAM server feature (do this by opening the MBAM Server Configuration Tool, then selecting Remove Features). diff --git a/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md b/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md index 185ace5f1b..166bfb30c5 100644 --- a/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md +++ b/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md @@ -26,7 +26,7 @@ MDOP Group Policy templates are available for download in a self-extracting, com **How to download and deploy the MDOP Group Policy templates** -1. Download the MDOP Group Policy templates from [Microsoft Desktop Optimization Pack Group Policy Administrative Templates](https://www.microsoft.com/en-us/download/details.aspx?id=55531). +1. Download the MDOP Group Policy templates from [Microsoft Desktop Optimization Pack Group Policy Administrative Templates](https://www.microsoft.com/download/details.aspx?id=55531). 2. Run the downloaded file to extract the template folders. diff --git a/mdop/mbam-v25/index.md b/mdop/mbam-v25/index.md index 9e5c96e03d..3f71f9edd8 100644 --- a/mdop/mbam-v25/index.md +++ b/mdop/mbam-v25/index.md @@ -1,7 +1,7 @@ --- title: Microsoft BitLocker Administration and Monitoring 2.5 description: Microsoft BitLocker Administration and Monitoring 2.5 -author: jamiejdt +author: dansimp ms.assetid: fd81d7de-b166-47e8-b6c7-d984830762b6 ms.pagetype: mdop, security ms.mktglfcycl: manage @@ -10,67 +10,61 @@ ms.prod: w10 ms.date: 04/19/2017 --- - # Microsoft BitLocker Administration and Monitoring 2.5 - Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 provides a simplified administrative interface that you can use to manage BitLocker Drive Encryption. You configure MBAM Group Policy Templates that enable you to set BitLocker Drive Encryption policy options that are appropriate for your enterprise, and then use them to monitor client compliance with those policies. You can also report on the encryption status of an individual computer and on the enterprise as a whole. In addition, you can access recovery key information when users forget their PIN or password or when their BIOS or boot record changes. For a more detailed description of MBAM, see [About MBAM 2.5](about-mbam-25.md). -To get the MBAM software, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049). +To obtain MBAM, see [How Do I Get MDOP](https://docs.microsoft.com/microsoft-desktop-optimization-pack/index#how-to-get-mdop). -[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) +## Outline -[About MBAM 2.5](about-mbam-25.md)**|**[Release Notes for MBAM 2.5](release-notes-for-mbam-25.md)**|**[About MBAM 2.5 SP1](about-mbam-25-sp1.md)**|**[Release Notes for MBAM 2.5 SP1](release-notes-for-mbam-25-sp1.md)**|**[Evaluating MBAM 2.5 in a Test Environment](evaluating-mbam-25-in-a-test-environment.md)**|**[High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md)**|**[Accessibility for MBAM 2.5](accessibility-for-mbam-25.md) +- [Getting Started with MBAM 2.5](getting-started-with-mbam-25.md) + - [About MBAM 2.5](about-mbam-25.md) + - [Release Notes for MBAM 2.5](release-notes-for-mbam-25.md) + - [About MBAM 2.5 SP1](about-mbam-25-sp1.md) + - [Release Notes for MBAM 2.5 SP1](release-notes-for-mbam-25-sp1.md) + - [Evaluating MBAM 2.5 in a Test Environment](evaluating-mbam-25-in-a-test-environment.md) + - [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) + - [Accessibility for MBAM 2.5](accessibility-for-mbam-25.md) +- [Planning for MBAM 2.5](planning-for-mbam-25.md) + - [Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md) + - [MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md) + - [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) + - [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md) + - [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md) + - [Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md) + - [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) + - [Planning for MBAM 2.5 High Availability](planning-for-mbam-25-high-availability.md) + - [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md) + - [MBAM 2.5 Planning Checklist](mbam-25-planning-checklist.md) +- [Deploying MBAM 2.5](deploying-mbam-25.md) + - [Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md) + - [Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md) + - [Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md) + - [MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md) + - [Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions](upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md) + - [Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md) +- [Operations for MBAM 2.5](operations-for-mbam-25.md) + - [Administering MBAM 2.5 Features](administering-mbam-25-features.md) + - [Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md) + - [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md) + - [Maintaining MBAM 2.5](maintaining-mbam-25.md) + - [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md) +- [Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) +- [Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) + - [Client Event Logs](client-event-logs.md) + - [Server Event Logs](server-event-logs.md) -[Planning for MBAM 2.5](planning-for-mbam-25.md) - -[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md)**|**[MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md)**|**[Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md)**|**[Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md)**|**[Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md)**|**[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md)**|**[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)**|**[Planning for MBAM 2.5 High Availability](planning-for-mbam-25-high-availability.md)**|**[MBAM 2.5 Security Considerations](mbam-25-security-considerations.md)**|**[MBAM 2.5 Planning Checklist](mbam-25-planning-checklist.md) - -[Deploying MBAM 2.5](deploying-mbam-25.md) - -[Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md)**|**[Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md)**|**[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md)**|**[MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md)**|**[Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions](upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md)**|**[Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md) - -[Operations for MBAM 2.5](operations-for-mbam-25.md) - -[Administering MBAM 2.5 Features](administering-mbam-25-features.md)**|**[Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md)**|**[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md)**|**[Maintaining MBAM 2.5](maintaining-mbam-25.md)**|**[Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md) - -[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md) - -[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md) - -[Client Event Logs](client-event-logs.md)**|**[Server Event Logs](server-event-logs.md) - -### More Information - -- [Release Notes for MBAM 2.5](release-notes-for-mbam-25.md) - - View updated product information and known issues for MBAM 2.5. - -- [MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286) - - Learn about the latest MDOP information and resources. - -- [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) - - Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447). - -- [MBAM Deployment Guide](https://www.microsoft.com/download/details.aspx?id=38398) - - Get help in choosing a deployment method for MBAM, including step-by-step instructions for each method. - -- [Apply Hotfixes on MBAM 2.5 SP1 Server](apply-hotfix-for-mbam-25-sp1.md) - - Guide of how to apply MBAM 2.5 SP1 Server hotfixes - -## Got a suggestion for MBAM? -- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). -- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). - -  - -  +## More Information +- [MDOP Information Experience](index.md) + Find documentation, videos, and other resources for MDOP technologies. +- [MBAM Deployment Guide](https://www.microsoft.com/download/details.aspx?id=38398) + Get help in choosing a deployment method for MBAM, including step-by-step instructions for each method. + +- [Apply Hotfixes on MBAM 2.5 SP1 Server](apply-hotfix-for-mbam-25-sp1.md) + Guide of how to apply MBAM 2.5 SP1 Server hotfixes diff --git a/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md b/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md index e6b0faca0c..b95c5a854c 100644 --- a/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md +++ b/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md @@ -260,8 +260,9 @@ The following table lists the installation prerequisites for the MBAM Administra

    Windows Server Features

    .NET Framework 4.5 features:

      -

    • .NET Framework 4.5

      +

    • .NET Framework 4.5 or 4.6

        +

      • Windows Server 2016 - .NET Framework 4.6 is already installed for these versions of Windows Server, but you must enable it.

      • Windows Server 2012 or Windows Server 2012 R2 - .NET Framework 4.5 is already installed for these versions of Windows Server, but you must enable it.

      • Windows Server 2008 R2 - .NET Framework 4.5 is not included with Windows Server 2008 R2, so you must download Microsoft .NET Framework 4.5 and install it separately.

        @@ -274,7 +275,7 @@ The following table lists the installation prerequisites for the MBAM Administra

      • WCF Activation

        • HTTP Activation

          • -

        • Non-HTTP Activation

          +

        • Non-HTTP Activation (Only for Windows Server 2008, 2012, and 2012 R2)

      • TCP Activation

        • diff --git a/mdop/mbam-v25/mbam-25-supported-configurations.md b/mdop/mbam-v25/mbam-25-supported-configurations.md index 970711d8a8..95405633b3 100644 --- a/mdop/mbam-v25/mbam-25-supported-configurations.md +++ b/mdop/mbam-v25/mbam-25-supported-configurations.md @@ -352,7 +352,7 @@ You must install SQL Server with the **SQL\_Latin1\_General\_CP1\_CI\_AS** colla

        Microsoft SQL Server 2016

        Standard, Enterprise, or Datacenter

        SP1

        -https://www.microsoft.com/en-us/download/details.aspx?id=54967

        64-bit

        +https://www.microsoft.com/download/details.aspx?id=54967

        64-bit

        Microsoft SQL Server 2014

        Standard, Enterprise, or Datacenter

        @@ -373,7 +373,7 @@ You must install SQL Server with the **SQL\_Latin1\_General\_CP1\_CI\_AS** colla **Note** -In order to support SQL 2016 you must install the March 2017 Servicing Release for MDOP https://www.microsoft.com/en-us/download/details.aspx?id=54967 and to support SQL 2017 you must install the July 2018 Servicing Release for MDOP https://www.microsoft.com/en-us/download/details.aspx?id=57157. In general stay current by always using the most recent servicing update as it also includes all bugfixes and new features. +In order to support SQL 2016 you must install the March 2017 Servicing Release for MDOP https://www.microsoft.com/download/details.aspx?id=54967 and to support SQL 2017 you must install the July 2018 Servicing Release for MDOP https://www.microsoft.com/download/details.aspx?id=57157. In general stay current by always using the most recent servicing update as it also includes all bugfixes and new features. ### SQL Server processor, RAM, and disk space requirements – Stand-alone topology @@ -598,6 +598,7 @@ The MBAM client is not supported on virtual machines and is also not supported o - [September 2017](https://support.microsoft.com/en-ie/help/4041137/september-2017-servicing-release-for-microsoft-desktop-optimization) - [March 2018](https://support.microsoft.com/help/4074878/march-2018-servicing-release-for-microsoft-desktop-optimization-pack) - [July 2018](https://support.microsoft.com/help/4340040/july-2018-servicing-release-for-microsoft-desktop-optimization-pack) +- [May 2019](https://support.microsoft.com/help/4505175/may-2019-servicing-release-for-microsoft-desktop-optimization-pack) ## Related topics diff --git a/mdop/mbam-v25/upgrade-mbam2.5-sp1.md b/mdop/mbam-v25/upgrade-mbam2.5-sp1.md new file mode 100644 index 0000000000..cd80095b3e --- /dev/null +++ b/mdop/mbam-v25/upgrade-mbam2.5-sp1.md @@ -0,0 +1,68 @@ +--- +title: Upgrading from MBAM 2.5 to MBAM 2.5 SP1 Servicing Release Update +author: dansimp +ms.author: ksharma +manager: +audience: ITPro +ms.topic: article +ms.prod: w10 +manager: miaposto +localization_priority: Normal +--- + +# Upgrade from MBAM 2.5 to MBAM 2.5 SP1 Servicing Release Update + +This article provides step-by-step instructions to upgrade Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 to MBAM 2.5 Service Pack 1 (SP1) together with the Microsoft Desktop Optimization Pack (MDOP) July 2018 servicing update in a standalone configuration. + +In this guide, we will use a two-server configuration. One server will be a database server that's running Microsoft SQL Server 2016. This server will host the MBAM databases and reports. The other server will be a Windows Server 2012 R2 web server. This server will host "Administration and Monitoring" and "Self-Service Portal." + +## Prepare to upgrade MBAM 2.5 SP1 + +### Know the MBAM servers in your environment + +1. SQL Server Database Engine: Server that hosts the MBAM databases. +2. SQL Server Reporting Services: Server that hosts the MBAM reports. +3. Internet Information Services (IIS) web servers: Server that hosts MBAM Web Applications and MBAM services. +4. (Optional) Microsoft System Center Configuration Manager primary site server: The MBAM configuration application is run on this server to integrate MBAM reports with Configuration Manager. These reports are then merged with existing Configuration Manager reports on the Configuration Manager SQL Server Reporting Services (SSRS) instance. + +### Identify service accounts, groups, server name, and reports URL + +1. Identify the MBAM application pool service account that's used by IIS web servers to read and write data to MBAM databases. +2. Identify the groups that are used during the MBAM web features configuration and the reports web service URL. +3. Identify the SQL Server name and instance name. Watch this video to learn more. + + > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE3ANP1] + +4. Identify the SQL Server Reporting Services Account that's used for reading compliance data from the Compliance and Audit database. Watch this video to learn more. + + > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE3ALdZ] + +## Upgrade the MBAM infrastructure to the latest version available + +MBAM Server infrastructure installation or upgrade is always performed in the order listed below: + +- SQL Server Database Engine: Databases +- SQL Server Reporting Services: Reports +- Web Server: Web Applications +- SCCM Server: SCCM Integrated Reports if applicable +- Clients: MBAM Agent or Client Update +- Group Policy Templates: Update the existing Group Policy with new templates and enable new settings on existing MBAM Group Policy + +> [!NOTE] +> We recommend that you create a full database backup of the MBAM databases before you run the upgrades. + +### Upgrade the MBAM SQL Server + +Watch this video to learn how to upgrade the MBAM SQL Server: + + > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE3ALew] + +### Upgrade the MBAM Web Server + +Watch this video to learn how to upgrade the MBAM Web Server: + + > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE3ALex] + +## More information + +For more information about known issues in MBAM 2.5 SP1, see [Release Notes for MBAM 2.5 SP1](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/release-notes-for-mbam-25-sp1). diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md index d71c2b2b2a..4e0f5b098c 100644 --- a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md +++ b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md @@ -17,8 +17,8 @@ ms.date: 2/16/2018 This topic describes the process for upgrading the Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 and the MBAM Client from 2.5 to MBAM 2.5 SP1. ### Before you begin -#### Download the July 2018 servicing release -[Desktop Optimization Pack](https://www.microsoft.com/download/details.aspx?id=57157) +#### Download the May 2019 servicing release +[Desktop Optimization Pack](https://www.microsoft.com/download/details.aspx?id=58345) #### Verify the installation documentaion Verify you have a current documentation of your MBAM environment, including all server names, database names, service accounts and their passwords. @@ -29,7 +29,7 @@ Verify you have a current documentation of your MBAM environment, including all Note: You will not see an option to remove the Databases; this is expected. 2. Install 2.5 SP1 (Located with MDOP - Microsoft Desktop Optimization Pack 2015 from the Volume Licensing Service Center site: 3. Do not configure it at this time  -4. Install the July 2018 Rollup: https://www.microsoft.com/download/details.aspx?id=57157 +4. Install the May 2019 Rollup: https://www.microsoft.com/download/details.aspx?id=58345 5. Using the MBAM Configurator; re-add the Reports role 6. This will configure the SSRS connection using the latest MBAM code from the rollup  7. Using the MBAM Configurator; re-add the SQL Database role on the SQL Server. @@ -40,13 +40,13 @@ Verify you have a current documentation of your MBAM environment, including all 1. Using the MBAM Configurator; remove the Admin and Self Service Portals from the IIS server 2. Install MBAM 2.5 SP1 3. Do not configure it at this time   -4. Install the July 2018 Rollup on the IIS server(https://www.microsoft.com/download/details.aspx?id=57157) +4. Install the May 2019 Rollup on the IIS server(https://www.microsoft.com/download/details.aspx?id=58345) 5. Using the MBAM Configurator; re-add the Admin and Self Service Portals to the IIS server  -6. This will configure the sites using the latest MBAM code from the July 2018 Rollup +6. This will configure the sites using the latest MBAM code from the May 2019 Rollup 7. Open an elevated command prompt, Type: **IISRESET** and Hit Enter. #### Steps to upgrade the MBAM Clients/Endpoints 1. Uninstall the 2.5 Agent from client endpoints 2. Install the 2.5 SP1 Agent on the client endpoints -3. Push out the July 2018 Rollup Client update to clients running the 2.5 SP1 Agent  -4. There is no need to uninstall the existing client prior to installing the July 2018 Rollup.   +3. Push out the May 2019 Rollup Client update to clients running the 2.5 SP1 Agent  +4. There is no need to uninstall the existing client prior to installing the May 2019 Rollup.   diff --git a/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md b/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md index 4c7082ea57..76b918713f 100644 --- a/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md +++ b/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md @@ -90,13 +90,13 @@ If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the rep 10. Browse to the following web services to verify that they load successfully. A page opens to indicate that the service is running, but the page does not display any metadata. - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMAdministrationService/AdministrationService.svc + - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMAdministrationService/AdministrationService.svc - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMUserSupportService/UserSupportService.svc + - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMUserSupportService/UserSupportService.svc - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMComplianceStatusService/StatusReportingService.svc + - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMComplianceStatusService/StatusReportingService.svc - - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMRecoveryAndHardwareService/CoreService.svc + - http(s)://< *MBAMAdministrationServerName*>:<*port*>/MBAMRecoveryAndHardwareService/CoreService.svc ## Validating the MBAM Server deployment with the Configuration Manager Integration topology diff --git a/mdop/medv-v1/about-med-v-10-sp1.md b/mdop/medv-v1/about-med-v-10-sp1.md index 56178030f7..f9d3fc4573 100644 --- a/mdop/medv-v1/about-med-v-10-sp1.md +++ b/mdop/medv-v1/about-med-v-10-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/about-med-v-10.md b/mdop/medv-v1/about-med-v-10.md index 88acba7244..8a99314de9 100644 --- a/mdop/medv-v1/about-med-v-10.md +++ b/mdop/medv-v1/about-med-v-10.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/about-this-guidemedv.md b/mdop/medv-v1/about-this-guidemedv.md index 223ee88fbe..cf20d13c06 100644 --- a/mdop/medv-v1/about-this-guidemedv.md +++ b/mdop/medv-v1/about-this-guidemedv.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/client-installation-command-line-reference.md b/mdop/medv-v1/client-installation-command-line-reference.md index 2556d5ec09..44326e2a47 100644 --- a/mdop/medv-v1/client-installation-command-line-reference.md +++ b/mdop/medv-v1/client-installation-command-line-reference.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/configuring-med-v-for-remote-networks.md b/mdop/medv-v1/configuring-med-v-for-remote-networks.md index a7a19283f2..cdb27ae2fd 100644 --- a/mdop/medv-v1/configuring-med-v-for-remote-networks.md +++ b/mdop/medv-v1/configuring-med-v-for-remote-networks.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- @@ -53,7 +53,7 @@ When applying new settings, the service must be restarted. - You can change the IIS authentication scheme to one of the following: BASIC, DIGEST, NTLM, or NEGOTIATE. The default is NEGOTIATE and uses the following entry: - ``` syntax + ```xml diff --git a/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md b/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md index 711eae625b..1b03f70a10 100644 --- a/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md +++ b/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/configuring-med-v-workspace-policies.md b/mdop/medv-v1/configuring-med-v-workspace-policies.md index d870b70e1c..34784f4a18 100644 --- a/mdop/medv-v1/configuring-med-v-workspace-policies.md +++ b/mdop/medv-v1/configuring-med-v-workspace-policies.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/creating-a-med-v-image.md b/mdop/medv-v1/creating-a-med-v-image.md index c784d59836..4b9d3222fb 100644 --- a/mdop/medv-v1/creating-a-med-v-image.md +++ b/mdop/medv-v1/creating-a-med-v-image.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md b/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md index 2445b5cb1a..49db131ccf 100644 --- a/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md +++ b/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md b/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md index d04425394e..c73b1b9457 100644 --- a/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md +++ b/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v1/define-the-project-scope.md b/mdop/medv-v1/define-the-project-scope.md index ad5596df00..2d628bd096 100644 --- a/mdop/medv-v1/define-the-project-scope.md +++ b/mdop/medv-v1/define-the-project-scope.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md b/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md index 2002a545dc..52e0292edc 100644 --- a/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md +++ b/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md b/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md index e30f9def62..4167d9099f 100644 --- a/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md +++ b/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/design-the-med-v-image-repositories.md b/mdop/medv-v1/design-the-med-v-image-repositories.md index 0fd8aa49a6..8302861536 100644 --- a/mdop/medv-v1/design-the-med-v-image-repositories.md +++ b/mdop/medv-v1/design-the-med-v-image-repositories.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v1/design-the-med-v-server-infrastructure.md b/mdop/medv-v1/design-the-med-v-server-infrastructure.md index d3869802c5..40536204ff 100644 --- a/mdop/medv-v1/design-the-med-v-server-infrastructure.md +++ b/mdop/medv-v1/design-the-med-v-server-infrastructure.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md b/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md index 07a5fcee07..5165183f3c 100644 --- a/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md +++ b/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/getting-started-with-med-v.md b/mdop/medv-v1/getting-started-with-med-v.md index 48d652a788..969a8b0a46 100644 --- a/mdop/medv-v1/getting-started-with-med-v.md +++ b/mdop/medv-v1/getting-started-with-med-v.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/high-level-architecturemedv.md b/mdop/medv-v1/high-level-architecturemedv.md index bb6ca22e61..7badb94bbd 100644 --- a/mdop/medv-v1/high-level-architecturemedv.md +++ b/mdop/medv-v1/high-level-architecturemedv.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md index 5940eccaee..5d9bdb7412 100644 --- a/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md +++ b/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md index 90e54bea2d..4846278e8e 100644 --- a/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md +++ b/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md index 95f5e5b56d..bb5b64f7e8 100644 --- a/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md +++ b/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md index 966dd20f1e..197b944570 100644 --- a/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md +++ b/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md b/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md index 0e617603d1..3a7c44c436 100644 --- a/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md +++ b/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-configure-a-deployment-package.md b/mdop/medv-v1/how-to-configure-a-deployment-package.md index 191960b228..6d2a5b4f31 100644 --- a/mdop/medv-v1/how-to-configure-a-deployment-package.md +++ b/mdop/medv-v1/how-to-configure-a-deployment-package.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md b/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md index ce0b36eae2..7669269fc7 100644 --- a/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md +++ b/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-configure-image-pre-staging.md b/mdop/medv-v1/how-to-configure-image-pre-staging.md index 5d736b92b9..5503edfefa 100644 --- a/mdop/medv-v1/how-to-configure-image-pre-staging.md +++ b/mdop/medv-v1/how-to-configure-image-pre-staging.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- @@ -72,17 +72,17 @@ Image pre-staging is useful only for the initial image download. It is not suppo **NT AUTHORITY\\Authenticated Users:(OI)(CI)(special access:)** - **                                READ\_CONTROL** + **READ\_CONTROL** - **                                                                                SYNCHRONIZE** + **SYNCHRONIZE** - **                                                                                FILE\_GENERIC\_READ** + **FILE\_GENERIC\_READ** - **                                                                                                FILE\_READ\_DATA** + **FILE\_READ\_DATA** - **                                                                                FILE\_READ\_EA** + **FILE\_READ\_EA** - **                                                                                FILE\_READ\_ATTRIBUTES** + **FILE\_READ\_ATTRIBUTES** **NT AUTHORITY\\SYSTEM:(OI)(CI)F** diff --git a/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md b/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md index 91f9055689..5d812e35d6 100644 --- a/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md +++ b/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md b/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md index 2aca3bc496..3db5f49a03 100644 --- a/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md +++ b/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md b/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md index 6519e09c4a..61a363f290 100644 --- a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md +++ b/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md b/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md index 938c998f17..aded377291 100644 --- a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md +++ b/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md b/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md index d37e201c72..6bea34fef3 100644 --- a/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md +++ b/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md b/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md index 258a58f9b0..463ab388e1 100644 --- a/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md +++ b/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md b/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md index 81edc52790..c63893f150 100644 --- a/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md +++ b/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-delete-a-med-v-image.md b/mdop/medv-v1/how-to-delete-a-med-v-image.md index 0167e493e8..02d9bb6115 100644 --- a/mdop/medv-v1/how-to-delete-a-med-v-image.md +++ b/mdop/medv-v1/how-to-delete-a-med-v-image.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md b/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md index 13cf016d4c..d849956376 100644 --- a/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md +++ b/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md b/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md index a6b40105d0..5eb6dd5c1c 100644 --- a/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md +++ b/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md b/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md index 269980cf59..babf8996d1 100644 --- a/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md +++ b/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-generate-reports-medvv2.md b/mdop/medv-v1/how-to-generate-reports-medvv2.md index 082e4a4e13..e9219aa508 100644 --- a/mdop/medv-v1/how-to-generate-reports-medvv2.md +++ b/mdop/medv-v1/how-to-generate-reports-medvv2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-import-and-export-a-policy.md b/mdop/medv-v1/how-to-import-and-export-a-policy.md index dec165468c..aaa08137dc 100644 --- a/mdop/medv-v1/how-to-import-and-export-a-policy.md +++ b/mdop/medv-v1/how-to-import-and-export-a-policy.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md b/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md index e21097b997..16597d58b2 100644 --- a/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md +++ b/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md b/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md index e84a2751f0..2ab92353b5 100644 --- a/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md +++ b/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md b/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md index 90bf368d23..908b387c82 100644 --- a/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md +++ b/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-install-med-v-clientesds.md b/mdop/medv-v1/how-to-install-med-v-clientesds.md index 57a88f7d96..46cf4d5fea 100644 --- a/mdop/medv-v1/how-to-install-med-v-clientesds.md +++ b/mdop/medv-v1/how-to-install-med-v-clientesds.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-localize-a-med-v-image.md b/mdop/medv-v1/how-to-localize-a-med-v-image.md index e118ce3dc9..b5f0bdf42a 100644 --- a/mdop/medv-v1/how-to-localize-a-med-v-image.md +++ b/mdop/medv-v1/how-to-localize-a-med-v-image.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md b/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md index 41bf6a6b2b..e620f98a5e 100644 --- a/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md +++ b/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-pack-a-med-v-image.md b/mdop/medv-v1/how-to-pack-a-med-v-image.md index 613b801c36..08ccd86ef5 100644 --- a/mdop/medv-v1/how-to-pack-a-med-v-image.md +++ b/mdop/medv-v1/how-to-pack-a-med-v-image.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md b/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md index 755acfb23b..9c9183aebe 100644 --- a/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md +++ b/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md b/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md index 9971961e86..f06380a126 100644 --- a/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md +++ b/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-set-up-script-actions.md b/mdop/medv-v1/how-to-set-up-script-actions.md index 674cc2b942..cff5da73d1 100644 --- a/mdop/medv-v1/how-to-set-up-script-actions.md +++ b/mdop/medv-v1/how-to-set-up-script-actions.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md b/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md index d1d0b3b653..d77de77862 100644 --- a/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md +++ b/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md b/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md index bd490a205c..491c545b20 100644 --- a/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md +++ b/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md b/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md index 20febc9c9a..b765e2f19c 100644 --- a/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md +++ b/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md b/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md index d6d2fd0dd2..125a45d5b6 100644 --- a/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md +++ b/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-update-a-med-v-image.md b/mdop/medv-v1/how-to-update-a-med-v-image.md index bee3310208..742368d6ac 100644 --- a/mdop/medv-v1/how-to-update-a-med-v-image.md +++ b/mdop/medv-v1/how-to-update-a-med-v-image.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md b/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md index b0f1a3f4b5..18cf02c554 100644 --- a/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md +++ b/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md b/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md index bb70d8a60e..cae37d85c9 100644 --- a/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md +++ b/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/how-to-work-with-reports.md b/mdop/medv-v1/how-to-work-with-reports.md index 0747b58a0d..d9c80fd178 100644 --- a/mdop/medv-v1/how-to-work-with-reports.md +++ b/mdop/medv-v1/how-to-work-with-reports.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/identify-the-number-of-med-v-instances.md b/mdop/medv-v1/identify-the-number-of-med-v-instances.md index 2454991da1..1d78567667 100644 --- a/mdop/medv-v1/identify-the-number-of-med-v-instances.md +++ b/mdop/medv-v1/identify-the-number-of-med-v-instances.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/index.md b/mdop/medv-v1/index.md index 807accc058..c056dfeeaf 100644 --- a/mdop/medv-v1/index.md +++ b/mdop/medv-v1/index.md @@ -1,12 +1,12 @@ --- title: Microsoft Enterprise Desktop Virtualization Planning, Deployment, and Operations Guide description: Microsoft Enterprise Desktop Virtualization Planning, Deployment, and Operations Guide -author: jamiejdt +author: dansimp ms.assetid: 7bc3e120-df77-4f4c-bc8e-7aaa4c2a6525 ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/installation-and-upgrade-checklists.md b/mdop/medv-v1/installation-and-upgrade-checklists.md index 48f64681a0..581101261f 100644 --- a/mdop/medv-v1/installation-and-upgrade-checklists.md +++ b/mdop/medv-v1/installation-and-upgrade-checklists.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/installing-and-configuring-med-v-components.md b/mdop/medv-v1/installing-and-configuring-med-v-components.md index 2c3191bd46..8128182f05 100644 --- a/mdop/medv-v1/installing-and-configuring-med-v-components.md +++ b/mdop/medv-v1/installing-and-configuring-med-v-components.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/key-scenarios-for-using-med-v.md b/mdop/medv-v1/key-scenarios-for-using-med-v.md index 206fbcc8f4..377facde64 100644 --- a/mdop/medv-v1/key-scenarios-for-using-med-v.md +++ b/mdop/medv-v1/key-scenarios-for-using-med-v.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/med-v-10-installation-checklist.md b/mdop/medv-v1/med-v-10-installation-checklist.md index 8e68457769..6e306306a6 100644 --- a/mdop/medv-v1/med-v-10-installation-checklist.md +++ b/mdop/medv-v1/med-v-10-installation-checklist.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/med-v-10-release-notesmedv-10.md b/mdop/medv-v1/med-v-10-release-notesmedv-10.md index 993d756655..ba7e8f9ef6 100644 --- a/mdop/medv-v1/med-v-10-release-notesmedv-10.md +++ b/mdop/medv-v1/med-v-10-release-notesmedv-10.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md b/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md index a439dfd41e..dce6ffe881 100644 --- a/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md +++ b/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md b/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md index 60cd668d0c..6beb4ac562 100644 --- a/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md +++ b/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md b/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md index 631070c928..2ae432d713 100644 --- a/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md +++ b/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md b/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md index 3d45628fd0..0ad376e710 100644 --- a/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md +++ b/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/med-v-client-operations.md b/mdop/medv-v1/med-v-client-operations.md index ecc32946a9..e295ac9750 100644 --- a/mdop/medv-v1/med-v-client-operations.md +++ b/mdop/medv-v1/med-v-client-operations.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/med-v-client-toolsv2.md b/mdop/medv-v1/med-v-client-toolsv2.md index 8d763f41b6..a49324c8b9 100644 --- a/mdop/medv-v1/med-v-client-toolsv2.md +++ b/mdop/medv-v1/med-v-client-toolsv2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/med-v-deployment-and-configuration.md b/mdop/medv-v1/med-v-deployment-and-configuration.md index 4360637610..38648cf7f4 100644 --- a/mdop/medv-v1/med-v-deployment-and-configuration.md +++ b/mdop/medv-v1/med-v-deployment-and-configuration.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/med-v-infrastructure-planning-and-design.md b/mdop/medv-v1/med-v-infrastructure-planning-and-design.md index 6ad5828d2b..a0654e7a12 100644 --- a/mdop/medv-v1/med-v-infrastructure-planning-and-design.md +++ b/mdop/medv-v1/med-v-infrastructure-planning-and-design.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/med-v-installation-prerequisites.md b/mdop/medv-v1/med-v-installation-prerequisites.md index ef53525088..08db5ec442 100644 --- a/mdop/medv-v1/med-v-installation-prerequisites.md +++ b/mdop/medv-v1/med-v-installation-prerequisites.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v1/med-v-operations.md b/mdop/medv-v1/med-v-operations.md index 4c5bed949c..c76249664e 100644 --- a/mdop/medv-v1/med-v-operations.md +++ b/mdop/medv-v1/med-v-operations.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/med-v-reporting.md b/mdop/medv-v1/med-v-reporting.md index 079276d2e5..17674e3619 100644 --- a/mdop/medv-v1/med-v-reporting.md +++ b/mdop/medv-v1/med-v-reporting.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md b/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md index e8b68e25fc..1aaecaa5a4 100644 --- a/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md +++ b/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- @@ -32,7 +32,7 @@ You can configure which folders are indexed on the host as part of the Trim Tran When applying new settings, the service must be restarted. -``` syntax +```xml - %WINDIR% diff --git a/mdop/medv-v1/overview-of-med-v.md b/mdop/medv-v1/overview-of-med-v.md index 1630db52bc..0d46bf93a7 100644 --- a/mdop/medv-v1/overview-of-med-v.md +++ b/mdop/medv-v1/overview-of-med-v.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/supported-configurationsmedv-orientation.md b/mdop/medv-v1/supported-configurationsmedv-orientation.md index f05c6462b7..c66ad41ec2 100644 --- a/mdop/medv-v1/supported-configurationsmedv-orientation.md +++ b/mdop/medv-v1/supported-configurationsmedv-orientation.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/technical-referencemedv-10-sp1.md b/mdop/medv-v1/technical-referencemedv-10-sp1.md index aaaad698a3..77b1fc1045 100644 --- a/mdop/medv-v1/technical-referencemedv-10-sp1.md +++ b/mdop/medv-v1/technical-referencemedv-10-sp1.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/troubleshooting-med-v.md b/mdop/medv-v1/troubleshooting-med-v.md index 60afd6e0d8..52b110ec3b 100644 --- a/mdop/medv-v1/troubleshooting-med-v.md +++ b/mdop/medv-v1/troubleshooting-med-v.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/updating-a-med-v-workspace-image.md b/mdop/medv-v1/updating-a-med-v-workspace-image.md index f5095643c7..c030f2922c 100644 --- a/mdop/medv-v1/updating-a-med-v-workspace-image.md +++ b/mdop/medv-v1/updating-a-med-v-workspace-image.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v1/using-the-med-v-management-console-user-interface.md b/mdop/medv-v1/using-the-med-v-management-console-user-interface.md index 9fc4f72eb1..58bf527214 100644 --- a/mdop/medv-v1/using-the-med-v-management-console-user-interface.md +++ b/mdop/medv-v1/using-the-med-v-management-console-user-interface.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/about-med-v-20.md b/mdop/medv-v2/about-med-v-20.md index d93dfacd2d..dd2c32be10 100644 --- a/mdop/medv-v2/about-med-v-20.md +++ b/mdop/medv-v2/about-med-v-20.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/authentication-of-med-v-end-users.md b/mdop/medv-v2/authentication-of-med-v-end-users.md index b9265d581c..843a257c5b 100644 --- a/mdop/medv-v2/authentication-of-med-v-end-users.md +++ b/mdop/medv-v2/authentication-of-med-v-end-users.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/command-line-options-for-med-v-installation-files.md b/mdop/medv-v2/command-line-options-for-med-v-installation-files.md index 414a684521..f6e9a21158 100644 --- a/mdop/medv-v2/command-line-options-for-med-v-installation-files.md +++ b/mdop/medv-v2/command-line-options-for-med-v-installation-files.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md b/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md index 42d933514a..66fc177330 100644 --- a/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md +++ b/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/configure-environment-prerequisites.md b/mdop/medv-v2/configure-environment-prerequisites.md index 23fec1d335..061ec06592 100644 --- a/mdop/medv-v2/configure-environment-prerequisites.md +++ b/mdop/medv-v2/configure-environment-prerequisites.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/configure-installation-prerequisites.md b/mdop/medv-v2/configure-installation-prerequisites.md index 04885dd2fb..efb17dc81e 100644 --- a/mdop/medv-v2/configure-installation-prerequisites.md +++ b/mdop/medv-v2/configure-installation-prerequisites.md @@ -9,7 +9,7 @@ ms.author: dansimp ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md b/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md index 2bae530b8d..eda6a8ccf3 100644 --- a/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md +++ b/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md @@ -1,7 +1,7 @@ --- title: Configuring a Windows Virtual PC Image for MED-V description: Configuring a Windows Virtual PC Image for MED-V -author: levinec +author: dansimp ms.assetid: d87a0df8-9e08-4d1e-bfb0-9dc3cebf0d28 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 11/01/2016 --- diff --git a/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md b/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md index 2cd2f9a102..b3ae9f4dfb 100644 --- a/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md +++ b/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md @@ -1,7 +1,7 @@ --- title: Configuring Advanced Settings by Using Windows PowerShell description: Configuring Advanced Settings by Using Windows PowerShell -author: levinec +author: dansimp ms.assetid: 437a31cc-2a11-456f-b448-b0b869fb53f7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/create-a-med-v-workspace-package.md b/mdop/medv-v2/create-a-med-v-workspace-package.md index 7dac2edf43..246603d1cd 100644 --- a/mdop/medv-v2/create-a-med-v-workspace-package.md +++ b/mdop/medv-v2/create-a-med-v-workspace-package.md @@ -1,7 +1,7 @@ --- title: Create a MED-V Workspace Package description: Create a MED-V Workspace Package -author: levinec +author: dansimp ms.assetid: 3f75fe73-41ac-4389-ae21-5efb2d437f4d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md b/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md index b3ff8ab2d9..fbc30d458a 100644 --- a/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md +++ b/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md @@ -1,7 +1,7 @@ --- title: Creating a Windows Virtual PC Image for MED-V description: Creating a Windows Virtual PC Image for MED-V -author: levinec +author: dansimp ms.assetid: fd7c0b1a-0769-4e7b-ad1a-dad19cca081f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/define-and-plan-your-med-v-deployment.md b/mdop/medv-v2/define-and-plan-your-med-v-deployment.md index 0b0e1a18e9..a45e18f101 100644 --- a/mdop/medv-v2/define-and-plan-your-med-v-deployment.md +++ b/mdop/medv-v2/define-and-plan-your-med-v-deployment.md @@ -1,7 +1,7 @@ --- title: Define and Plan your MED-V Deployment description: Define and Plan your MED-V Deployment -author: levinec +author: dansimp ms.assetid: a90945cc-dc37-4548-963d-e0c6f8ba0467 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/deploy-the-med-v-components.md b/mdop/medv-v2/deploy-the-med-v-components.md index 607d552f9d..59af8e81b0 100644 --- a/mdop/medv-v2/deploy-the-med-v-components.md +++ b/mdop/medv-v2/deploy-the-med-v-components.md @@ -1,7 +1,7 @@ --- title: Deploy the MED-V Components description: Deploy the MED-V Components -author: levinec +author: dansimp ms.assetid: fc2c5ef2-9c71-412a-8f6c-93df248f77d6 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/deploying-the-med-v-workspace-package.md b/mdop/medv-v2/deploying-the-med-v-workspace-package.md index 5296ed863d..9db9c7a967 100644 --- a/mdop/medv-v2/deploying-the-med-v-workspace-package.md +++ b/mdop/medv-v2/deploying-the-med-v-workspace-package.md @@ -1,7 +1,7 @@ --- title: Deploying the MED-V Workspace Package description: Deploying the MED-V Workspace Package -author: levinec +author: dansimp ms.assetid: f314425a-d60f-4b8d-b71f-d13d1da9297f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/deployment-of-med-v.md b/mdop/medv-v2/deployment-of-med-v.md index 9bd5ad5ee3..76cbc0aeff 100644 --- a/mdop/medv-v2/deployment-of-med-v.md +++ b/mdop/medv-v2/deployment-of-med-v.md @@ -1,7 +1,7 @@ --- title: Deployment of MED-V description: Deployment of MED-V -author: levinec +author: dansimp ms.assetid: 52ea8ae4-ec2e-4cb8-ab38-e6400f47d3ba ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/deployment-troubleshooting.md b/mdop/medv-v2/deployment-troubleshooting.md index 3556aa5667..5d411f2928 100644 --- a/mdop/medv-v2/deployment-troubleshooting.md +++ b/mdop/medv-v2/deployment-troubleshooting.md @@ -1,7 +1,7 @@ --- title: Deployment Troubleshooting description: Deployment Troubleshooting -author: levinec +author: dansimp ms.assetid: 9ee980f2-4e77-4020-9f0e-8c2ffdc390ad ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md b/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md index f8f174a569..d5a05dd4ef 100644 --- a/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md +++ b/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md @@ -1,7 +1,7 @@ --- title: Detecting Network Changes that Affect MED-V description: Detecting Network Changes that Affect MED-V -author: levinec +author: dansimp ms.assetid: fd29b95a-cda2-464d-b86d-50b6bd64b4ca ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/determining-how-med-v-will-be-deployed.md b/mdop/medv-v2/determining-how-med-v-will-be-deployed.md index 84034b795d..3c8e2d21f2 100644 --- a/mdop/medv-v2/determining-how-med-v-will-be-deployed.md +++ b/mdop/medv-v2/determining-how-med-v-will-be-deployed.md @@ -1,7 +1,7 @@ --- title: Determining How MED-V Will Be Deployed description: Determining How MED-V Will Be Deployed -author: levinec +author: dansimp ms.assetid: addbfef6-799e-4fe7-87d2-7e096a5ef5a5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md b/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md index 1b2a195147..4daddcb6d0 100644 --- a/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md +++ b/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md @@ -1,7 +1,7 @@ --- title: End-to-End Deployment Scenario for MED-V 2.0 description: End-to-End Deployment Scenario for MED-V 2.0 -author: levinec +author: dansimp ms.assetid: 91bb5a9a-5fb1-4743-8494-9d4dee2ec222 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md b/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md index 508bff53d9..65d35893fa 100644 --- a/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md +++ b/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md @@ -1,7 +1,7 @@ --- title: End-to-End Operations Scenario for MED-V 2.0 description: End-to-End Operations Scenario for MED-V 2.0 -author: levinec +author: dansimp ms.assetid: 1d87f5f3-9fc5-4731-8bd1-c155714f34ee ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md b/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md index fb7cb8a0c5..f307f40682 100644 --- a/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md +++ b/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md @@ -1,7 +1,7 @@ --- title: End-to-End Planning Scenario for MED-V 2.0 description: End-to-End Planning Scenario for MED-V 2.0 -author: levinec +author: dansimp ms.assetid: e7833883-be93-4b42-9fa3-5c4d9a919058 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/example-med-v-checklists.md b/mdop/medv-v2/example-med-v-checklists.md index 9f0a743c5f..49b270971b 100644 --- a/mdop/medv-v2/example-med-v-checklists.md +++ b/mdop/medv-v2/example-med-v-checklists.md @@ -1,7 +1,7 @@ --- title: Example MED-V Checklists description: Example MED-V Checklists -author: levinec +author: dansimp ms.assetid: cf9c33e8-1b7a-4306-92f6-edbb70ab23b5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/example-med-v-environment-planning-checklist.md b/mdop/medv-v2/example-med-v-environment-planning-checklist.md index 4a91991ac1..41281617c0 100644 --- a/mdop/medv-v2/example-med-v-environment-planning-checklist.md +++ b/mdop/medv-v2/example-med-v-environment-planning-checklist.md @@ -1,7 +1,7 @@ --- title: Example MED-V Environment Planning Checklist description: Example MED-V Environment Planning Checklist -author: levinec +author: dansimp ms.assetid: 877d1660-abef-4e81-ab3a-a8a3ec181d26 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/example-med-v-image-preparation-checklist.md b/mdop/medv-v2/example-med-v-image-preparation-checklist.md index d1ddce73d0..c9b913604f 100644 --- a/mdop/medv-v2/example-med-v-image-preparation-checklist.md +++ b/mdop/medv-v2/example-med-v-image-preparation-checklist.md @@ -1,7 +1,7 @@ --- title: Example MED-V Image Preparation Checklist description: Example MED-V Image Preparation Checklist -author: levinec +author: dansimp ms.assetid: d69f252f-624b-439e-814b-b68cdaf7d582 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/example-med-v-project-planning-checklist.md b/mdop/medv-v2/example-med-v-project-planning-checklist.md index b0a5d1d39b..30003b57dd 100644 --- a/mdop/medv-v2/example-med-v-project-planning-checklist.md +++ b/mdop/medv-v2/example-med-v-project-planning-checklist.md @@ -1,7 +1,7 @@ --- title: Example MED-V Project Planning Checklist description: Example MED-V Project Planning Checklist -author: levinec +author: dansimp ms.assetid: 2b599bcb-1808-43ba-a689-1642bda24511 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/example-med-v-system-installation-checklist.md b/mdop/medv-v2/example-med-v-system-installation-checklist.md index de3ca2a590..1ca51ad940 100644 --- a/mdop/medv-v2/example-med-v-system-installation-checklist.md +++ b/mdop/medv-v2/example-med-v-system-installation-checklist.md @@ -1,7 +1,7 @@ --- title: Example MED-V System Installation Checklist description: Example MED-V System Installation Checklist -author: levinec +author: dansimp ms.assetid: 9e5673ba-dee4-4680-9c57-a149beab14d3 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md b/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md index f86a94139f..d8328a1021 100644 --- a/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md +++ b/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md @@ -1,7 +1,7 @@ --- title: Example MED-V Workspace Deployment Checklist description: Example MED-V Workspace Deployment Checklist -author: levinec +author: dansimp ms.assetid: d8857883-9b2d-40ac-9136-59e4e20e02fe ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/getting-started-with-med-vmedv2.md b/mdop/medv-v2/getting-started-with-med-vmedv2.md index de6c48b1d5..e1cc6d20f7 100644 --- a/mdop/medv-v2/getting-started-with-med-vmedv2.md +++ b/mdop/medv-v2/getting-started-with-med-vmedv2.md @@ -1,7 +1,7 @@ --- title: Getting Started with MED-V description: Getting Started with MED-V -author: levinec +author: dansimp ms.assetid: 283734d7-231c-45b6-92c9-c95a46ec3628 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/high-level-architecturemedv2.md b/mdop/medv-v2/high-level-architecturemedv2.md index a5adeabb7e..0349fc5e99 100644 --- a/mdop/medv-v2/high-level-architecturemedv2.md +++ b/mdop/medv-v2/high-level-architecturemedv2.md @@ -1,7 +1,7 @@ --- title: High-Level Architecture description: High-Level Architecture -author: levinec +author: dansimp ms.assetid: a00edb9f-207b-4f32-9e8f-522ea2739d2f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md b/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md index 0821577e21..f6f51a257c 100644 --- a/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md +++ b/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md @@ -1,7 +1,7 @@ --- title: How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace description: How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace -author: levinec +author: dansimp ms.assetid: bf55848d-bf77-452e-aaa5-4dd4868ff5bd ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 11/01/2016 --- diff --git a/mdop/medv-v2/how-to-create-a-test-environment.md b/mdop/medv-v2/how-to-create-a-test-environment.md index 18068b07ed..2e3bdbf84b 100644 --- a/mdop/medv-v2/how-to-create-a-test-environment.md +++ b/mdop/medv-v2/how-to-create-a-test-environment.md @@ -1,7 +1,7 @@ --- title: How to Create a Test Environment description: How to Create a Test Environment -author: levinec +author: dansimp ms.assetid: a0db2299-16f3-4516-8769-7d55ca4a1e98 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md index 550099841d..1d02488513 100644 --- a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md +++ b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md @@ -1,7 +1,7 @@ --- title: How to Deploy a MED-V Workspace in a Windows 7 Image description: How to Deploy a MED-V Workspace in a Windows 7 Image -author: levinec +author: dansimp ms.assetid: a83aba4e-8681-4906-9872-f431c0bb15f9 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md index da44b5f136..f9f754df22 100644 --- a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md +++ b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md @@ -1,7 +1,7 @@ --- title: How to Deploy a MED-V Workspace Manually description: How to Deploy a MED-V Workspace Manually -author: levinec +author: dansimp ms.assetid: 94bfb209-2230-49b6-bb40-9c6ab088dbf4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md index 7d9e7b0536..b272e8779c 100644 --- a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md +++ b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md @@ -1,7 +1,7 @@ --- title: How to Deploy a MED-V Workspace Through an Electronic Software Distribution System description: How to Deploy a MED-V Workspace Through an Electronic Software Distribution System -author: levinec +author: dansimp ms.assetid: b5134c35-e1de-470c-93f8-ead6218d9dce ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md b/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md index 9271b1face..715d961e5b 100644 --- a/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md +++ b/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md @@ -1,7 +1,7 @@ --- title: How to Deploy the MED-V Components Through an Electronic Software Distribution System description: How to Deploy the MED-V Components Through an Electronic Software Distribution System -author: levinec +author: dansimp ms.assetid: 8a800bdf-6fa4-47b4-b417-df053289d4e8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 11/01/2016 --- diff --git a/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md b/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md index 581db9047a..dfbd8cf0b3 100644 --- a/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md +++ b/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md @@ -1,7 +1,7 @@ --- title: How to Install the MED-V Workspace Packager description: How to Install the MED-V Workspace Packager -author: levinec +author: dansimp ms.assetid: 627478e9-6798-4b32-9a50-7a1b72bea295 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md b/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md index b933cc1510..6bb5aea367 100644 --- a/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md +++ b/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md @@ -1,7 +1,7 @@ --- title: How to Manage URL Redirection by Using the MED-V Workspace Packager description: How to Manage URL Redirection by Using the MED-V Workspace Packager -author: levinec +author: dansimp ms.assetid: 1a8d25af-479f-42d3-bf5f-c7fd974bbf8c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md b/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md index a8214e0d7a..f307753ca2 100644 --- a/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md +++ b/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md @@ -1,7 +1,7 @@ --- title: How to Manually Install the MED-V Host Agent description: How to Manually Install the MED-V Host Agent -author: levinec +author: dansimp ms.assetid: 4becc90b-6481-4e1f-a4d3-aec74c8821ec ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md b/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md index 5708a84057..b586bdbc0c 100644 --- a/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md +++ b/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md @@ -1,7 +1,7 @@ --- title: How to Publish and Unpublish an Application on the MED-V Workspace description: How to Publish and Unpublish an Application on the MED-V Workspace -author: levinec +author: dansimp ms.assetid: fd5a62e9-0577-44d2-ae17-61c0aef78ce8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/how-to-test-application-publishing.md b/mdop/medv-v2/how-to-test-application-publishing.md index 0e21fda4c9..40a15dfa19 100644 --- a/mdop/medv-v2/how-to-test-application-publishing.md +++ b/mdop/medv-v2/how-to-test-application-publishing.md @@ -1,7 +1,7 @@ --- title: How to Test Application Publishing description: How to Test Application Publishing -author: levinec +author: dansimp ms.assetid: 17ba2e12-50a0-4f41-8300-f61f09db9f6c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 11/01/2016 --- diff --git a/mdop/medv-v2/how-to-test-url-redirection.md b/mdop/medv-v2/how-to-test-url-redirection.md index e003cb9d88..fd02148316 100644 --- a/mdop/medv-v2/how-to-test-url-redirection.md +++ b/mdop/medv-v2/how-to-test-url-redirection.md @@ -1,7 +1,7 @@ --- title: How to Test URL Redirection description: How to Test URL Redirection -author: levinec +author: dansimp ms.assetid: 38d80088-da1d-4098-b27e-76f9e78f81dc ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 11/01/2016 --- diff --git a/mdop/medv-v2/how-to-uninstall-the-med-v-components.md b/mdop/medv-v2/how-to-uninstall-the-med-v-components.md index 9a514186e2..ec1b2c9d2d 100644 --- a/mdop/medv-v2/how-to-uninstall-the-med-v-components.md +++ b/mdop/medv-v2/how-to-uninstall-the-med-v-components.md @@ -1,7 +1,7 @@ --- title: How to Uninstall the MED-V Components description: How to Uninstall the MED-V Components -author: levinec +author: dansimp ms.assetid: c121dd27-6b2f-4d41-a21a-c6e8608c5c41 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/how-to-verify-first-time-setup-settings.md b/mdop/medv-v2/how-to-verify-first-time-setup-settings.md index e7f28b9e80..47c2626a8b 100644 --- a/mdop/medv-v2/how-to-verify-first-time-setup-settings.md +++ b/mdop/medv-v2/how-to-verify-first-time-setup-settings.md @@ -1,7 +1,7 @@ --- title: How to Verify First Time Setup Settings description: How to Verify First Time Setup Settings -author: levinec +author: dansimp ms.assetid: e8a07d4c-5786-4455-ac43-2deac4042efd ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md b/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md index 99eeb385f5..31c02591be 100644 --- a/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md +++ b/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md @@ -1,7 +1,7 @@ --- title: Identifying the Number and Types of MED-V Workspaces description: Identifying the Number and Types of MED-V Workspaces -author: levinec +author: dansimp ms.assetid: 11642253-6b1f-4c4a-a11e-48d8a360e1ea ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/index.md b/mdop/medv-v2/index.md index 5c86cb32d1..aa6fcbf448 100644 --- a/mdop/medv-v2/index.md +++ b/mdop/medv-v2/index.md @@ -1,12 +1,12 @@ --- title: Microsoft Enterprise Desktop Virtualization 2.0 description: Microsoft Enterprise Desktop Virtualization 2.0 -author: jamiejdt +author: dansimp ms.assetid: 84109be0-4613-42e9-85fc-fcda8de6e4c4 ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md b/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md index 6a9fb7c44b..6c12965962 100644 --- a/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md +++ b/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md @@ -1,7 +1,7 @@ --- title: Installing and Removing an Application on the MED-V Workspace description: Installing and Removing an Application on the MED-V Workspace -author: levinec +author: dansimp ms.assetid: 24f32720-51ab-4385-adfe-4f5a65e45fdf ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md b/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md index fc9d0a46a6..e98aa04fb2 100644 --- a/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md +++ b/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md @@ -1,7 +1,7 @@ --- title: Installing Applications on a Windows Virtual PC Image description: Installing Applications on a Windows Virtual PC Image -author: levinec +author: dansimp ms.assetid: 32651eff-e3c6-4ef4-947d-2beddc695eac ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/manage-med-v-url-redirection.md b/mdop/medv-v2/manage-med-v-url-redirection.md index d55c3d0b60..e5c040b671 100644 --- a/mdop/medv-v2/manage-med-v-url-redirection.md +++ b/mdop/medv-v2/manage-med-v-url-redirection.md @@ -1,7 +1,7 @@ --- title: Manage MED-V URL Redirection description: Manage MED-V URL Redirection -author: levinec +author: dansimp ms.assetid: 274161c0-b54a-4364-bb63-89996afccd04 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/manage-med-v-workspace-applications.md b/mdop/medv-v2/manage-med-v-workspace-applications.md index 59211673e6..0763341fda 100644 --- a/mdop/medv-v2/manage-med-v-workspace-applications.md +++ b/mdop/medv-v2/manage-med-v-workspace-applications.md @@ -1,7 +1,7 @@ --- title: Manage MED-V Workspace Applications description: Manage MED-V Workspace Applications -author: levinec +author: dansimp ms.assetid: f58c7504-a77a-41a8-ac38-7e618da131fb ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/manage-med-v-workspace-settings.md b/mdop/medv-v2/manage-med-v-workspace-settings.md index 6161aed548..525cda4fc4 100644 --- a/mdop/medv-v2/manage-med-v-workspace-settings.md +++ b/mdop/medv-v2/manage-med-v-workspace-settings.md @@ -1,7 +1,7 @@ --- title: Manage MED-V Workspace Settings description: Manage MED-V Workspace Settings -author: levinec +author: dansimp ms.assetid: 35ebd16e-31c7-4996-81be-af1d56346803 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md b/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md index 7d71f89c65..b0f0205aff 100644 --- a/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md +++ b/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md @@ -1,7 +1,7 @@ --- title: Managing Applications Deployed to MED-V Workspaces description: Managing Applications Deployed to MED-V Workspaces -author: levinec +author: dansimp ms.assetid: 9a9bcdf5-0aa7-42a3-b6f0-6065adb01bcb ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md b/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md index ccc7f402df..0faa8153bc 100644 --- a/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md +++ b/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md @@ -1,7 +1,7 @@ --- title: Managing Automatic Updates for MED-V Workspaces description: Managing Automatic Updates for MED-V Workspaces -author: levinec +author: dansimp ms.assetid: 306f28a2-d653-480d-b737-4b8b3132de5d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md b/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md index c9a2d28a4c..8fec90798f 100644 --- a/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md +++ b/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md @@ -1,7 +1,7 @@ --- title: Managing MED-V Workspace Configuration Settings description: Managing MED-V Workspace Configuration Settings -author: levinec +author: dansimp ms.assetid: 517d04de-c31f-4b50-b2b3-5f8c312ed37b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md b/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md index 4ceab3afe3..c20db2b59c 100644 --- a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md +++ b/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md @@ -1,7 +1,7 @@ --- title: Managing MED-V Workspace Settings by Using a WMI description: Managing MED-V Workspace Settings by Using a WMI -author: levinec +author: dansimp ms.assetid: 05a665a3-2309-46c1-babb-a3e3bbb0b1f9 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md b/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md index f82ac07a75..561bba1d57 100644 --- a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md +++ b/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md @@ -1,7 +1,7 @@ --- title: Managing MED-V Workspace Settings by Using the MED-V Workspace Packager description: Managing MED-V Workspace Settings by Using the MED-V Workspace Packager -author: levinec +author: dansimp ms.assetid: e4b2c516-b9f8-44f9-9eae-caac6c2af3e7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md b/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md index cf173e2d6d..31618c4d43 100644 --- a/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md +++ b/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md @@ -1,7 +1,7 @@ --- title: Managing Printers on a MED-V Workspace description: Managing Printers on a MED-V Workspace -author: levinec +author: dansimp ms.assetid: ba0a65ad-444f-4d18-95eb-8b9fa1a3ffba ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md b/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md index 4dd09c0751..39d497dd06 100644 --- a/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md +++ b/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md @@ -1,7 +1,7 @@ --- title: Managing Software Updates for MED-V Workspaces description: Managing Software Updates for MED-V Workspaces -author: levinec +author: dansimp ms.assetid: a28d6dcd-cb9f-46ba-8dac-1d990837a3a3 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/med-v-20-best-practices.md b/mdop/medv-v2/med-v-20-best-practices.md index e402342e9f..abdc959702 100644 --- a/mdop/medv-v2/med-v-20-best-practices.md +++ b/mdop/medv-v2/med-v-20-best-practices.md @@ -1,7 +1,7 @@ --- title: MED-V 2.0 Best Practices description: MED-V 2.0 Best Practices -author: levinec +author: dansimp ms.assetid: 47ba2dd1-6c6e-4d6e-8e18-b42291f8e02a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/med-v-20-deployment-overview.md b/mdop/medv-v2/med-v-20-deployment-overview.md index eb8d227f1d..0d86bae8b1 100644 --- a/mdop/medv-v2/med-v-20-deployment-overview.md +++ b/mdop/medv-v2/med-v-20-deployment-overview.md @@ -1,7 +1,7 @@ --- title: MED-V 2.0 Deployment Overview description: MED-V 2.0 Deployment Overview -author: levinec +author: dansimp ms.assetid: 0b8998ea-c46f-4c81-a304-f380b2ed7cf8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/med-v-20-release-notes.md b/mdop/medv-v2/med-v-20-release-notes.md index 51c9d5c1c7..aaca3dffee 100644 --- a/mdop/medv-v2/med-v-20-release-notes.md +++ b/mdop/medv-v2/med-v-20-release-notes.md @@ -1,7 +1,7 @@ --- title: MED-V 2.0 Release Notes description: MED-V 2.0 Release Notes -author: levinec +author: dansimp ms.assetid: b8f7d938-566e-434c-b4b8-28b67cdfd0b1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/med-v-20-supported-configurations.md b/mdop/medv-v2/med-v-20-supported-configurations.md index f3b1110fd8..c5c082066d 100644 --- a/mdop/medv-v2/med-v-20-supported-configurations.md +++ b/mdop/medv-v2/med-v-20-supported-configurations.md @@ -1,7 +1,7 @@ --- title: MED-V 2.0 Supported Configurations description: MED-V 2.0 Supported Configurations -author: levinec +author: dansimp ms.assetid: 88f1d232-aa01-45ab-8da7-d086269250b5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/med-v-event-log-messages.md b/mdop/medv-v2/med-v-event-log-messages.md index 0eaa2bebad..03c64897de 100644 --- a/mdop/medv-v2/med-v-event-log-messages.md +++ b/mdop/medv-v2/med-v-event-log-messages.md @@ -1,7 +1,7 @@ --- title: MED-V Event Log Messages description: MED-V Event Log Messages -author: levinec +author: dansimp ms.assetid: 7ba7344d-153b-4cc4-a00a-5d42aee9986b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/monitor-med-v-workspaces.md b/mdop/medv-v2/monitor-med-v-workspaces.md index f2c3f0b9f9..127f1a75a5 100644 --- a/mdop/medv-v2/monitor-med-v-workspaces.md +++ b/mdop/medv-v2/monitor-med-v-workspaces.md @@ -1,7 +1,7 @@ --- title: Monitor MED-V Workspaces description: Monitor MED-V Workspaces -author: levinec +author: dansimp ms.assetid: f514afe2-8add-4105-9520-1a491733fa79 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/monitoring-med-v-workspace-deployments.md b/mdop/medv-v2/monitoring-med-v-workspace-deployments.md index 13c103bc84..c34b7c9663 100644 --- a/mdop/medv-v2/monitoring-med-v-workspace-deployments.md +++ b/mdop/medv-v2/monitoring-med-v-workspace-deployments.md @@ -1,7 +1,7 @@ --- title: Monitoring MED-V Workspace Deployments description: Monitoring MED-V Workspace Deployments -author: levinec +author: dansimp ms.assetid: 5de0cb06-b8a9-48a5-b8b3-836954295765 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/operations-for-med-v.md b/mdop/medv-v2/operations-for-med-v.md index adce3aa597..b123f6ab79 100644 --- a/mdop/medv-v2/operations-for-med-v.md +++ b/mdop/medv-v2/operations-for-med-v.md @@ -1,7 +1,7 @@ --- title: Operations for MED-V description: Operations for MED-V -author: levinec +author: dansimp ms.assetid: 8f3f367d-fa9d-4468-814a-f0495adfaea4 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/operations-troubleshooting-medv2.md b/mdop/medv-v2/operations-troubleshooting-medv2.md index e32475aae0..9d937f3ad8 100644 --- a/mdop/medv-v2/operations-troubleshooting-medv2.md +++ b/mdop/medv-v2/operations-troubleshooting-medv2.md @@ -1,7 +1,7 @@ --- title: Operations Troubleshooting description: Operations Troubleshooting -author: levinec +author: dansimp ms.assetid: 948d7869-accd-44da-974f-93409234dee7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/overview-of-med-vmedv2.md b/mdop/medv-v2/overview-of-med-vmedv2.md index 41fe819b84..284394fac4 100644 --- a/mdop/medv-v2/overview-of-med-vmedv2.md +++ b/mdop/medv-v2/overview-of-med-vmedv2.md @@ -1,7 +1,7 @@ --- title: Overview of MED-V description: Overview of MED-V -author: levinec +author: dansimp ms.assetid: 393daa9b-2d76-43e1-861a-9d8c00f68cf6 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/planning-for-application-operating-system-compatibility.md b/mdop/medv-v2/planning-for-application-operating-system-compatibility.md index d45cb683cb..cd729437ec 100644 --- a/mdop/medv-v2/planning-for-application-operating-system-compatibility.md +++ b/mdop/medv-v2/planning-for-application-operating-system-compatibility.md @@ -1,7 +1,7 @@ --- title: Planning for Application Operating System Compatibility description: Planning for Application Operating System Compatibility -author: levinec +author: dansimp ms.assetid: cdb0a7f0-9da4-4562-8277-12972eb0fea8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/planning-for-med-v.md b/mdop/medv-v2/planning-for-med-v.md index 9d40fa4ef6..ec8790d025 100644 --- a/mdop/medv-v2/planning-for-med-v.md +++ b/mdop/medv-v2/planning-for-med-v.md @@ -1,7 +1,7 @@ --- title: Planning for MED-V description: Planning for MED-V -author: levinec +author: dansimp ms.assetid: 8124b765-6930-4607-8bd9-93068403c7a2 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/prepare-a-med-v-image.md b/mdop/medv-v2/prepare-a-med-v-image.md index 2796dbedaa..e5b50af281 100644 --- a/mdop/medv-v2/prepare-a-med-v-image.md +++ b/mdop/medv-v2/prepare-a-med-v-image.md @@ -1,7 +1,7 @@ --- title: Prepare a MED-V Image description: Prepare a MED-V Image -author: levinec +author: dansimp ms.assetid: 1bc757e5-8aef-4163-8542-1bdccc028961 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md b/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md index 7eb0e906c5..3aa06de98d 100644 --- a/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md +++ b/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md @@ -1,7 +1,7 @@ --- title: Prepare the Deployment Environment for MED-V description: Prepare the Deployment Environment for MED-V -author: levinec +author: dansimp ms.assetid: d15ea370-7fdb-4852-a1ba-730ec7568e3e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md b/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md index 4a1f38168d..3b78792e33 100644 --- a/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md +++ b/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md @@ -1,7 +1,7 @@ --- title: Restarting and Resetting a MED-V Workspace description: Restarting and Resetting a MED-V Workspace -author: levinec +author: dansimp ms.assetid: a959cdb3-a727-47c7-967e-e58f224e74de ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/security-and-protection-for-med-v.md b/mdop/medv-v2/security-and-protection-for-med-v.md index c05c03ed27..8f046a1720 100644 --- a/mdop/medv-v2/security-and-protection-for-med-v.md +++ b/mdop/medv-v2/security-and-protection-for-med-v.md @@ -1,7 +1,7 @@ --- title: Security and Protection for MED-V description: Security and Protection for MED-V -author: levinec +author: dansimp ms.assetid: 5db66d56-eb65-4bff-a9e4-3d52de4256bd ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/security-best-practices-for-med-v-operations.md b/mdop/medv-v2/security-best-practices-for-med-v-operations.md index fa5a61b526..7dbb08a888 100644 --- a/mdop/medv-v2/security-best-practices-for-med-v-operations.md +++ b/mdop/medv-v2/security-best-practices-for-med-v-operations.md @@ -1,7 +1,7 @@ --- title: Security Best Practices for MED-V Operations description: Security Best Practices for MED-V Operations -author: levinec +author: dansimp ms.assetid: 231e2b9a-8b49-42fe-93b5-2ef12fe17bac ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/technical-reference-for-med-v.md b/mdop/medv-v2/technical-reference-for-med-v.md index b273ebdd42..bf11849a4e 100644 --- a/mdop/medv-v2/technical-reference-for-med-v.md +++ b/mdop/medv-v2/technical-reference-for-med-v.md @@ -1,7 +1,7 @@ --- title: Technical Reference for MED-V description: Technical Reference for MED-V -author: levinec +author: dansimp ms.assetid: 52aa15ae-6ca8-4494-8660-313c7b723406 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md b/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md index d8d48b7fc4..7952fd2f90 100644 --- a/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md +++ b/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md @@ -1,7 +1,7 @@ --- title: Test And Deploy the MED-V Workspace Package description: Test And Deploy the MED-V Workspace Package -author: levinec +author: dansimp ms.assetid: 0238dea7-a08c-4859-b8b1-2b52bc63fda6 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/testing-the-med-v-workspace-package.md b/mdop/medv-v2/testing-the-med-v-workspace-package.md index 4833b54dea..3297a9e056 100644 --- a/mdop/medv-v2/testing-the-med-v-workspace-package.md +++ b/mdop/medv-v2/testing-the-med-v-workspace-package.md @@ -1,7 +1,7 @@ --- title: Testing the MED-V Workspace Package description: Testing the MED-V Workspace Package -author: levinec +author: dansimp ms.assetid: 83edcb6e-9615-4d18-96b8-f085a647294e ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md b/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md index 9eec10ced2..3133cf4586 100644 --- a/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md +++ b/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md @@ -1,7 +1,7 @@ --- title: Troubleshooting MED-V by Using the Administration Toolkit description: Troubleshooting MED-V by Using the Administration Toolkit -author: levinec +author: dansimp ms.assetid: 6c096a1c-b9ce-4ec7-8dfd-5286e3b9a617 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/troubleshooting-med-vmedv2.md b/mdop/medv-v2/troubleshooting-med-vmedv2.md index 68e73550f9..fb9c8989f9 100644 --- a/mdop/medv-v2/troubleshooting-med-vmedv2.md +++ b/mdop/medv-v2/troubleshooting-med-vmedv2.md @@ -1,7 +1,7 @@ --- title: Troubleshooting MED-V description: Troubleshooting MED-V -author: levinec +author: dansimp ms.assetid: 4502d62b-a7db-4f83-81e2-23fd8b0820e1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/updating-med-v-20.md b/mdop/medv-v2/updating-med-v-20.md index 7d18165a6a..6ba790263a 100644 --- a/mdop/medv-v2/updating-med-v-20.md +++ b/mdop/medv-v2/updating-med-v-20.md @@ -1,7 +1,7 @@ --- title: Updating MED-V 2.0 description: Updating MED-V 2.0 -author: levinec +author: dansimp ms.assetid: beea2f54-42d7-4a17-98e0-d243a8562265 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/viewing-and-configuring-med-v-logs.md b/mdop/medv-v2/viewing-and-configuring-med-v-logs.md index 831ec64b9b..25dbdb5885 100644 --- a/mdop/medv-v2/viewing-and-configuring-med-v-logs.md +++ b/mdop/medv-v2/viewing-and-configuring-med-v-logs.md @@ -1,7 +1,7 @@ --- title: Viewing and Configuring MED-V Logs description: Viewing and Configuring MED-V Logs -author: levinec +author: dansimp ms.assetid: a15537ce-981d-4f55-9c3c-e7fbf94b8fe5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/viewing-med-v-workspace-configurations.md b/mdop/medv-v2/viewing-med-v-workspace-configurations.md index 8f95dc130d..94f19acf18 100644 --- a/mdop/medv-v2/viewing-med-v-workspace-configurations.md +++ b/mdop/medv-v2/viewing-med-v-workspace-configurations.md @@ -1,7 +1,7 @@ --- title: Viewing MED-V Workspace Configurations description: Viewing MED-V Workspace Configurations -author: levinec +author: dansimp ms.assetid: 5de6cf04-6beb-4ac9-ad52-26ac8c0c8ce6 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/whats-new-in-med-v-20.md b/mdop/medv-v2/whats-new-in-med-v-20.md index 2068ac978f..74b4b120b7 100644 --- a/mdop/medv-v2/whats-new-in-med-v-20.md +++ b/mdop/medv-v2/whats-new-in-med-v-20.md @@ -1,7 +1,7 @@ --- title: What's New in MED-V 2.0 description: What's New in MED-V 2.0 -author: levinec +author: dansimp ms.assetid: 53b10bff-2b6f-463b-bdc2-5edc56526792 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md b/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md index 6b98064476..17d50062b8 100644 --- a/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md +++ b/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md @@ -1,7 +1,7 @@ --- title: Windows Virtual PC Application Exclude List description: Windows Virtual PC Application Exclude List -author: levinec +author: dansimp ms.assetid: 7715f198-f5ed-421e-8740-0cec2ca4ece3 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w7 +ms.prod: w10 ms.date: 04/28/2017 --- diff --git a/mdop/softgrid-application-virtualization.md b/mdop/softgrid-application-virtualization.md index a7950b25d2..77aeb74b9c 100644 --- a/mdop/softgrid-application-virtualization.md +++ b/mdop/softgrid-application-virtualization.md @@ -1,7 +1,7 @@ --- title: SoftGrid Application Virtualization description: SoftGrid Application Virtualization -author: eavena +author: dansimp ms.pagetype: mdop ms.mktglfcycl: manage ms.sitesec: library diff --git a/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md b/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md index d5e3224942..b5c114dda1 100644 --- a/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md +++ b/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md @@ -1,7 +1,7 @@ --- title: Application Publishing and Client Interaction for App-V 5 description: Application Publishing and Client Interaction for App-V 5 -author: levinec +author: dansimp ms.assetid: 9854afdc-00f9-40ec-8275-d168e5151286 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md b/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md index b2c6ffe718..481320f97b 100644 --- a/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md +++ b/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md @@ -1,7 +1,7 @@ --- title: Creating App-V 4.5 Databases Using SQL Scripting description: Creating App-V 4.5 Databases Using SQL Scripting -author: levinec +author: dansimp ms.assetid: 6cd0b180-163e-463f-a658-939ab9a7cfa1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md b/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md index 080458ef89..f59bc0582f 100644 --- a/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md +++ b/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md @@ -1,7 +1,7 @@ --- title: How to Download and Deploy MDOP Group Policy (.admx) Templates description: How to Download and Deploy MDOP Group Policy (.admx) Templates -author: levinec +author: dansimp ms.assetid: fdb64505-6c66-4fdf-ad74-a6a161191e3f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/15/2018 --- @@ -23,7 +23,7 @@ You can manage the feature settings of certain Microsoft Desktop Optimization Pa **How to download and deploy the MDOP Group Policy templates** -1. Download the latest [MDOP Group Policy templates](https://www.microsoft.com/en-us/download/details.aspx?id=55531) +1. Download the latest [MDOP Group Policy templates](https://www.microsoft.com/download/details.aspx?id=55531) 2. Expand the downloaded .cab file by running `expand \MDOP_ADMX_Templates.cab -F:* ` diff --git a/mdop/solutions/index.md b/mdop/solutions/index.md index 6183633995..20c7e2da8e 100644 --- a/mdop/solutions/index.md +++ b/mdop/solutions/index.md @@ -1,12 +1,12 @@ --- title: MDOP Solutions and Scenarios description: MDOP Solutions and Scenarios -author: jamiejdt +author: dansimp ms.assetid: 1cb18bef-fbae-4e96-a4f1-90cf111c3b5f ms.pagetype: mdop ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md b/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md index 29150aab71..14aadfc522 100644 --- a/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md +++ b/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md @@ -1,7 +1,7 @@ --- title: Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0 description: Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0 -author: levinec +author: dansimp ms.assetid: bd16c20f-cc47-4172-ae16-47b23c9b7f5c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md b/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md index 1bafd39be8..ec76232e3c 100644 --- a/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md +++ b/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md @@ -1,7 +1,7 @@ --- title: Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0 description: Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0 -author: levinec +author: dansimp ms.assetid: 742e64de-6ace-4eb4-901a-7a282ca7ae85 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md b/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md index ddac76e38c..588f1412b9 100644 --- a/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md +++ b/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md @@ -1,7 +1,7 @@ --- title: About User Experience Virtualization 1.0 SP1 description: About User Experience Virtualization 1.0 SP1 -author: levinec +author: dansimp ms.assetid: 0212d3fb-e882-476c-9496-9eb52301703d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/about-user-experience-virtualization-10.md b/mdop/uev-v1/about-user-experience-virtualization-10.md index 14b915317b..912a597260 100644 --- a/mdop/uev-v1/about-user-experience-virtualization-10.md +++ b/mdop/uev-v1/about-user-experience-virtualization-10.md @@ -1,7 +1,7 @@ --- title: About User Experience Virtualization 1.0 description: About User Experience Virtualization 1.0 -author: levinec +author: dansimp ms.assetid: 3758b100-35a8-4e10-ac08-f583fb8ddbd9 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/accessibility-for-ue-v.md b/mdop/uev-v1/accessibility-for-ue-v.md index 710364b2ab..569e811568 100644 --- a/mdop/uev-v1/accessibility-for-ue-v.md +++ b/mdop/uev-v1/accessibility-for-ue-v.md @@ -1,7 +1,7 @@ --- title: Accessibility for UE-V description: Accessibility for UE-V -author: levinec +author: dansimp ms.assetid: 059a76e5-bcf0-4459-b5d2-8b71ff2ef433 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/uev-v1/administering-ue-v-10.md b/mdop/uev-v1/administering-ue-v-10.md index 2bcd134ade..fcdd94b61b 100644 --- a/mdop/uev-v1/administering-ue-v-10.md +++ b/mdop/uev-v1/administering-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Administering UE-V 1.0 description: Administering UE-V 1.0 -author: levinec +author: dansimp ms.assetid: c399ae8d-c839-4f84-9bfc-adacd8f89f34 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md b/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md index 10ce670be1..7ad504a085 100644 --- a/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md +++ b/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md @@ -1,7 +1,7 @@ --- title: Administering UE-V with PowerShell and WMI description: Administering UE-V with PowerShell and WMI -author: levinec +author: dansimp ms.assetid: 26cc864f-c628-4c04-a18c-dd60fce8187c ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md b/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md index ab2aa0c2ec..b7764e7db1 100644 --- a/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md +++ b/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md @@ -1,7 +1,7 @@ --- title: Changing the Frequency of UE-V Scheduled Tasks description: Changing the Frequency of UE-V Scheduled Tasks -author: levinec +author: dansimp ms.assetid: 33c2674e-0df4-4717-9c3d-820a90b16e19 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md b/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md index 1ca4e1e44a..251f7b2906 100644 --- a/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md +++ b/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Checklist for Evaluating Line-of-Business Applications for UE-V 1.0 description: Checklist for Evaluating Line-of-Business Applications for UE-V 1.0 -author: levinec +author: dansimp ms.assetid: 3bfaab30-59f7-4099-abb1-d248ce0086b8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md b/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md index 4ff6a7f274..16fe74b419 100644 --- a/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md +++ b/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md @@ -1,7 +1,7 @@ --- title: Configuring UE-V with Group Policy Objects description: Configuring UE-V with Group Policy Objects -author: levinec +author: dansimp ms.assetid: 5c9be706-a05f-4397-9a38-e6b73ebff1e5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md b/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md index 57534783a3..3744085adf 100644 --- a/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md +++ b/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md @@ -1,7 +1,7 @@ --- title: Create UE-V Settings Location Templates with the UE-V Generator description: Create UE-V Settings Location Templates with the UE-V Generator -author: levinec +author: dansimp ms.assetid: b8e50e2f-0cc6-4f74-bb48-c471fefdc7d8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md b/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md index 7a2b1288e2..79255766c6 100644 --- a/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md +++ b/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Deploying the Settings Storage Location for UE-V 1.0 description: Deploying the Settings Storage Location for UE-V 1.0 -author: levinec +author: dansimp ms.assetid: b187d44d-649b-487e-98d3-a61ee2be8c2f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md b/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md index c0e408d050..11fca5f564 100644 --- a/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md +++ b/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Deploying the Settings Template Catalog for UE-V 1.0 description: Deploying the Settings Template Catalog for UE-V 1.0 -author: levinec +author: dansimp ms.assetid: 0e6ab5ef-8eeb-40b4-be7b-a841bd83be96 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/deploying-the-ue-v-agent.md b/mdop/uev-v1/deploying-the-ue-v-agent.md index 80f00c8ff1..8e28076181 100644 --- a/mdop/uev-v1/deploying-the-ue-v-agent.md +++ b/mdop/uev-v1/deploying-the-ue-v-agent.md @@ -1,7 +1,7 @@ --- title: Deploying the UE-V Agent description: Deploying the UE-V Agent -author: levinec +author: dansimp ms.assetid: ec1c16c4-4be0-41ff-93bc-3e2b1afb5832 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/deploying-ue-v-10.md b/mdop/uev-v1/deploying-ue-v-10.md index 58a93cbff2..93606fd806 100644 --- a/mdop/uev-v1/deploying-ue-v-10.md +++ b/mdop/uev-v1/deploying-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Deploying UE-V 1.0 description: Deploying UE-V 1.0 -author: levinec +author: dansimp ms.assetid: 519598bb-8c81-4af7-bee7-357696bff880 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md b/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md index fe939dc049..4cc3825fa1 100644 --- a/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md +++ b/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Deploying UE-V Settings Location Templates for UE-V 1.0 description: Deploying UE-V Settings Location Templates for UE-V 1.0 -author: levinec +author: dansimp ms.assetid: 7e0cc553-14f7-40fa-828a-281c8d2d1934 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md b/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md index 70fac05e66..6d30dee877 100644 --- a/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md +++ b/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md @@ -1,7 +1,7 @@ --- title: Edit UE-V Settings Location Templates with the UE-V Generator description: Edit UE-V Settings Location Templates with the UE-V Generator -author: levinec +author: dansimp ms.assetid: da78f9c8-1624-4111-8c96-79db7224bd0b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md b/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md index 1d1459418d..0f030abcb9 100644 --- a/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md +++ b/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md @@ -1,7 +1,7 @@ --- title: Getting Started With User Experience Virtualization 1.0 description: Getting Started With User Experience Virtualization 1.0 -author: levinec +author: dansimp ms.assetid: 74a068dc-4f87-4cb4-b114-8ca2a37149f7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/uev-v1/high-level-architecture-for-ue-v-10.md b/mdop/uev-v1/high-level-architecture-for-ue-v-10.md index de0ffab797..99ba96d4f9 100644 --- a/mdop/uev-v1/high-level-architecture-for-ue-v-10.md +++ b/mdop/uev-v1/high-level-architecture-for-ue-v-10.md @@ -1,7 +1,7 @@ --- title: High-Level Architecture for UE-V 1.0 description: High-Level Architecture for UE-V 1.0 -author: levinec +author: dansimp ms.assetid: d54f9f10-1a4d-4e56-802d-22d51646e1cc ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/index.md b/mdop/uev-v1/index.md index 49e6e8a74c..3fe3f036fa 100644 --- a/mdop/uev-v1/index.md +++ b/mdop/uev-v1/index.md @@ -1,12 +1,12 @@ --- title: Microsoft User Experience Virtualization (UE-V) 1.0 description: Microsoft User Experience Virtualization (UE-V) 1.0 -author: jamiejdt +author: dansimp ms.assetid: 7c2b59f6-bbe9-4373-8b08-c1738665a37b ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 04/19/2017 --- diff --git a/mdop/uev-v1/installing-the-ue-v-generator.md b/mdop/uev-v1/installing-the-ue-v-generator.md index 2729e3b8a1..d147ad6687 100644 --- a/mdop/uev-v1/installing-the-ue-v-generator.md +++ b/mdop/uev-v1/installing-the-ue-v-generator.md @@ -1,7 +1,7 @@ --- title: Installing the UE-V Generator description: Installing the UE-V Generator -author: levinec +author: dansimp ms.assetid: 198b9a5f-3dfc-46be-9005-d33451914f87 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md b/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md index 114fd6f250..556cd9af45 100644 --- a/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md +++ b/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md @@ -1,7 +1,7 @@ --- title: Installing the UE-V Group Policy ADMX Templates description: Installing the UE-V Group Policy ADMX Templates -author: levinec +author: dansimp ms.assetid: 7bd1f12e-7ba6-49f9-af9c-22c496b13b39 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 07/12/2017 --- @@ -31,7 +31,7 @@ ADMX files can be installed and tested locally on any computer that runs the Win **To download the UE-V ADMX templates** -1. Download the UE-V ADMX template files: . +1. Download the UE-V ADMX template files: . 2. For more information about how to deploy the Group Policy templates, see . diff --git a/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md b/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md index efb3fdfb94..e00683076e 100644 --- a/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md +++ b/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md @@ -1,7 +1,7 @@ --- title: Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI description: Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI -author: levinec +author: dansimp ms.assetid: c8989b01-1769-4e69-82b1-4aadb261d2d5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md b/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md index 9bacdae69b..086461286d 100644 --- a/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md +++ b/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md @@ -1,7 +1,7 @@ --- title: Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI description: Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI -author: levinec +author: dansimp ms.assetid: 4b911c78-a5e9-4199-bfeb-72ab764d47c1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md b/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md index de4bba54f9..36b60931b3 100644 --- a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md +++ b/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md @@ -1,7 +1,7 @@ --- title: Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes description: Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes -author: levinec +author: dansimp ms.assetid: 920f3fae-e9b5-4b94-beda-32c19d31e94b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md b/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md index c41b75222e..799871bc65 100644 --- a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md +++ b/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md @@ -1,7 +1,7 @@ --- title: Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes description: Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes -author: levinec +author: dansimp ms.assetid: 447fae0c-fe87-4d1c-b616-6f92fbdaf6d5 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/uev-v1/migrating-ue-v-settings-packages.md b/mdop/uev-v1/migrating-ue-v-settings-packages.md index 0584788218..15490e0ee1 100644 --- a/mdop/uev-v1/migrating-ue-v-settings-packages.md +++ b/mdop/uev-v1/migrating-ue-v-settings-packages.md @@ -1,7 +1,7 @@ --- title: Migrating UE-V Settings Packages description: Migrating UE-V Settings Packages -author: levinec +author: dansimp ms.assetid: 93d99254-3e17-4e96-92ad-87059d8554a7 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/operations-for-ue-v-10.md b/mdop/uev-v1/operations-for-ue-v-10.md index 1ca7174231..8d9b7950e8 100644 --- a/mdop/uev-v1/operations-for-ue-v-10.md +++ b/mdop/uev-v1/operations-for-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Operations for UE-V 1.0 description: Operations for UE-V 1.0 -author: levinec +author: dansimp ms.assetid: 5b4a82fd-3145-49e8-ac06-f9cc583abe5f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md b/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md index 41e30f2c3a..d1bbb9560a 100644 --- a/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md +++ b/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Planning for Custom Template Deployment for UE-V 1.0 description: Planning for Custom Template Deployment for UE-V 1.0 -author: levinec +author: dansimp ms.assetid: be76fc9a-31ca-4290-af11-7640dcb87d50 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/planning-for-ue-v-10.md b/mdop/uev-v1/planning-for-ue-v-10.md index a1b74638d4..01cf6db269 100644 --- a/mdop/uev-v1/planning-for-ue-v-10.md +++ b/mdop/uev-v1/planning-for-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Planning for UE-V 1.0 description: Planning for UE-V 1.0 -author: levinec +author: dansimp ms.assetid: fc44aa5f-1d4f-4c03-b326-37ecd6bd913f ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/planning-for-ue-v-configuration-methods.md b/mdop/uev-v1/planning-for-ue-v-configuration-methods.md index 8e5be9114d..1e9805546f 100644 --- a/mdop/uev-v1/planning-for-ue-v-configuration-methods.md +++ b/mdop/uev-v1/planning-for-ue-v-configuration-methods.md @@ -1,7 +1,7 @@ --- title: Planning for UE-V Configuration Methods description: Planning for UE-V Configuration Methods -author: levinec +author: dansimp ms.assetid: 57bce7ab-1be5-434b-9ee5-c96026bbe010 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/planning-for-ue-v-configuration.md b/mdop/uev-v1/planning-for-ue-v-configuration.md index f703d2f78a..6559c6b1eb 100644 --- a/mdop/uev-v1/planning-for-ue-v-configuration.md +++ b/mdop/uev-v1/planning-for-ue-v-configuration.md @@ -1,7 +1,7 @@ --- title: Planning for UE-V Configuration description: Planning for UE-V Configuration -author: levinec +author: dansimp ms.assetid: db78dad4-78e0-45d6-a235-8b7345cb79f8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md b/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md index 79eebd7152..d6f2e16c4d 100644 --- a/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md +++ b/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Planning Which Applications to Synchronize with UE-V 1.0 description: Planning Which Applications to Synchronize with UE-V 1.0 -author: levinec +author: dansimp ms.assetid: c718274f-87b4-47f3-8ef7-5e1bd5557a9d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/preparing-your-environment-for-ue-v.md b/mdop/uev-v1/preparing-your-environment-for-ue-v.md index c361404d69..d1bf14f1a1 100644 --- a/mdop/uev-v1/preparing-your-environment-for-ue-v.md +++ b/mdop/uev-v1/preparing-your-environment-for-ue-v.md @@ -1,7 +1,7 @@ --- title: Preparing Your Environment for UE-V description: Preparing Your Environment for UE-V -author: levinec +author: dansimp ms.assetid: c93d3b33-e032-451a-9e1b-8534e1625396 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md b/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md index eeafde3a12..cc3551aa20 100644 --- a/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md +++ b/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Restoring Application and Windows Settings Synchronized with UE-V 1.0 description: Restoring Application and Windows Settings Synchronized with UE-V 1.0 -author: levinec +author: dansimp ms.assetid: 254a16b1-f186-44a4-8e22-49a4ee87c734 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/security-and-privacy-for-ue-v-10.md b/mdop/uev-v1/security-and-privacy-for-ue-v-10.md index dd0f34f96c..6ea8dd1e7c 100644 --- a/mdop/uev-v1/security-and-privacy-for-ue-v-10.md +++ b/mdop/uev-v1/security-and-privacy-for-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Security and Privacy for UE-V 1.0 description: Security and Privacy for UE-V 1.0 -author: levinec +author: dansimp ms.assetid: c23d867d-7991-4c78-a123-a8a92758e5ba ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md b/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md index 48f0163995..9a39c6eac9 100644 --- a/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md +++ b/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md @@ -1,7 +1,7 @@ --- title: Sharing Settings Location Templates with the UE-V Template Gallery description: Sharing Settings Location Templates with the UE-V Template Gallery -author: levinec +author: dansimp ms.assetid: 3830ae0c-96dd-4a8d-96a2-df87aea81b27 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- @@ -17,7 +17,7 @@ ms.date: 08/30/2016 # Sharing Settings Location Templates with the UE-V Template Gallery -## Share location templates with the template gallery +## Share location templates with the template gallery The Microsoft User Experience Virtualization (UE-V) template gallery allows administrators to share their UE-V settings location templates. In the gallery, you can upload your settings location templates for other people to use, and you can download templates that other people have created. The UE-V template gallery is located on Microsoft TechNet here: . diff --git a/mdop/uev-v1/supported-configurations-for-ue-v-10.md b/mdop/uev-v1/supported-configurations-for-ue-v-10.md index 2fca53cc15..efcce87df5 100644 --- a/mdop/uev-v1/supported-configurations-for-ue-v-10.md +++ b/mdop/uev-v1/supported-configurations-for-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Supported Configurations for UE-V 1.0 description: Supported Configurations for UE-V 1.0 -author: levinec +author: dansimp ms.assetid: d90ab83e-741f-48eb-b1d8-a64cb9259f7a ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/uev-v1/troubleshooting-ue-v-10.md b/mdop/uev-v1/troubleshooting-ue-v-10.md index 81aa6256a0..0febbf92ca 100644 --- a/mdop/uev-v1/troubleshooting-ue-v-10.md +++ b/mdop/uev-v1/troubleshooting-ue-v-10.md @@ -1,7 +1,7 @@ --- title: Troubleshooting UE-V 1.0 description: Troubleshooting UE-V 1.0 -author: levinec +author: dansimp ms.assetid: e40f46a9-34f6-40ee-801b-9bf91f65c0e1 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- @@ -19,7 +19,7 @@ ms.date: 08/30/2016 Troubleshooting content is not included in the Administrator's Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). -## Find troubleshooting information +## Find troubleshooting information You can use the following information to find troubleshooting content or additional technical content for this product. @@ -44,7 +44,7 @@ The first step to find help content in the Administrator’s Guide is to search 3. Review the search results for assistance. -## Create a troubleshooting article +## Create a troubleshooting article If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP Online Help or TechNet Wiki, you can create your own TechNet Wiki article. diff --git a/mdop/uev-v1/ue-v-10-security-considerations.md b/mdop/uev-v1/ue-v-10-security-considerations.md index ddbecb7393..3f9092994d 100644 --- a/mdop/uev-v1/ue-v-10-security-considerations.md +++ b/mdop/uev-v1/ue-v-10-security-considerations.md @@ -1,7 +1,7 @@ --- title: UE-V 1.0 Security Considerations description: UE-V 1.0 Security Considerations -author: levinec +author: dansimp ms.assetid: c5cdf9ff-dc96-4491-98e9-0eada898ffe0 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/ue-v-checklist.md b/mdop/uev-v1/ue-v-checklist.md index 03c5bb4c70..867fbf837b 100644 --- a/mdop/uev-v1/ue-v-checklist.md +++ b/mdop/uev-v1/ue-v-checklist.md @@ -1,7 +1,7 @@ --- title: UE-V Checklist description: UE-V Checklist -author: levinec +author: dansimp ms.assetid: 0e4b9bd5-4e60-4673-b698-90612008fc2b ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/user-experience-virtualization-privacy-statement.md b/mdop/uev-v1/user-experience-virtualization-privacy-statement.md index ecbbabaa59..d3b329d5b9 100644 --- a/mdop/uev-v1/user-experience-virtualization-privacy-statement.md +++ b/mdop/uev-v1/user-experience-virtualization-privacy-statement.md @@ -1,7 +1,7 @@ --- title: User Experience Virtualization Privacy Statement description: User Experience Virtualization Privacy Statement -author: levinec +author: dansimp ms.assetid: c2919034-f2cf-48d6-b18e-4dd318252426 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 08/30/2016 --- diff --git a/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md b/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md index 7b2ac97915..0dd3e58ddb 100644 --- a/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md +++ b/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md @@ -1,7 +1,7 @@ --- title: Validate UE-V Settings Location Templates with UE-V Generator description: Validate UE-V Settings Location Templates with UE-V Generator -author: levinec +author: dansimp ms.assetid: 131c636c-173a-4b41-af5d-9a75b453b9d8 ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md b/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md index 14ed81bb52..94eb7e9741 100644 --- a/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md +++ b/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md @@ -1,7 +1,7 @@ --- title: Working with Custom UE-V Templates and the UE-V Generator description: Working with Custom UE-V Templates and the UE-V Generator -author: levinec +author: dansimp ms.assetid: 7bb2583a-b032-4800-9bf9-eb33528e1d0d ms.reviewer: manager: dansimp @@ -9,7 +9,7 @@ ms.author: ellevin ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library -ms.prod: w8 +ms.prod: w10 ms.date: 06/16/2016 --- diff --git a/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md index 349a791c43..ad27b863c5 100644 --- a/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md +++ b/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Accessibility for UE-V 2.x description: Accessibility for UE-V 2.x -author: levinec +author: dansimp ms.assetid: ec05da5f-4558-4d4d-9b58-3b8ed68cf2fe ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md b/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md index e25587766a..4400c57d74 100644 --- a/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md +++ b/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md @@ -1,7 +1,7 @@ --- title: Administering UE-V 2.x description: Administering UE-V 2.x -author: levinec +author: dansimp ms.assetid: 996e4797-8383-4627-b714-24a84c907798 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md b/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md index 6acd7dcdd5..02104c5466 100644 --- a/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md +++ b/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Administering UE-V 2.x with Windows PowerShell and WMI description: Administering UE-V 2.x with Windows PowerShell and WMI -author: levinec +author: dansimp ms.assetid: e749ac03-0adf-475a-a4f2-5cc023549b12 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md index fd3074b66a..e39853513d 100644 --- a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md +++ b/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Application Template Schema Reference for UE-V 2.x description: Application Template Schema Reference for UE-V 2.x -author: levinec +author: dansimp ms.assetid: be8735a5-6a3e-4b1f-ba14-2a3bc3e5a8b6 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md b/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md index e6dc6513a3..62759777cc 100644 --- a/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md +++ b/mdop/uev-v2/changing-the-frequency-of-ue-v-2x-scheduled-tasks-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Changing the Frequency of UE-V 2.x Scheduled Tasks description: Changing the Frequency of UE-V 2.x Scheduled Tasks -author: levinec +author: dansimp ms.assetid: ee486570-c6cf-4fd9-ba48-0059ba877c10 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md index 8b371ea90a..d7a037fae6 100644 --- a/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md +++ b/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Configuring the Company Settings Center for UE-V 2.x description: Configuring the Company Settings Center for UE-V 2.x -author: levinec +author: dansimp ms.assetid: 48fadb0a-c0dc-4287-9474-f94ce1417003 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md b/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md index 94ee14b167..95c3a06d9c 100644 --- a/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md +++ b/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Configuring UE-V 2.x with Group Policy Objects description: Configuring UE-V 2.x with Group Policy Objects -author: levinec +author: dansimp ms.assetid: 2bb55834-26ee-4f19-9860-dfdf3c797143 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md b/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md index c5936123dc..271e7c2304 100644 --- a/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md +++ b/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Configuring UE-V 2.x with System Center Configuration Manager 2012 description: Configuring UE-V 2.x with System Center Configuration Manager 2012 -author: levinec +author: dansimp ms.assetid: 9a4e2a74-7646-4a77-b58f-2b4456487295 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md b/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md index b88d290654..33bef01f40 100644 --- a/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md +++ b/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md @@ -1,7 +1,7 @@ --- title: Deploy Required Features for UE-V 2.x description: Deploy Required Features for UE-V 2.x -author: levinec +author: dansimp ms.assetid: 10399bb3-cc7b-4578-bc0c-2f6b597abe4d ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md b/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md index e86cfa6fc0..5ea364d361 100644 --- a/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md +++ b/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md @@ -1,7 +1,7 @@ --- title: Deploy UE-V 2.x for Custom Applications description: Deploy UE-V 2.x for Custom Applications -author: levinec +author: dansimp ms.assetid: f7cb089f-d764-4a93-82b6-926fe0385a23 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md b/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md index a18ae22ef9..bfbca01322 100644 --- a/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md +++ b/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md @@ -1,7 +1,7 @@ --- title: Get Started with UE-V 2.x description: Get Started with UE-V 2.x -author: levinec +author: dansimp ms.assetid: 526ecbf0-0dee-4f0b-b017-8f8d25357b14 ms.reviewer: manager: dansimp @@ -114,7 +114,7 @@ Before you proceed, make sure your environment includes these requirements for r -**Note:** Starting with Windows 10, version 1607, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack +**Note:** Starting with Windows 10, version 1607, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack Also… @@ -193,7 +193,7 @@ You’ll need to deploy a settings storage location, a standard network share wh -**Security Note:  ** +**Security Note:** If you create the settings storage share on a computer running a Windows Server operating system, configure UE-V to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable this additional security, specify this setting in the Windows Server Registry Editor: diff --git a/mdop/uev-v2/index.md b/mdop/uev-v2/index.md index 5e5f69c25f..b0a92410ba 100644 --- a/mdop/uev-v2/index.md +++ b/mdop/uev-v2/index.md @@ -1,7 +1,7 @@ --- title: Microsoft User Experience Virtualization (UE-V) 2.x description: Microsoft User Experience Virtualization (UE-V) 2.x -author: jamiejdt +author: dansimp ms.assetid: b860fed0-b846-415d-bdd6-ba60231a64be ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy diff --git a/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md b/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md index 2716ff5ef7..850ec9ab0d 100644 --- a/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md +++ b/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md @@ -1,7 +1,7 @@ --- title: Manage Administrative Backup and Restore in UE-V 2.x description: Manage Administrative Backup and Restore in UE-V 2.x -author: levinec +author: dansimp ms.assetid: 2eb5ae75-65e5-4afc-adb6-4e83cf4364ae ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md b/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md index 7b0ce9f869..d633e2bf7c 100644 --- a/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md +++ b/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md @@ -1,7 +1,7 @@ --- title: Manage Configurations for UE-V 2.x description: Manage Configurations for UE-V 2.x -author: levinec +author: dansimp ms.assetid: e2332eca-a9cd-4446-8f7c-d17058b03466 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md b/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md index ba8db1fb4b..1a0b9037e8 100644 --- a/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md +++ b/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Managing the UE-V 2.x Agent and Packages with Windows PowerShell and WMI description: Managing the UE-V 2.x Agent and Packages with Windows PowerShell and WMI -author: levinec +author: dansimp ms.assetid: 56e6780b-8b2c-4717-91c8-2af63062ab75 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md b/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md index 8de1e74734..92a9f13cc8 100644 --- a/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md +++ b/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI description: Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI -author: levinec +author: dansimp ms.assetid: b5253050-acc3-4274-90d0-1fa4c480331d ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md index 72c09ecf9e..64cd5462a4 100644 --- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md +++ b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md @@ -1,7 +1,7 @@ --- title: Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes description: Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes -author: levinec +author: dansimp ms.assetid: 5ef66cd1-ba2b-4383-9f45-e7cde41f1ba1 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md index d8f9534765..6ce7711f88 100644 --- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md +++ b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md @@ -1,7 +1,7 @@ --- title: Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes description: Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes -author: levinec +author: dansimp ms.assetid: 79a36c77-fa0c-4651-8028-4a79763a2fd2 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md index f2d84f5f5c..f1f230b1c4 100644 --- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md +++ b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md @@ -1,7 +1,7 @@ --- title: Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes description: Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes -author: levinec +author: dansimp ms.assetid: 561988c4-cc5c-4e15-970b-16e942c8f2ef ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md b/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md index 6b13a80d3d..d94337ff73 100644 --- a/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md +++ b/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Migrating UE-V 2.x Settings Packages description: Migrating UE-V 2.x Settings Packages -author: levinec +author: dansimp ms.assetid: f79381f4-e142-405c-b728-5c048502aa70 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md b/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md index 9d9a9348ec..a2b3332a55 100644 --- a/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md +++ b/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md @@ -1,7 +1,7 @@ --- title: Prepare a UE-V 2.x Deployment description: Prepare a UE-V 2.x Deployment -author: levinec +author: dansimp ms.assetid: c429fd06-13ff-48c5-b9c9-fa1ec01ab800 ms.reviewer: manager: dansimp @@ -710,7 +710,7 @@ Also… **Note** -- Starting with WIndows 10, version 1607, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack. +- Starting with WIndows 10, version 1607, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack. - The UE-V Windows PowerShell feature of the UE-V Agent requires .NET Framework 4 or higher and Windows PowerShell 3.0 or higher to be enabled. Download Windows PowerShell 3.0 [here](https://go.microsoft.com/fwlink/?LinkId=309609). diff --git a/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md index bc93749e20..add6d7f5cd 100644 --- a/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md +++ b/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Security Considerations for UE-V 2.x description: Security Considerations for UE-V 2.x -author: levinec +author: dansimp ms.assetid: 9d5c3cae-9fcb-4dea-bd67-741b3dea63be ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md index 4eefbd2641..ab07885a9b 100644 --- a/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md +++ b/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Sync Methods for UE-V 2.x description: Sync Methods for UE-V 2.x -author: levinec +author: dansimp ms.assetid: af0ae894-dfdc-41d2-927b-c2ab1b355ffe ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md index 8b8c565dc8..0056d7a17a 100644 --- a/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md +++ b/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Sync Trigger Events for UE-V 2.x description: Sync Trigger Events for UE-V 2.x -author: levinec +author: dansimp ms.assetid: 4ed71a13-6a4f-4376-996f-74b126536bbc ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md b/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md index 8d25af0236..e145aa7852 100644 --- a/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md +++ b/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Synchronizing Office 2013 with UE-V 2.0 description: Synchronizing Office 2013 with UE-V 2.0 -author: levinec +author: dansimp ms.assetid: c46feb6d-28a8-4799-888d-053531dc5842 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md index 7df413058d..f4ce714825 100644 --- a/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md +++ b/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Technical Reference for UE-V 2.x description: Technical Reference for UE-V 2.x -author: levinec +author: dansimp ms.assetid: 303cff9a-a96d-4e83-9e94-19b0d3744e1e ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md b/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md index 733876d705..1f176a44b3 100644 --- a/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md +++ b/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Troubleshooting UE-V 2.x description: Troubleshooting UE-V 2.x -author: levinec +author: dansimp ms.assetid: a02847f8-6986-4612-8307-ba1b72d7919b ms.reviewer: manager: dansimp @@ -19,7 +19,7 @@ ms.date: 08/30/2016 Troubleshooting content is not included in the Administrator's Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905). -## Find troubleshooting information +## Find troubleshooting information You can use the following information to find troubleshooting content or additional technical content for this product. @@ -44,7 +44,7 @@ The first step to find help content in the Administrator’s Guide is to search 3. Review the search results for assistance. -## Create a troubleshooting article +## Create a troubleshooting article If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP Online Help or TechNet Wiki, you can create your own TechNet Wiki article. diff --git a/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md b/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md index 16c4897c6f..8a0b0cd6db 100644 --- a/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md +++ b/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md @@ -1,7 +1,7 @@ --- title: Using UE-V 2.x with Application Virtualization Applications description: Using UE-V 2.x with Application Virtualization Applications -author: levinec +author: dansimp ms.assetid: 4644b810-fc48-4fd0-96e4-2fc6cd64d8ad ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md b/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md index ad1e2132a4..99c2fdbf22 100644 --- a/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md +++ b/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md @@ -1,7 +1,7 @@ --- title: What's New in UE-V 2.0 description: What's New in UE-V 2.0 -author: levinec +author: dansimp ms.assetid: 5d852beb-f293-4e3a-a33b-c40df59a7515 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md b/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md index de567fa610..5d8c70b598 100644 --- a/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md +++ b/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md @@ -1,7 +1,7 @@ --- title: What's New in UE-V 2.1 description: What's New in UE-V 2.1 -author: levinec +author: dansimp ms.assetid: 7f385183-7d97-4602-b19a-baa710334ade ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md b/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md index b146bb839e..bdde3b117e 100644 --- a/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md +++ b/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md @@ -1,7 +1,7 @@ --- title: What's New in UE-V 2.1 SP1 description: What's New in UE-V 2.1 SP1 -author: levinec +author: dansimp ms.assetid: 9a40c737-ad9a-4ec1-b42b-31bfabe0f170 ms.reviewer: manager: dansimp diff --git a/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md b/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md index a925e62689..bce863091a 100644 --- a/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md +++ b/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md @@ -1,7 +1,7 @@ --- title: Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator description: Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator -author: levinec +author: dansimp ms.assetid: f0bb4920-0132-472c-a564-abf06a884275 ms.reviewer: manager: dansimp diff --git a/smb/cloud-mode-business-setup.md b/smb/cloud-mode-business-setup.md index 5db1de9950..b3f0ec8f06 100644 --- a/smb/cloud-mode-business-setup.md +++ b/smb/cloud-mode-business-setup.md @@ -2,15 +2,14 @@ title: Deploy and manage a full cloud IT solution for your business description: Learn how to set up a cloud infrastructure for your business, acquire devices and apps, and configure and deploy policies to your devices. keywords: smb, full cloud IT solution, small to medium business, deploy, setup, manage, Windows, Intune, Office 365 -ms.prod: w10 -ms.technology: smb-windows -ms.topic: hero-article +ms.prod: +ms.technology: ms.author: eravena +audience: itpro ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: smb author: eavena -ms.date: 10/30/2017 ms.reviewer: manager: dansimp ms.localizationpriority: medium diff --git a/smb/index.md b/smb/index.md index 4df3e742c1..5cc2746261 100644 --- a/smb/index.md +++ b/smb/index.md @@ -2,16 +2,16 @@ title: Windows 10 for small to midsize businesses description: Microsoft products and devices to transform and grow your businessLearn how to use Windows 10 for your small to midsize business. keywords: Windows 10, SMB, small business, midsize business, business -ms.prod: w10 -ms.technology: smb-windows +ms.prod: +ms.technology: ms.topic: article ms.author: celested ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: smb author: CelesteDG -ms.date: 05/01/2017 ms.localizationpriority: medium +manager: dansimp --- # Windows 10 for SMB diff --git a/store-for-business/TOC.md b/store-for-business/TOC.md index c4fdb65355..fe8f3b7411 100644 --- a/store-for-business/TOC.md +++ b/store-for-business/TOC.md @@ -1,7 +1,7 @@ # [Microsoft Store for Business](index.md) ## [What's new in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md) ## [Sign up and get started](sign-up-microsoft-store-for-business-overview.md) -###[Microsoft Store for Business and Microsoft Store for Education overview](microsoft-store-for-business-overview.md) +### [Microsoft Store for Business and Microsoft Store for Education overview](microsoft-store-for-business-overview.md) ### [Prerequisites for Microsoft Store for Business and Education](prerequisites-microsoft-store-for-business.md) ### [Sign up for Microsoft Store for Business or Microsoft Store for Education](sign-up-microsoft-store-for-business.md) ### [Roles and permissions in the Microsoft Store for Business and Education](roles-and-permissions-microsoft-store-for-business.md) diff --git a/store-for-business/add-profile-to-devices.md b/store-for-business/add-profile-to-devices.md index de500f83cb..1215008fc9 100644 --- a/store-for-business/add-profile-to-devices.md +++ b/store-for-business/add-profile-to-devices.md @@ -23,7 +23,7 @@ Windows Autopilot simplifies device set up for IT Admins. For an overview of ben Watch this video to learn more about Windows Autopilot in Microsoft Store for Business.
        -> [!video https://www.microsoft.com/en-us/videoplayer/embed/3b30f2c2-a3e2-4778-aa92-f65dbc3ecf54?autoplay=false] +> [!video https://www.microsoft.com/videoplayer/embed/3b30f2c2-a3e2-4778-aa92-f65dbc3ecf54?autoplay=false] ## What is Windows Autopilot? In Microsoft Store for Business, you can manage devices for your organization and apply an *Autopilot deployment profile* to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the Autopilot deployment profile you applied to the device. diff --git a/store-for-business/device-guard-signing-portal.md b/store-for-business/device-guard-signing-portal.md index 2c0e080ed7..6a2720e035 100644 --- a/store-for-business/device-guard-signing-portal.md +++ b/store-for-business/device-guard-signing-portal.md @@ -51,7 +51,7 @@ Catalog and policy files have required files types. | catalog files | .cat | | policy files | .bin | - ## Store for Business roles and permissions + ## Store for Business roles and permissions Signing code integrity policies and access to Device Guard portal requires the Device Guard signer role. ## Device Guard signing certificates diff --git a/store-for-business/docfx.json b/store-for-business/docfx.json index 10be832452..2825ff309d 100644 --- a/store-for-business/docfx.json +++ b/store-for-business/docfx.json @@ -33,6 +33,7 @@ "globalMetadata": { "breadcrumb_path": "/microsoft-store/breadcrumb/toc.json", "ms.author": "trudyha", + "audience": "ITPro", "ms.technology": "windows", "ms.topic": "article", "ms.date": "05/09/2017", diff --git a/store-for-business/education/TOC.md b/store-for-business/education/TOC.md index bf36f37baf..515b03dd25 100644 --- a/store-for-business/education/TOC.md +++ b/store-for-business/education/TOC.md @@ -1,7 +1,7 @@ # [Microsoft Store for Education](/microsoft-store/index?toc=/microsoft-store/education/toc.json) ## [What's new in Microsoft Store for Business and Education](/microsoft-store/whats-new-microsoft-store-business-education?toc=/microsoft-store/education/toc.json) ## [Sign up and get started](/microsoft-store/sign-up-microsoft-store-for-business-overview?toc=/microsoft-store/education/toc.json) -###[Microsoft Store for Business and Education overview](/microsoft-store/windows-store-for-business-overview?toc=/microsoft-store/education/toc.json) +### [Microsoft Store for Business and Education overview](/microsoft-store/windows-store-for-business-overview?toc=/microsoft-store/education/toc.json) ### [Prerequisites for Microsoft Store for Business and Education](/microsoft-store/prerequisites-microsoft-store-for-business?toc=/microsoft-store/education/toc.json) ### [Sign up for Microsoft Store for Business or Microsoft Store for Education](/microsoft-store/sign-up-microsoft-store-for-business?toc=/microsoft-store/education/toc.json) ### [Roles and permissions in the Microsoft Store for Business and Education](/microsoft-store/roles-and-permissions-microsoft-store-for-business?toc=/microsoft-store/education/toc.json) diff --git a/store-for-business/manage-orders-microsoft-store-for-business.md b/store-for-business/manage-orders-microsoft-store-for-business.md index 115dd3fa5b..91a18494e2 100644 --- a/store-for-business/manage-orders-microsoft-store-for-business.md +++ b/store-for-business/manage-orders-microsoft-store-for-business.md @@ -42,14 +42,14 @@ Refunds work a little differently for free apps, and apps that have a price. In **Refunds for free apps** - For free apps, there isn't really a refund to request -- you're removing the app from your inventory. You must first reclaim any assigned licenses, and then you can remove the app from your organization's inventory. +For free apps, there isn't really a refund to request -- you're removing the app from your inventory. You must first reclaim any assigned licenses, and then you can remove the app from your organization's inventory. - **Refunds for apps that have a price** +**Refunds for apps that have a price** - There are a few requirements for apps that have a price: - - **Timing** - Refunds are available for the first 30 days after you place your order. For example, if your order is placed on June 1, you can self-refund through June 30. - - **Available licenses** - You need to have enough available licenses to cover the number of licenses in the order you are refunding. For example, if you purchased 10 copies of an app and you want to request a refund, you must have at least 10 licenses of the app available in your inventory -- those 10 licenses can't be assigned to people in your organization. - - **Whole order refunds only** - You must refund the complete amount of apps in an order. You can't refund a part of an order. For example, if you purchased 10 copies of an app, but later found you only needed 5 copies, you'll need to request a refund for the 10 apps, and then make a separate order for 5 apps. If you have had multiple orders of the same app, you can refund one order but still keep the rest of the inventory. +There are a few requirements for apps that have a price: +- **Timing** - Refunds are available for the first 30 days after you place your order. For example, if your order is placed on June 1, you can self-refund through June 30. +- **Available licenses** - You need to have enough available licenses to cover the number of licenses in the order you are refunding. For example, if you purchased 10 copies of an app and you want to request a refund, you must have at least 10 licenses of the app available in your inventory -- those 10 licenses can't be assigned to people in your organization. +- **Whole order refunds only** - You must refund the complete amount of apps in an order. You can't refund a part of an order. For example, if you purchased 10 copies of an app, but later found you only needed 5 copies, you'll need to request a refund for the 10 apps, and then make a separate order for 5 apps. If you have had multiple orders of the same app, you can refund one order but still keep the rest of the inventory. **To refund an order** diff --git a/store-for-business/work-with-partner-microsoft-store-business.md b/store-for-business/work-with-partner-microsoft-store-business.md index 9ca69eef76..e2829a08cb 100644 --- a/store-for-business/work-with-partner-microsoft-store-business.md +++ b/store-for-business/work-with-partner-microsoft-store-business.md @@ -38,7 +38,7 @@ There are several ways that a solution provider can work with you. Solution prov | OEM PC partner | Solution providers can upload device IDs for PCs that you're [managing with Autopilot](https://docs.microsoft.com/microsoft-store/add-profile-to-devices). | | Line-of-business (LOB) partner | Solution providers can develop, submit, and manage LOB apps specific for your organization or school. | -## Find a solution provider +## Find a solution provider You can find partner in Microsoft Store for Business and Education. diff --git a/surface-hub-2s-ports-keypad.md b/surface-hub-2s-ports-keypad.md deleted file mode 100644 index de36eacd73..0000000000 --- a/surface-hub-2s-ports-keypad.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: "Surface Hub 2S ports and keypad overview" -description: "This page describes the ports, physical buttons, and configuration information for Surface Hub 2S." -keywords: separate values with commas -ms.prod: surface-hub -ms.sitesec: library -author: robmazz -ms.author: robmazz -audience: Admin -ms.topic: article -ms.localizationpriority: Normal ---- - -# Surface Hub 2S ports and keypad overview - -This page describes the ports, physical buttons, and configuration information essential for connecting to Surface Hub 2S whether via wired, Wi-Fi, or Bluetooth methods. It also includes best practice recommendations for key connectivity scenarios. - -Figure 1 shows the location ports and physical buttons located on a keypad attached to the underside of the device. Table 1 includes detailed descriptions of each element. -*Figure 1. Front facing and underside view of I/O connections and physical buttons* -*Table 1. Surface Hub 2S port and keypad component reference* - -| Key | Component | Description | Key parameters | -| --- | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- | -| ① | USB C | USB 3.0 Port

        - Use as a walk-up port for plugging in peripherals such as thumb-drives. Guest ports are located on each side of the device (4).
        -

        NOTE: This is the recommended port for connecting an external camera. Additional camera mount features are incorporated into the design to help support retention of attached cameras.


        - NOTE: TouchBack and video ingest are not supported on these ports. | Type C

        - 15 W Port (5V/3A) | -| ② | AC power | 100-240V input
        Connect to standard AC power and Surface Hub 2S will auto switch to the local power standard such as110 volts in the US and Canada or 220 volts in the UK or other countries.

        NOTE: When the AC cord is plugged in, the system remains in an off state in which only the system management controller (SMC), real time clock (RTC), and keypad are running. | IEC 60320 C14 | -| ③ | DC power | 24V DC input port
        Use for connecting to mobile battery. | Xbox1 Dual barrel to Anderson connector | -| ④ | Ethernet | 1000/100/10 BaseT
        Use for providing a continuous connection in a corporate environment and related scenarios requiring maximum stability or capacity. | RJ45 | -| ⑤ | USB-A | USB 3.0 Port
        Use as a walk-up port for plugging in peripherals such as thumb-drives. | Type A
        7.5 W Port (5V/1.5A) | -| ⑥ | USB-C | USB 3.0 Port
        Use as a walk-up port for connecting external PCs and related devices or plugging in peripherals such as thumb-drives.

        NOTE: This is the recommended video input port, supporting both TouchBack and InkBack. | Type C
        18 W Port (5V/3A, 9V/2A) | -| ⑦ | HDMI in | HDMI 2.0, HDCP 2.2 /1.4
        Use for multiple scenarios including HDMI-to-HDMI guest input. | Standard HDMI | -| ⑧ | Mini DisplayPort out | DisplayPort 1.2 output
        Use for video-out scenarios such as mirroring the Surface Hub 2S display to a larger projector. | Mini DisplayPort | -| ⑨ | Source | Use to toggle among connected ingest sources — external PC, HDMI, and DisplayPort modes. | n/a | -| ⑩ | Volume | Use +/- to adjust audio locally on the device.

        NOTE: When navigating to the brightness control, use +/- on the volume slider to control display brightness. | n/a | -| ⑪ | Power | Power device on/off.
        Use also to navigate display menus and select items. | n/a | - - ** - ** -*Figure 2. Rear facing view of wireless, audio, & related components* -NOTE: **many of these components are internal and may not be obviously visible from the outside. - -*Figure 3. Wired port connections on Surface Hub-2S* \ No newline at end of file diff --git a/windows/access-protection/docfx.json b/windows/access-protection/docfx.json index 57281ea6e2..9df4554e37 100644 --- a/windows/access-protection/docfx.json +++ b/windows/access-protection/docfx.json @@ -33,6 +33,7 @@ "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", + "audience": "ITPro", "ms.topic": "article", "_op_documentIdPathDepotMapping": { "./": { diff --git a/windows/application-management/add-apps-and-features.md b/windows/application-management/add-apps-and-features.md index bb0195c0dc..81f0da756e 100644 --- a/windows/application-management/add-apps-and-features.md +++ b/windows/application-management/add-apps-and-features.md @@ -5,7 +5,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: article -ms.author: tracyp +ms.author: dansimp author: msfttracyp ms.localizationpriority: medium ms.date: 04/26/2018 diff --git a/windows/application-management/app-v/appv-about-appv.md b/windows/application-management/app-v/appv-about-appv.md index 91926ff30c..910454c958 100644 --- a/windows/application-management/app-v/appv-about-appv.md +++ b/windows/application-management/app-v/appv-about-appv.md @@ -42,7 +42,7 @@ Previous versions of App-V have required you to manually remove your unpublished ### App-V is now a feature in Windows 10 -With Windows 10, version 1607 and later releases, App-V is now included with [Windows 10 for Enterprise and Windows 10 for Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack. +With Windows 10, version 1607 and later releases, App-V is now included with [Windows 10 for Enterprise and Windows 10 for Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack. To learn more about earlier versions of App-V, see [MDOP Information Experience](https://docs.microsoft.com/microsoft-desktop-optimization-pack/index). diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 3dbd5d0ae9..a913ce8a38 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -346,7 +346,7 @@ This process will recreate both the local and network locations for AppData and In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers through the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are input as PowerShell commands on the computer running the App-V Client. -This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012, see [Integrating Virtual Application Management with App-V 5 and Configuration Manager 2012 SP1](https://www.microsoft.com/en-us/download/details.aspx?id=38177). +This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012, see [Integrating Virtual Application Management with App-V 5 and Configuration Manager 2012 SP1](https://www.microsoft.com/download/details.aspx?id=38177). The App-V application lifecycle tasks are triggered at user sign in (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured (after the client is enabled) with Windows PowerShell commands. See [App-V Client Configuration Settings: Windows PowerShell](appv-client-configuration-settings.md#app-v-client-configuration-settings-windows-powershell). @@ -799,7 +799,7 @@ App-V packages contain the Manifest file inside of the App-V Package file, which ### Examples of dynamic configuration files -The following example shows the combination of the Manifest, Deployment Configuration, and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only, not to be a complete description of the specific categories available in each file. For more information, download the [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760). +The following example shows the combination of the Manifest, Deployment Configuration, and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only, not to be a complete description of the specific categories available in each file. For more information, download the [App-V Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760). #### Manifest diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md index 5af97d8c38..6e88aa4a89 100644 --- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md +++ b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md @@ -62,5 +62,5 @@ Using Group Policy, you can turn on the **Enable automatic cleanup of unused App ## Related topics - [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) -- [Download the Microsoft Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/en-us/download/details.aspx?id=41186) +- [Download the Microsoft Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/download/details.aspx?id=41186) - [Using the App-V Client Management Console](appv-using-the-client-management-console.md) diff --git a/windows/application-management/app-v/appv-capacity-planning.md b/windows/application-management/app-v/appv-capacity-planning.md index 3d117f1d01..099bcdf1c4 100644 --- a/windows/application-management/app-v/appv-capacity-planning.md +++ b/windows/application-management/app-v/appv-capacity-planning.md @@ -128,9 +128,9 @@ Computers running the App-V client connect to the App-V publishing server to sen > [!IMPORTANT] > The following list displays the main factors to consider when setting up the App-V publishing server: -> * The number of clients connecting simultaneously to a single publishing server. -> * The number of packages in each refresh. -> * The available network bandwidth in your environment between the client and the App-V publishing server. +> * The number of clients connecting simultaneously to a single publishing server. +> * The number of packages in each refresh. +> * The available network bandwidth in your environment between the client and the App-V publishing server. |Scenario|Summary| |---|---| @@ -153,9 +153,9 @@ Computers running the App-V client stream the virtual application package from t > [!IMPORTANT] > The following list identifies the main factors to consider when setting up the App-V streaming server: -> * The number of clients streaming application packages simultaneously from a single streaming server. -> * The size of the package being streamed. -> * The available network bandwidth in your environment between the client and the streaming server. +> * The number of clients streaming application packages simultaneously from a single streaming server. +> * The size of the package being streamed. +> * The available network bandwidth in your environment between the client and the streaming server. |Scenario|Summary| |---|---| diff --git a/windows/application-management/app-v/appv-connection-group-virtual-environment.md b/windows/application-management/app-v/appv-connection-group-virtual-environment.md index 7fa1f3d1b5..ed2d425dc4 100644 --- a/windows/application-management/app-v/appv-connection-group-virtual-environment.md +++ b/windows/application-management/app-v/appv-connection-group-virtual-environment.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 06/25/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # About the connection group virtual environment diff --git a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md b/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md index b6228dd6cd..794615f010 100644 --- a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md +++ b/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to convert a package created in a previous version of App-V diff --git a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md b/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md index c7df167fba..312adeb09b 100644 --- a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md +++ b/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to create a connection croup with user-published and globally published packages diff --git a/windows/application-management/app-v/appv-create-a-connection-group.md b/windows/application-management/app-v/appv-create-a-connection-group.md index 2dca44be85..9f08b25b41 100644 --- a/windows/application-management/app-v/appv-create-a-connection-group.md +++ b/windows/application-management/app-v/appv-create-a-connection-group.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to create a connection group diff --git a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md b/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md index 098316aee4..273b520a59 100644 --- a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md +++ b/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to create a custom configuration file by using the App-V Management Console diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md index a33e8e481a..fb72cbc762 100644 --- a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md +++ b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to create a package accelerator by using Windows PowerShell diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator.md b/windows/application-management/app-v/appv-create-a-package-accelerator.md index e16200acad..7f2ec6c3c5 100644 --- a/windows/application-management/app-v/appv-create-a-package-accelerator.md +++ b/windows/application-management/app-v/appv-create-a-package-accelerator.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to create a package accelerator diff --git a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md b/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md index 936ec0bf29..c6983aab02 100644 --- a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md +++ b/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to create a virtual application package using an App-V Package Accelerator diff --git a/windows/application-management/app-v/appv-create-and-use-a-project-template.md b/windows/application-management/app-v/appv-create-and-use-a-project-template.md index 5e2bef4061..54aa412604 100644 --- a/windows/application-management/app-v/appv-create-and-use-a-project-template.md +++ b/windows/application-management/app-v/appv-create-and-use-a-project-template.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Create and apply an App-V project template to a sequenced App-V package diff --git a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md index 66e540afb8..197cff66cb 100644 --- a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md +++ b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Creating and managing App-V virtualized applications diff --git a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md index d1a19673a2..aae5ad7d4c 100644 --- a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md +++ b/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 07/10/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to customize virtual applications extensions for a specific AD group by using the Management Console diff --git a/windows/application-management/app-v/appv-delete-a-connection-group.md b/windows/application-management/app-v/appv-delete-a-connection-group.md index cce79c8074..9747e3066d 100644 --- a/windows/application-management/app-v/appv-delete-a-connection-group.md +++ b/windows/application-management/app-v/appv-delete-a-connection-group.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to delete a connection group diff --git a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md index efb08e96ef..3b5027c30b 100644 --- a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md +++ b/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to delete a package in the Management Console diff --git a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md b/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md index a8d4e50173..fa0a2dca44 100644 --- a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md +++ b/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to deploy the App-V databases by using SQL scripts diff --git a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md index f71def779b..0c013faf96 100644 --- a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to deploy App-V packages using electronic software distribution diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md b/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md index a2d5fcd633..9ee527503b 100644 --- a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md +++ b/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to deploy the App-V server using a script diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server.md b/windows/application-management/app-v/appv-deploy-the-appv-server.md index 79a0d77597..d30cf24d63 100644 --- a/windows/application-management/app-v/appv-deploy-the-appv-server.md +++ b/windows/application-management/app-v/appv-deploy-the-appv-server.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to Deploy the App-V Server (new installation) @@ -32,7 +32,7 @@ ms.topic: article 1. Download the App-V server components. All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from either of the following locations: * The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from this site. - * The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home). + * The [Volume Licensing Service Center](https://www.microsoft.com/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home). 2. Copy the App-V server installation files to the computer on which you want to install it. 3. Start the App-V server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**. 4. Review and accept the license terms, and choose whether to enable Microsoft updates. diff --git a/windows/application-management/app-v/appv-deploying-appv.md b/windows/application-management/app-v/appv-deploying-appv.md index ee60adece8..d71a0f0476 100644 --- a/windows/application-management/app-v/appv-deploying-appv.md +++ b/windows/application-management/app-v/appv-deploying-appv.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying App-V for Windows 10 diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md index 126da2945c..eb84b6e2b7 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying Microsoft Office 2010 by Using App-V @@ -86,7 +86,7 @@ The following table provides a full list of supported integration points for Off ### Office 2010 App-V Packages -* [Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/en-us/download/details.aspx?id=38399) +* [Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/download/details.aspx?id=38399) * [Known issues when you create or use an App-V 5.0 Office 2010 package](https://support.microsoft.com/kb/2828619) * [How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/kb/2830069) diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md index 2b22d0a46a..6fa996507f 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying Microsoft Office 2013 by Using App-V diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md index f9239225d9..ce7303bbf8 100644 --- a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md +++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying Microsoft Office 2016 by using App-V diff --git a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md index 0bc8d491a1..37adcaae5e 100644 --- a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying App-V packages by using electronic software distribution (ESD) @@ -30,7 +30,7 @@ To learn how to configure the App-V client to enable only administrators to publ ## Related topics -- [App-V and Citrix integration](https://www.microsoft.com/en-us/download/details.aspx?id=40885) +- [App-V and Citrix integration](https://www.microsoft.com/download/details.aspx?id=40885) - [Operations for App-V](appv-operations.md) diff --git a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md index b1535ba7a9..4edf732dd1 100644 --- a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md +++ b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying the App-V Sequencer and configuring the client diff --git a/windows/application-management/app-v/appv-deploying-the-appv-server.md b/windows/application-management/app-v/appv-deploying-the-appv-server.md index ae16a7025e..576764fb91 100644 --- a/windows/application-management/app-v/appv-deploying-the-appv-server.md +++ b/windows/application-management/app-v/appv-deploying-the-appv-server.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Deploying the App-V server @@ -45,7 +45,7 @@ App-V offers the following five server components, each of which serves a specif All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from either of the following locations: * The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from this site. -* The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home). +* The [Volume Licensing Service Center](https://www.microsoft.com/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home). In large organizations, you might want to install more than one instance of the server components to get the following benefits. diff --git a/windows/application-management/app-v/appv-deployment-checklist.md b/windows/application-management/app-v/appv-deployment-checklist.md index da297a75ef..bb97e27472 100644 --- a/windows/application-management/app-v/appv-deployment-checklist.md +++ b/windows/application-management/app-v/appv-deployment-checklist.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # App-V Deployment Checklist diff --git a/windows/application-management/app-v/appv-dynamic-configuration.md b/windows/application-management/app-v/appv-dynamic-configuration.md index 61c8be02a4..13a82055b6 100644 --- a/windows/application-management/app-v/appv-dynamic-configuration.md +++ b/windows/application-management/app-v/appv-dynamic-configuration.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # About App-V dynamic configuration diff --git a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md index 007503ac03..656f0264ce 100644 --- a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to enable only administrators to publish packages by using an ESD diff --git a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md index cbaef2e7a4..39a072c558 100644 --- a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md +++ b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to Enable Reporting on the App-V Client by Using Windows PowerShell diff --git a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md index 39b561ebe4..d9644226fb 100644 --- a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md +++ b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Enable the App-V in-box client diff --git a/windows/application-management/app-v/appv-evaluating-appv.md b/windows/application-management/app-v/appv-evaluating-appv.md index 6381b20416..df7f76ca07 100644 --- a/windows/application-management/app-v/appv-evaluating-appv.md +++ b/windows/application-management/app-v/appv-evaluating-appv.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-for-windows.md b/windows/application-management/app-v/appv-for-windows.md index c05dd40169..459032925c 100644 --- a/windows/application-management/app-v/appv-for-windows.md +++ b/windows/application-management/app-v/appv-for-windows.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Application Virtualization (App-V) for Windows 10 overview diff --git a/windows/application-management/app-v/appv-getting-started.md b/windows/application-management/app-v/appv-getting-started.md index a05b56167e..1b1f6592d5 100644 --- a/windows/application-management/app-v/appv-getting-started.md +++ b/windows/application-management/app-v/appv-getting-started.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Getting started with App-V for Windows 10 @@ -18,7 +18,7 @@ ms.topic: article Microsoft Application Virtualization (App-V) for Windows 10 delivers Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service in real time and on an as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally. -With the release of Windows 10, version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise). If you're new to Windows 10 and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. To learn what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md). +With the release of Windows 10, version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/WindowsForBusiness/windows-for-enterprise). If you're new to Windows 10 and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. To learn what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md). If you’re already using App-V, performing an in-place upgrade to Windows 10 on user devices automatically installs the App-V client and migrates users’ App-V applications and settings. For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md). @@ -35,13 +35,13 @@ To start using App-V to deliver virtual applications to users, you’ll need to | Component | What it does | Where to find it | |------------|--|------| -| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For more details, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

        If you're already using App-V 5.x, you don't need to redeploy the App-V server components, as they haven't changed since App-V 5.0's release. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package that can be downloaded from the following locations:

        If you have a Microsoft Developer Network (MSDN) subscription, use the [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215) to download the MDOP ISO package.

        If you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home), download it from the [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx).

        See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components.| +| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For more details, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

        If you're already using App-V 5.x, you don't need to redeploy the App-V server components, as they haven't changed since App-V 5.0's release. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package that can be downloaded from the following locations:

        If you have a Microsoft Developer Network (MSDN) subscription, use the [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215) to download the MDOP ISO package.

        If you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home), download it from the [Volume Licensing Service Center](https://www.microsoft.com/licensing/default.aspx).

        See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components.| | App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices, allowing users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10, version 1607.

        To learn how to enable the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md). | | App-V sequencer | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must run the App-V client to allow users to interact with virtual applications. | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows 10, version 1607](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). | For more information about these components, see [High Level Architecture for App-V](appv-high-level-architecture.md). -If you're new to App-V, it's a good idea to read the documentation thoroughly. Before deploying App-V in a production environment, you can ensure installation goes smoothly by validating your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. To get started, see the [Microsoft Training Overview](https://www.microsoft.com/en-us/learning/default.aspx). +If you're new to App-V, it's a good idea to read the documentation thoroughly. Before deploying App-V in a production environment, you can ensure installation goes smoothly by validating your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. To get started, see the [Microsoft Training Overview](https://www.microsoft.com/learning/default.aspx). ## Getting started with App-V diff --git a/windows/application-management/app-v/appv-high-level-architecture.md b/windows/application-management/app-v/appv-high-level-architecture.md index a74cef34c4..ab25607096 100644 --- a/windows/application-management/app-v/appv-high-level-architecture.md +++ b/windows/application-management/app-v/appv-high-level-architecture.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # High-level architecture for App-V diff --git a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md index f4075f53b1..82b6545be6 100644 --- a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md +++ b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md index 30f57f3cb7..ffffedff20 100644 --- a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md +++ b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to Install the Management and Reporting Databases on separate computers from the Management and Reporting Services diff --git a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md index 314545131f..44e1be2801 100644 --- a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md +++ b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to install the Management Server on a Standalone Computer and Connect it to the Database diff --git a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md index c2f081dd15..87ee2f267a 100644 --- a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md +++ b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to install the publishing server on a remote computer diff --git a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md index a0a7912e96..d476fda616 100644 --- a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md +++ b/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to install the reporting server on a standalone computer and connect it to the database diff --git a/windows/application-management/app-v/appv-install-the-sequencer.md b/windows/application-management/app-v/appv-install-the-sequencer.md index 6fe3e63862..93180520e7 100644 --- a/windows/application-management/app-v/appv-install-the-sequencer.md +++ b/windows/application-management/app-v/appv-install-the-sequencer.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Install the App-V Sequencer diff --git a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md b/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md index a4597fb812..bc8cd9361e 100644 --- a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md +++ b/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to load the Windows PowerShell cmdlets for App-V and get cmdlet help diff --git a/windows/application-management/app-v/appv-maintaining-appv.md b/windows/application-management/app-v/appv-maintaining-appv.md index 65f4a157a0..3b54154537 100644 --- a/windows/application-management/app-v/appv-maintaining-appv.md +++ b/windows/application-management/app-v/appv-maintaining-appv.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Maintaining App-V diff --git a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md index f0f0b0ad03..c7f1214405 100644 --- a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md +++ b/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/24/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to manage App-V packages running on a stand-alone computer by using Windows PowerShell diff --git a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md index c3653ce3be..d4e01266f8 100644 --- a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md +++ b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-managing-connection-groups.md b/windows/application-management/app-v/appv-managing-connection-groups.md index 76ced5b4de..5a94cbc421 100644 --- a/windows/application-management/app-v/appv-managing-connection-groups.md +++ b/windows/application-management/app-v/appv-managing-connection-groups.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md index cd519bf28a..dff030f470 100644 --- a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md +++ b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md index a783bac0cb..e2cb4eca48 100644 --- a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md +++ b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md index 11bcc0117b..7fe2f3896f 100644 --- a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md +++ b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md index de47148927..5305207fe6 100644 --- a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md +++ b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-operations.md b/windows/application-management/app-v/appv-operations.md index d5f38d7982..c45c9ab9cf 100644 --- a/windows/application-management/app-v/appv-operations.md +++ b/windows/application-management/app-v/appv-operations.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Operations for App-V diff --git a/windows/application-management/app-v/appv-performance-guidance.md b/windows/application-management/app-v/appv-performance-guidance.md index 40047a8bd9..65ccf02292 100644 --- a/windows/application-management/app-v/appv-performance-guidance.md +++ b/windows/application-management/app-v/appv-performance-guidance.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- @@ -31,7 +31,7 @@ You should read and understand the following information before reading this doc - [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md) -- [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760) +- [App-V Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760) **Note**   Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk * review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document. diff --git a/windows/application-management/app-v/appv-planning-checklist.md b/windows/application-management/app-v/appv-planning-checklist.md index dc6488afb9..edaf668a89 100644 --- a/windows/application-management/app-v/appv-planning-checklist.md +++ b/windows/application-management/app-v/appv-planning-checklist.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # App-V Planning Checklist diff --git a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md index 3a1d781f17..c9c570009a 100644 --- a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md +++ b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning to Use Folder Redirection with App-V diff --git a/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md b/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md index 289e32ec6f..eaf7729f22 100644 --- a/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md +++ b/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning for the App-V server deployment diff --git a/windows/application-management/app-v/appv-planning-for-appv.md b/windows/application-management/app-v/appv-planning-for-appv.md index 175946673a..d54d848a2c 100644 --- a/windows/application-management/app-v/appv-planning-for-appv.md +++ b/windows/application-management/app-v/appv-planning-for-appv.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning for App-V diff --git a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md index e6167f8707..af66e545e4 100644 --- a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md +++ b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning for high availability with App-V Server diff --git a/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md b/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md index adcfe14ddc..4fa3630f7f 100644 --- a/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md +++ b/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning for the App-V Sequencer and Client Deployment diff --git a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md index ae79aea7c4..dac8271c33 100644 --- a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md +++ b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning for deploying App-V with Office diff --git a/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md index 4fec6e664e..7c682239c3 100644 --- a/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md +++ b/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning to Deploy App-V with an electronic software distribution system diff --git a/windows/application-management/app-v/appv-planning-to-deploy-appv.md b/windows/application-management/app-v/appv-planning-to-deploy-appv.md index 8b30ecd4ff..ee9e0b73a9 100644 --- a/windows/application-management/app-v/appv-planning-to-deploy-appv.md +++ b/windows/application-management/app-v/appv-planning-to-deploy-appv.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Planning to Deploy App-V for Windows 10 diff --git a/windows/application-management/app-v/appv-preparing-your-environment.md b/windows/application-management/app-v/appv-preparing-your-environment.md index 33dcf85901..57989881e0 100644 --- a/windows/application-management/app-v/appv-preparing-your-environment.md +++ b/windows/application-management/app-v/appv-preparing-your-environment.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Preparing your environment for App-V diff --git a/windows/application-management/app-v/appv-prerequisites.md b/windows/application-management/app-v/appv-prerequisites.md index 841c318800..bc458a3f94 100644 --- a/windows/application-management/app-v/appv-prerequisites.md +++ b/windows/application-management/app-v/appv-prerequisites.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/18/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # App-V for Windows 10 prerequisites diff --git a/windows/application-management/app-v/appv-publish-a-connection-group.md b/windows/application-management/app-v/appv-publish-a-connection-group.md index c8c8da79fa..41d35e29a0 100644 --- a/windows/application-management/app-v/appv-publish-a-connection-group.md +++ b/windows/application-management/app-v/appv-publish-a-connection-group.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to Publish a Connection Group diff --git a/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md b/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md index 47e033fcbe..cd4469abe5 100644 --- a/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md +++ b/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 09/27/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # How to publish a package by using the Management console diff --git a/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md b/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md index da72c8bd99..2134edc7bb 100644 --- a/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md +++ b/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md index 9179e46022..dc744d16c2 100644 --- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md +++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md index daf1783e49..bb14436095 100644 --- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md +++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- # Release Notes for App-V for Windows 10, version 1607 diff --git a/windows/application-management/app-v/appv-reporting.md b/windows/application-management/app-v/appv-reporting.md index 99a25f7fda..57a4526ecf 100644 --- a/windows/application-management/app-v/appv-reporting.md +++ b/windows/application-management/app-v/appv-reporting.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/16/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # About App-V reporting @@ -30,7 +30,7 @@ The following list displays the end–to-end high-level workflow for reporting i To confirm SQL Server Reporting Services is running, enter in a web browser as administrator on the server that will host App-V Reporting. The SQL Server Reporting Services Home page should appear. 2. Install the App-V reporting server and associated database. For more information about installing the reporting server see [How to install the Reporting Server on a standalone computer and connect it to the database](appv-install-the-reporting-server-on-a-standalone-computer.md). Configure the time when the computer running the App-V client should send data to the reporting server. -3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at [Application Virtualization SSRS Reports](https://www.microsoft.com/en-us/download/details.aspx?id=42630). +3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at [Application Virtualization SSRS Reports](https://www.microsoft.com/download/details.aspx?id=42630). > [!NOTE] >If you are using the Configuration Manager integration with App-V, most reports are generated from Configuration Manager rather than from App-V. diff --git a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md index 5582efb79c..3befc157bd 100644 --- a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md +++ b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 03/08/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-security-considerations.md b/windows/application-management/app-v/appv-security-considerations.md index 32939d5452..ab6c1c4c32 100644 --- a/windows/application-management/app-v/appv-security-considerations.md +++ b/windows/application-management/app-v/appv-security-considerations.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/16/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # App-V security considerations diff --git a/windows/application-management/app-v/appv-sequence-a-new-application.md b/windows/application-management/app-v/appv-sequence-a-new-application.md index bdb63f9a46..c3e16261db 100644 --- a/windows/application-management/app-v/appv-sequence-a-new-application.md +++ b/windows/application-management/app-v/appv-sequence-a-new-application.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/16/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # Manually sequence a new app using the Microsoft Application Virtualization Sequencer (App-V Sequencer) diff --git a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md b/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md index 1ccb908974..349ead11a5 100644 --- a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md +++ b/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-supported-configurations.md b/windows/application-management/app-v/appv-supported-configurations.md index cdf2a4782e..2dce846fd9 100644 --- a/windows/application-management/app-v/appv-supported-configurations.md +++ b/windows/application-management/app-v/appv-supported-configurations.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/16/2018 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article --- # App-V Supported Configurations diff --git a/windows/application-management/app-v/appv-technical-reference.md b/windows/application-management/app-v/appv-technical-reference.md index 910287f6d3..e0f6e0f48d 100644 --- a/windows/application-management/app-v/appv-technical-reference.md +++ b/windows/application-management/app-v/appv-technical-reference.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md index 92cd2124d8..a085b22759 100644 --- a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md +++ b/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-troubleshooting.md b/windows/application-management/app-v/appv-troubleshooting.md index fdacc04362..fd794d1044 100644 --- a/windows/application-management/app-v/appv-troubleshooting.md +++ b/windows/application-management/app-v/appv-troubleshooting.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md index 5234b80231..4aedf60d24 100644 --- a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md +++ b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- # Upgrading to App-V for Windows 10 from an existing installation diff --git a/windows/application-management/app-v/appv-using-the-client-management-console.md b/windows/application-management/app-v/appv-using-the-client-management-console.md index 83bfa11219..b6691c2fc5 100644 --- a/windows/application-management/app-v/appv-using-the-client-management-console.md +++ b/windows/application-management/app-v/appv-using-the-client-management-console.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- @@ -22,7 +22,7 @@ This topic provides information about using the Application Virtualization (App- ## Obtain the client management console -The client management console is separate from the App-V client itself. You can download the client management console from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=41186). +The client management console is separate from the App-V client itself. You can download the client management console from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=41186). > [!NOTE] > To perform all of the actions available using the client management console, you must have administrative access on the computer running the App-V client. diff --git a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md index 2d1bb8bb98..e949a9406e 100644 --- a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md +++ b/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md index 771291c90e..eac57684c6 100644 --- a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md +++ b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp --- diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 5ce9e92dc8..7b5828d9c2 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -ms.author: tracyp +ms.author: dansimp author: msfttracyp ms.localizationpriority: medium ms.topic: article diff --git a/windows/application-management/change-history-for-application-management.md b/windows/application-management/change-history-for-application-management.md index 394767a6af..b7fda33af3 100644 --- a/windows/application-management/change-history-for-application-management.md +++ b/windows/application-management/change-history-for-application-management.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: msfttracyp -ms.author: tracyp +ms.author: dansimp ms.topic: article ms.date: 10/24/2017 ms.reviewer: diff --git a/windows/application-management/deploy-app-upgrades-windows-10-mobile.md b/windows/application-management/deploy-app-upgrades-windows-10-mobile.md index d2c0c0bc21..d176e86059 100644 --- a/windows/application-management/deploy-app-upgrades-windows-10-mobile.md +++ b/windows/application-management/deploy-app-upgrades-windows-10-mobile.md @@ -5,7 +5,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -ms.author: tracyp +ms.author: dansimp author: msfttracyp ms.date: 07/21/2017 ms.reviewer: diff --git a/windows/application-management/docfx.json b/windows/application-management/docfx.json index f7c9b35003..ee08c91bcf 100644 --- a/windows/application-management/docfx.json +++ b/windows/application-management/docfx.json @@ -33,6 +33,7 @@ "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", + "audience": "ITPro", "ms.topic": "article", "ms.author": "elizapo", "feedback_system": "GitHub", diff --git a/windows/application-management/enterprise-background-activity-controls.md b/windows/application-management/enterprise-background-activity-controls.md index dfb14cdb36..a9bdc7b123 100644 --- a/windows/application-management/enterprise-background-activity-controls.md +++ b/windows/application-management/enterprise-background-activity-controls.md @@ -2,7 +2,7 @@ author: msfttracyp title: Remove background task resource restrictions description: Allow enterprise background tasks unrestricted access to computer resources. -ms.author: tracyp +ms.author: dansimp ms.date: 10/03/2017 ms.reviewer: manager: dansimp diff --git a/windows/application-management/index.md b/windows/application-management/index.md index 31196fe532..fef303c216 100644 --- a/windows/application-management/index.md +++ b/windows/application-management/index.md @@ -4,9 +4,9 @@ description: Windows 10 application management ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +manager: dansimp +author: dansimp ms.localizationpriority: high -ms.date: 09/26/2017 --- # Windows 10 application management diff --git a/windows/application-management/manage-windows-mixed-reality.md b/windows/application-management/manage-windows-mixed-reality.md index 56d7147923..74edf682a0 100644 --- a/windows/application-management/manage-windows-mixed-reality.md +++ b/windows/application-management/manage-windows-mixed-reality.md @@ -9,7 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium author: msfttracyp -ms.author: tracyp +ms.author: dansimp ms.topic: article --- diff --git a/windows/application-management/msix-app-packaging-tool.md b/windows/application-management/msix-app-packaging-tool.md index 1d38d2f161..adcf842841 100644 --- a/windows/application-management/msix-app-packaging-tool.md +++ b/windows/application-management/msix-app-packaging-tool.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium -ms.author: tracyp +ms.author: dansimp ms.topic: article ms.date: 12/03/2018 ms.reviewer: diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 53121c3c18..1100a66787 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -1,11 +1,11 @@ --- -title: Per-user services in Windows 10 and Windows Server +title: Per-user services in Windows 10 and Windows Server description: Learn about per-user services introduced in Windows 10. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -ms.author: tracyp +ms.author: dansimp author: msfttracyp ms.date: 09/14/2017 ms.reviewer: @@ -92,7 +92,7 @@ Revision=1 If a per-user service can't be disabled using a the security template, you can disable it by using Group Policy preferences. -1. On a Windows Server domain controller or Windows 10 PC that has the [Remote Server Administration Tools (RSAT)](https://www.microsoft.com/en-us/download/details.aspx?id=45520) installed, click **Start**, type GPMC.MSC, and then press **Enter** to open the **Group Policy Management Console**. +1. On a Windows Server domain controller or Windows 10 PC that has the [Remote Server Administration Tools (RSAT)](https://www.microsoft.com/download/details.aspx?id=45520) installed, click **Start**, type GPMC.MSC, and then press **Enter** to open the **Group Policy Management Console**. 2. Create a new Group Policy Object (GPO) or use an existing GPO. diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index 371e401c1a..27c49f97ae 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -4,7 +4,7 @@ description: How to keep provisioned apps that were removed from your machine fr ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.author: tracyp +ms.author: dansimp author: msfttracyp ms.date: 05/25/2018 ms.reviewer: @@ -162,9 +162,13 @@ Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] -``` +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.3DBuilder_8wekyb3d8bbwe] +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe] + +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Messaging_8wekyb3d8bbwe] +``` [Get-AppxPackage](https://docs.microsoft.com/powershell/module/appx/get-appxpackage) [Get-AppxPackage -allusers](https://docs.microsoft.com/powershell/module/appx/get-appxpackage) diff --git a/windows/application-management/sideload-apps-in-windows-10.md b/windows/application-management/sideload-apps-in-windows-10.md index 8052f02284..2dc4591d51 100644 --- a/windows/application-management/sideload-apps-in-windows-10.md +++ b/windows/application-management/sideload-apps-in-windows-10.md @@ -4,7 +4,7 @@ description: Sideload line-of-business apps in Windows 10. ms.assetid: C46B27D0-375B-4F7A-800E-21595CF1D53D ms.reviewer: manager: dansimp -ms.author: tracyp +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -19,6 +19,9 @@ ms.date: 05/20/2019 - Windows 10 - Windows 10 Mobile +> [!NOTE] +> As of Windows Insider Build 18956, sideloading is enabled by default. Now, you can deploy a signed package onto a device without a special configuration. + "Line-of-Business" (LOB) apps are present in a wide range of businesses and organizations. Organizations value these apps because they solve problems unique to each business. When you sideload an app, you deploy a signed app package to a device. You maintain the signing, hosting, and deployment of these apps. Sideloading was also available with Windows 8 and Windows 8.1 diff --git a/windows/application-management/svchost-service-refactoring.md b/windows/application-management/svchost-service-refactoring.md index 58e0e60b57..3bd1bf1897 100644 --- a/windows/application-management/svchost-service-refactoring.md +++ b/windows/application-management/svchost-service-refactoring.md @@ -5,7 +5,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -ms.author: tracyp +ms.author: dansimp author: msfttracyp ms.date: 07/20/2017 ms.reviewer: diff --git a/windows/client-management/TOC.md b/windows/client-management/TOC.md index d3c28bfc73..05d41bdfa9 100644 --- a/windows/client-management/TOC.md +++ b/windows/client-management/TOC.md @@ -22,6 +22,10 @@ ##### [Troubleshoot port exhaustion](troubleshoot-tcpip-port-exhaust.md) ##### [Troubleshoot Remote Procedure Call (RPC) errors](troubleshoot-tcpip-rpc-errors.md) ### [Advanced troubleshooting for Windows startup](troubleshoot-windows-startup.md) +#### [How to determine the appropriate page file size for 64-bit versions of Windows](determine-appropriate-page-file-size.md) +#### [Generate a kernel or complete crash dump](generate-kernel-or-complete-crash-dump.md) +#### [Introduction to the page file](introduction-page-file.md) +#### [Configure system failure and recovery options in Windows](system-failure-recovery-options.md) #### [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md) #### [Advanced troubleshooting for Windows-based computer freeze](troubleshoot-windows-freeze.md) #### [Advanced troubleshooting for stop error or blue screen error](troubleshoot-stop-errors.md) diff --git a/windows/client-management/advanced-troubleshooting-802-authentication.md b/windows/client-management/advanced-troubleshooting-802-authentication.md index 7edad5cf25..878b065aa7 100644 --- a/windows/client-management/advanced-troubleshooting-802-authentication.md +++ b/windows/client-management/advanced-troubleshooting-802-authentication.md @@ -17,7 +17,7 @@ ms.topic: troubleshooting ## Overview -This is a general troubleshooting of 802.1X wireless and wired clients. With 802.1X and wireless troubleshooting, it's important to know how the flow of authentication works, and then figuring out where it's breaking. It involves a lot of third party devices and software. Most of the time, we have to identify where the problem is, and another vendor has to fix it. Since we don't make access points or wwitches, it won't be an end-to-end Microsoft solution. +This is a general troubleshooting of 802.1X wireless and wired clients. With 802.1X and wireless troubleshooting, it's important to know how the flow of authentication works, and then figuring out where it's breaking. It involves a lot of third party devices and software. Most of the time, we have to identify where the problem is, and another vendor has to fix it. Since we don't make access points or switches, it won't be an end-to-end Microsoft solution. ## Scenarios diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index e83a4bf8bd..5f1c4ea9c9 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -14,8 +14,8 @@ ms.topic: troubleshooting # Advanced troubleshooting for Windows boot problems ->[!NOTE] ->This article is intended for use by support agents and IT professionals. If you're looking for more general information about recovery options, see [Recovery options in Windows 10](https://support.microsoft.com/help/12415). +> [!NOTE] +> This article is intended for use by support agents and IT professionals. If you're looking for more general information about recovery options, see [Recovery options in Windows 10](https://support.microsoft.com/help/12415). ## Summary @@ -58,14 +58,14 @@ Here is a summary of the boot sequence, what will be seen on the display, and ty Each phase has a different approach to troubleshooting. This article provides troubleshooting techniques for problems that occur during the first three phases. ->[!NOTE] ->If the computer repeatedly boots to the recovery options, run the following command at a command prompt to break the cycle: +> [!NOTE] +> If the computer repeatedly boots to the recovery options, run the following command at a command prompt to break the cycle: > ->`Bcdedit /set {default} recoveryenabled no` +> `Bcdedit /set {default} recoveryenabled no` > ->If the F8 options don't work, run the following command: +> If the F8 options don't work, run the following command: > ->`Bcdedit /set {default} bootmenupolicy legacy` +> `Bcdedit /set {default} bootmenupolicy legacy` ## BIOS phase @@ -98,11 +98,10 @@ The Startup Repair tool automatically fixes many common problems. The tool also To do this, follow these steps. ->[!NOTE] ->For additional methods to start WinRE, see [Entry points into WinRE](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference#span-identrypointsintowinrespanspan-identrypointsintowinrespanspan-identrypointsintowinrespanentry-points-into-winre). +> [!NOTE] +> For additional methods to start WinRE, see [Windows Recovery Environment (Windows RE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference#span-identrypointsintowinrespanspan-identrypointsintowinrespanspan-identrypointsintowinrespanentry-points-into-winre). -1. Start the system to the installation media for the installed version of Windows. - **Note** For more information, see [Create installation media for Windows](https://support.microsoft.com/help/15088). +1. Start the system to the installation media for the installed version of Windows. For more information, see [Create installation media for Windows](https://support.microsoft.com/help/15088). 2. On the **Install Windows** screen, select **Next** > **Repair your computer**. @@ -132,8 +131,8 @@ To repair the boot sector, run the following command: BOOTREC /FIXBOOT ``` ->[!NOTE] ->Running **BOOTREC** together with **Fixmbr** overwrites only the master boot code. If the corruption in the MBR affects the partition table, running **Fixmbr** may not fix the problem. +> [!NOTE] +> Running **BOOTREC** together with **Fixmbr** overwrites only the master boot code. If the corruption in the MBR affects the partition table, running **Fixmbr** may not fix the problem. ### Method 3: Fix BCD errors @@ -152,20 +151,25 @@ If you receive BCD-related errors, follow these steps: ``` 4. You might receive one of the following outputs: - - - Scanning all disks for Windows installations. Please wait, since this may take a while...Successfully scanned Windows installations. Total identified Windows installations: 0 + ```dos + Scanning all disks for Windows installations. Please wait, since this may take a while ... + Successfully scanned Windows installations. Total identified Windows installations: 0 The operation completed successfully. + ``` - - Scanning all disks for Windows installations. Please wait, since this may take a while... Successfully scanned Windows installations. Total identified Windows installations: 1 + ```dos + Scanning all disks for Windows installations. Please wait, since this may take a while ... + Successfully scanned Windows installations. Total identified Windows installations: 1 D:\Windows Add installation to boot list? Yes/No/All: + ``` If the output shows **windows installation: 0**, run the following commands: ```dos bcdedit /export c:\bcdbackup -attrib c:\\boot\\bcd -h -r –s +attrib c:\\boot\\bcd -r –s -h ren c:\\boot\\bcd bcd.old @@ -174,39 +178,41 @@ bootrec /rebuildbcd After you run the command, you receive the following output: - Scanning all disks for Windows installations. Please wait, since this may take a while...Successfully scanned Windows installations. Total identified Windows installations: 1{D}:\Windows +```dos +Scanning all disks for Windows installations. Please wait, since this may take a while ... +Successfully scanned Windows installations. Total identified Windows installations: 1 +{D}:\Windows Add installation to boot list? Yes/No/All: Y +``` -5. Try again to start the system. +5. Try restarting the system. ### Method 4: Replace Bootmgr -If methods 1 and 2 do not fix the problem, replace the Bootmgr file from drive C to the System Reserved partition. To do this, follow these steps: +If methods 1, 2 and 3 do not fix the problem, replace the Bootmgr file from drive C to the System Reserved partition. To do this, follow these steps: 1. At a command prompt, change the directory to the System Reserved partition. 2. Run the **attrib** command to unhide the file: ```dos - attrib-s -h -r + attrib -r -s -h ``` 3. Run the same **attrib** command on the Windows (system drive): ```dos - attrib-s -h –r + attrib -r -s -h ``` 4. Rename the Bootmgr file as Bootmgr.old: ```dos - ren c:\\bootmgr bootmgr.old + ren c:\bootmgr bootmgr.old ``` -5. Start a text editor, such as Notepad. +5. Navigate to the system drive. -6. Navigate to the system drive. +6. Copy the Bootmgr file, and then paste it to the System Reserved partition. -7. Copy the Bootmgr file, and then paste it to the System Reserved partition. - -8. Restart the computer. +7. Restart the computer. ### Method 5: Restore System Hive @@ -267,16 +273,16 @@ For detailed instructions, see [How to perform a clean boot in Windows](https:// If the computer starts in Disable Driver Signature mode, start the computer in Disable Driver Signature Enforcement mode, and then follow the steps that are documented in the following article to determine which drivers or files require driver signature enforcement: [Troubleshooting boot problem caused by missing driver signature (x64)](https://blogs.technet.microsoft.com/askcore/2012/04/15/troubleshooting-boot-issues-due-to-missing-driver-signature-x64/) ->[!NOTE] ->If the computer is a domain controller, try Directory Services Restore mode (DSRM). +> [!NOTE] +> If the computer is a domain controller, try Directory Services Restore mode (DSRM). > ->This method is an important step if you encounter Stop error "0xC00002E1" or "0xC00002E2" +> This method is an important step if you encounter Stop error "0xC00002E1" or "0xC00002E2" **Examples** ->[!WARNING] ->Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these +> [!WARNING] +> Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk. *Error code INACCESSIBLE_BOOT_DEVICE (STOP 0x7B)* @@ -307,11 +313,11 @@ For additional troubleshooting steps, see the following articles: To fix problems that occur after you install Windows updates, check for pending updates by using these steps: -1. Open a Command Prompt winodw in WinRE. +1. Open a Command Prompt window in WinRE. 2. Run the command: ```dos - dism /image:C:\ /get-packages + DISM /image:C:\ /get-packages ``` 3. If there are any pending updates, uninstall them by running the following commands: @@ -319,7 +325,7 @@ To fix problems that occur after you install Windows updates, check for pending DISM /image:C:\ /remove-package /packagename: name of the package ``` ```dos - Dism /Image:C:\ /Cleanup-Image /RevertPendingActions + DISM /Image:C:\ /Cleanup-Image /RevertPendingActions ``` Try to start the computer. diff --git a/windows/client-management/determine-appropriate-page-file-size.md b/windows/client-management/determine-appropriate-page-file-size.md new file mode 100644 index 0000000000..b6abb3661e --- /dev/null +++ b/windows/client-management/determine-appropriate-page-file-size.md @@ -0,0 +1,129 @@ +--- +title: How to determine the appropriate page file size for 64-bit versions of Windows +description: Learn how to determine the appropriate page file size for 64-bit versions of Windows. +ms.prod: w10 +ms.sitesec: library +ms.topic: troubleshooting +author: Deland-Han +ms.localizationpriority: medium +ms.author: delhan +ms.date: 8/28/2019 +ms.reviewer: +manager: dcscontentpm +--- + +# How to determine the appropriate page file size for 64-bit versions of Windows + +Page file sizing depends on the system crash dump setting requirements and the peak usage or expected peak usage of the system commit charge. Both considerations are unique to each system, even for systems that are identical. This means that page file sizing is also unique to each system and cannot be generalized. + +## Determine the appropriate page file size + +Use the following considerations for page file sizing for all versions of Windows and Windows Server. + +### Crash dump setting + +If you want a crash dump file to be created during a system crash, a page file or a dedicated dump file must exist and be large enough to back up the system crash dump setting. Otherwise, a system memory dump file is not created. + +For more information, see [Support for system crash dumps](introduction-page-file.md#support-for-system-crash-dumps) section. + +### Peak system commit charge + +The system commit charge cannot exceed the system commit limit. This limit is the sum of physical memory (RAM) and all page files combined. If no page files exist, the system commit limit is slightly less than the physical memory that is installed. Peak system-committed memory usage can vary greatly between systems. Therefore, physical memory and page file sizing also vary. + +### Quantity of infrequently accessed pages + +The purpose of a page file is to *back* (support) infrequently accessed modified pages so that they can be removed from physical memory. This provides more available space for more frequently accessed pages. The "\Memory\Modified Page List Bytes" performance counter measures, in part, the number of infrequently accessed modified pages that are destined for the hard disk. However, be aware that not all the memory on the modified page list is written out to disk. Typically, several hundred megabytes of memory remains resident on the modified list. Therefore, consider extending or adding a page file if all the following conditions are true: + +- More available physical memory (\Memory\Available MBytes) is required. + +- The modified page list contains a significant amount of memory. + +- The existing page files are fairly full (\Paging Files(*)\% Usage). + +## Support for system crash dumps + +A system crash (also known as a “bug check” or a "Stop error") occurs when the system cannot run correctly. The dump file that is produced from this event is called a system crash dump. A page file or dedicated dump file is used to write a crash dump file (Memory.dmp) to disk. Therefore, a page file or a dedicated dump file must be large enough to support the kind of crash dump selected. Otherwise, the system cannot create the crash dump file. + +>[!Note] +>During startup, system-managed page files are sized respective to the system crash dump settings. This assumes that enough free disk space exists. + +|System crash dump setting |Minimum page file size requirement| +|-----------|-------------------| +|Small memory dump (256 KB) |1 MB| +|Kernel memory dump |Depends on kernel virtual memory usage| +|Complete memory dump |1 x RAM plus 257 MB*| +|Automatic memory dump |Depends on kernel virtual memory usage. For details, see Automatic memory dump.| + +\* 1 MB of header data and device drivers can total 256 MB of secondary crash dump data. + +The **Automatic memory dump** setting is enabled by default. This is a setting instead of a kind of crash dump. This setting automatically selects the best page file size, depending on the frequency of system crashes. + +The Automatic memory dump feature initially selects a small paging file size. It would accommodate the kernel memory most of the time. If the system crashes again within four weeks, the Automatic memory dump feature sets the page file size as either the RAM size or 32 GB, whichever is smaller. + +Kernel memory crash dumps require enough page file space or dedicated dump file space to accommodate the kernel mode side of virtual memory usage. If the system crashes again within four weeks of the previous crash, a Complete memory dump is selected at restart. This requires a page file or dedicated dump file of at least the size of physical memory (RAM) plus 1 MB for header information plus 256 MB for potential driver data to support all the potential data that is dumped from memory. Again, the system-managed page file will be increased to back this kind of crash dump. If the system is configured to have a page file or a dedicated dump file of a specific size, make sure that the size is sufficient to back the crash dump setting that is listed in the table earlier in this section together with and the peak system commit charge. + +### Dedicated dump files + +Computers that are running Microsoft Windows or Microsoft Windows Server usually must have a page file to support a system crash dump. System administrators now have the option to create a dedicated dump file instead. + +A dedicated dump file is a page file that is not used for paging. Instead, it is “dedicated” to back a system crash dump file (Memory.dmp) when a system crash occurs. Dedicated dump files can be put on any disk volume that can support a page file. We recommend that you use a dedicated dump file if you want a system crash dump but you do not want a page file. + +## System-managed page files + +By default, page files are system-managed. This means that the page files increase and decrease based on many factors, such as the amount of physical memory installed, the process of accommodating the system commit charge, and the process of accommodating a system crash dump. + +For example, when the system commit charge is more than 90 percent of the system commit limit, the page file is increased to back it. This continues to occur until the page file reaches three times the size of physical memory or 4 GB, whichever is larger. This all assumes that the logical disk that is hosting the page file is large enough to accommodate the growth. + +The following table lists the minimum and maximum page file sizes of system-managed page files in Windows 10. + +|Minimum page file size |Maximum page file size| +|---------------|------------------| +|Varies based on page file usage history, amount of RAM (RAM ÷ 8, max 32 GB) and crash dump settings. |3 × RAM or 4 GB, whichever is larger. This is then limited to the volume size ÷ 8. However, it can grow to within 1 GB of free space on the volume if required for crash dump settings.| + +## Performance counters + +Several performance counters are related to page files. This section describes the counters and what they measure. + +### \Memory\Page/sec and other hard page fault counters + +The following performance counters measure hard page faults (which include, but are not limited to, page file reads): + +- \Memory\Page/sec + +- \Memory\Page Reads/sec + +- \Memory\Page Inputs/sec + +The following performance counters measure page file writes: + +- \Memory\Page Writes/sec + +- \Memory\Page Output/sec + +Hard page faults are faults that must be resolved by retrieving the data from disk. Such data can include portions of DLLs, .exe files, memory-mapped files, and page files. These faults might or might not be related to a page file or to a low-memory condition. Hard page faults are a standard function of the operating system. They occur when the following items are read: + +- Parts of image files (.dll and .exe files) as they are used + +- Memory-mapped files + +- A page file + +High values for these counters (excessive paging) indicate disk access of generally 4 KB per page fault on x86 and x64 versions of Windows and Windows Server. This disk access might or might not be related to page file activity but may contribute to poor disk performance that can cause system-wide delays if the related disks are overwhelmed. + +Therefore, we recommend that you monitor the disk performance of the logical disks that host a page file in correlation with these counters. Be aware that a system that has a sustained 100 hard page faults per second experiences 400 KB per second disk transfers. Most 7,200 RPM disk drives can handle about 5 MB per second at an IO size of 16 KB or 800 KB per second at an IO size of 4 KB. No performance counter directly measures which logical disk the hard page faults are resolved for. + +### \Paging File(*)\% Usage + +The \Paging File(*)\% Usage performance counter measures the percentage of usage of each page file. 100 percent usage of a page file does not indicate a performance problem as long as the system commit limit is not reached by the system commit charge, and if a significant amount of memory is not waiting to be written to a page file. + +>[!Note] +>The size of the Modified Page List (\Memory\Modified Page List Bytes) is the total of modified data that is waiting to be written to disk. + +If the Modified Page List (a list of physical memory pages that are the least frequently accessed) contains lots of memory, and if the **% Usage** value of all page files is greater than 90, you can make more physical memory available for more frequently access pages by increasing or adding a page file. + +>[!Note] +>Not all the memory on the modified page list is written out to disk. Typically, several hundred megabytes of memory remains resident on the modified list. + +## Multiple page files and disk considerations + +If a system is configured to have more than one page files, the page file that responds first is the one that is used. This means that page files that are on faster disks are used more frequently. Also, whether you put a page file on a “fast” or “slow” disk is important only if the page file is frequently accessed and if the disk that is hosting the respective page file is overwhelmed. Be aware that actual page file usage depends greatly on the amount of modified memory that the system is managing. This means that files that already exist on disk (such as .txt, .doc, .dll, and .exe) are not written to a page file. Only modified data that does not already exist on disk (for example, unsaved text in Notepad) is memory that could potentially be backed by a page file. After the unsaved data is saved to disk as a file, it is backed by the disk and not by a page file. diff --git a/windows/client-management/docfx.json b/windows/client-management/docfx.json index c5967a88c3..d687294412 100644 --- a/windows/client-management/docfx.json +++ b/windows/client-management/docfx.json @@ -33,7 +33,9 @@ "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", + "audience": "ITPro", "ms.topic": "article", + "manager": "dansimp", "feedback_system": "GitHub", "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", diff --git a/windows/client-management/generate-kernel-or-complete-crash-dump.md b/windows/client-management/generate-kernel-or-complete-crash-dump.md new file mode 100644 index 0000000000..894ed853fc --- /dev/null +++ b/windows/client-management/generate-kernel-or-complete-crash-dump.md @@ -0,0 +1,111 @@ +--- +title: Generate a kernel or complete crash dump +description: Learn how to generate a kernel or complete crash dump. +ms.prod: w10 +ms.sitesec: library +ms.topic: troubleshooting +author: Deland-Han +ms.localizationpriority: medium +ms.author: delhan +ms.date: 8/28/2019 +ms.reviewer: +manager: dcscontentpm +--- + +# Generate a kernel or complete crash dump + +A system crash (also known as a “bug check” or a "Stop error") occurs when Windows can't run correctly. The dump file that is produced from this event is called a system crash dump. + +A manual kernel or complete memory dump file is useful when you troubleshoot several issues because the process captures a record of system memory at the time of a crash. + +## Set up page files + +See [Support for system crash dumps](determine-appropriate-page-file-size.md#support-for-system-crash-dumps) for the page file size requirement for system crash dump. + +## Enable memory dump setting + +You must be logged on as an administrator or a member of the Administrators group to complete this procedure. If your computer is connected to a network, network policy settings may prevent you from completing this procedure. + +To enable memory dump setting, follow these steps: + +1. In **Control Panel**, select **System and Security** > **System**. + +2. Select **Advanced system settings**, and then select the **Advanced** tab. + +3. In the **Startup and Recovery** area, select **Settings**. + +4. Make sure that **Kernel memory dump** or **Complete memory dump** is selected under **Writing Debugging Information**. + +5. Restart the computer. + +>[!Note] +>You can change the dump file path by edit the **Dump file** field. In other words, you can change the path from %SystemRoot%\Memory.dmp to point to a local drive that has enough disk space, such as E:\Memory.dmp. + +### Tips to generate memory dumps + +When the computer crashes and restarts, the contents of physical RAM are written to the paging file that is located on the partition on which the operating system is installed. + +Depending on the speed of the hard disk on which Windows is installed, dumping more than 2 gigabytes (GB) of memory may take a long time. Even in a best case scenario, if the dump file is configured to reside on another local hard drive, a significant amount of data will be read and written to the hard disks. This can cause a prolonged server outage. + +>[!Note] +>Use this method to generate complete memory dump files with caution. Ideally, you should do this only when you are explicitly requested to by the Microsoft Support engineer. Any kernel or complete memory dump file debugging should be the last resort after all standard troubleshooting methods have been completely exhausted. + +## Manually generate a memory dump file + +### Use the NotMyFault tool + +If you can log on while the problem is occurring, you can use the Microsoft Sysinternals NotMyFault tool. To do this, follow these steps: + +1. Download the [NotMyFault](https://download.sysinternals.com/files/NotMyFault.zip) tool. + +2. Select **Start**, and then select **Command Prompt**. +3. At the command line, run the following command: + + ```cmd + notMyfault.exe /crash + ``` + +>[!Note] +>This operation generates a memory dump file and a D1 Stop error. + +### Use NMI + +On some computers, you cannot use keyboard to generate a crash dump file. For example, Hewlett-Packard (HP) BladeSystem servers from the Hewlett-Packard Development Company are managed through a browser-based graphical user interface (GUI). A keyboard is not attached to the HP BladeSystem server. + +In these cases, you must generate a complete crash dump file or a kernel crash dump file by using the Non-Maskable Interrupt (NMI) switch that causes an NMI on the system processor. + +To do this, follow these steps: + +> [!IMPORTANT] +> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur. + +1. In Registry Editor, locate the following registry subkey: + **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl** + +2. Right-click **CrashControl**, point to **New**, and then click **DWORD Value**. + +3. Type NMICrashDump, and then press Enter. + +4. Right-click **NMICrashDump**, and then select **Modify**. + +5. In the **Value data** box, type **1**, and then select **OK**. + +6. Restart the computer. + +7. Hardware vendors, such as HP, IBM, and Dell, may provide an Automatic System Recovery (ASR) feature. You should disable this feature during troubleshooting. For example, if the HP and Compaq ASR feature is enabled in the BIOS, disable this feature while you troubleshoot to generate a complete Memory.dmp file. For the exact steps, contact your hardware vendor. + +8. Enable the NMI switch in the BIOS or by using the Integrated Lights Out (iLO) Web interface. + + >[!Note] + >For the exact steps, see the BIOS reference manual or contact your hardware vendor. + +9. Test this method on the server by using the NMI switch to generate a dump file. You will see a STOP 0x00000080 hardware malfunction. + +### Use the keyboard + +[Forcing a System Crash from the Keyboard](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard) + +### Use Debugger + +[Forcing a System Crash from the Debugger](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-debugger) + diff --git a/windows/client-management/images/out-of-memory.png b/windows/client-management/images/out-of-memory.png new file mode 100644 index 0000000000..c377389128 Binary files /dev/null and b/windows/client-management/images/out-of-memory.png differ diff --git a/windows/client-management/images/task-manager-commit.png b/windows/client-management/images/task-manager-commit.png new file mode 100644 index 0000000000..86d289eebe Binary files /dev/null and b/windows/client-management/images/task-manager-commit.png differ diff --git a/windows/client-management/images/task-manager.png b/windows/client-management/images/task-manager.png new file mode 100644 index 0000000000..c52163f46e Binary files /dev/null and b/windows/client-management/images/task-manager.png differ diff --git a/windows/client-management/index.md b/windows/client-management/index.md index f47496e3b0..ff70171304 100644 --- a/windows/client-management/index.md +++ b/windows/client-management/index.md @@ -4,9 +4,9 @@ description: Windows 10 client management ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.date: 08/16/2017 +ms.author: dansimp --- # Client management diff --git a/windows/client-management/introduction-page-file.md b/windows/client-management/introduction-page-file.md new file mode 100644 index 0000000000..662ae5f90e --- /dev/null +++ b/windows/client-management/introduction-page-file.md @@ -0,0 +1,70 @@ +--- +title: Introduction to the page file +description: Learn about the page files in Windows. +ms.prod: w10 +ms.sitesec: library +ms.topic: troubleshooting +author: Deland-Han +ms.localizationpriority: medium +ms.author: delhan +ms.reviewer: greglin +manager: willchen +--- + +# Introduction to page files + +A page file (also known as a "paging file") is an optional, hidden system file on a hard disk. + +## Functionality + +Page files have the following functionalities. + +### Physical extension of RAM + +Page files enable the system to remove infrequently accessed modified pages from physical memory to let the system use physical memory more efficiently for more frequently accessed pages. + +### Application requirements + +Some products or services require a page file for various reasons. For specific information, check the product documentation. + +For example, the following Windows servers requires page files: + +- Windows Server domain controllers (DCs) +- DFS Replication (DFS-R) servers +- Certificate servers +- ADAM/LDS servers + +This is because the algorithm of the database cache for Extensible Storage Engine (ESENT, or ESE in Microsoft Exchange Server) depends on the "\Memory\Transition Pages RePurposed/sec" performance monitor counter. A page file is required to make sure that the database cache can release memory if other services or applications request memory. + +For Windows Server 2012 Hyper-V and Windows Server 2012 R2 Hyper-V, the page file of the management OS (commonly called the host OS) should be left at the default of setting of "System Managed" . + +### Support for system crash dumps + +Page files can be used to "back" (or support) system crash dumps and extend how much system-committed memory (also known as “virtual memory”) a system can support. + +For more information about system crash dumps, see [system crash dump options](system-failure-recovery-options.md#under-write-debugging-information). + +## Page files in Windows with large physical memory + +When large physical memory is installed, a page file might not be required to support the system commit charge during peak usage. For example, 64-bit versions of Windows and Windows Server support more physical memory (RAM) than 32-bit versions support. The available physical memory alone might be large enough. + +However, the reason to configure the page file size has not changed. It has always been about supporting a system crash dump, if it is necessary, or extending the system commit limit, if it is necessary. For example, when a lot of physical memory is installed, a page file might not be required to back the system commit charge during peak usage. The available physical memory alone might be large enough to do this. However, a page file or a dedicated dump file might still be required to back a system crash dump. + +## System committed memory + +Page files extend how much "committed memory" (also known as "virtual memory") is used to store modified data. + +The system commit memory limit is the sum of physical memory and all page files combined. It represents the maximum system-committed memory (also known as the "system commit charge") that the system can support. + +![Task manager](images/task-manager.png) + +The system commit charge is the total committed or "promised" memory of all committed virtual memory in the system. If the system commit charge reaches the system commit limit, the system and processes might not get committed memory. This condition can cause freezing, crashing, and other malfunctions. Therefore, make sure that you set the system commit limit high enough to support the system commit charge during peak usage. + +![Out of memory](images/out-of-memory.png) + +![Task Manager](images/task-manager-commit.png) + +The system committed charge and system committed limit can be measured on the **Performance** tab in Task Manager or by using the "\Memory\Committed Bytes" and "\Memory\Commit Limit" performance counters. The \Memory\% Committed Bytes In Use counter is a ratio of \Memory\Committed Bytes to \Memory\Commit Limit values. + +>[!Note] +>System-managed page files automatically grow up to three times the physical memory or 4 GB (whichever is larger) when the system commit charge reaches 90 percent of the system commit limit. This assumes that enough free disk space is available to accommodate the growth. diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 4a0423c1e7..c6fe7134c8 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -98,7 +98,7 @@ As you review the roles in your organization, you can use the following generali Your configuration requirements are defined by multiple factors, including the level of management needed, the devices and data managed, and your industry requirements. Meanwhile, employees are frequently concerned about IT applying strict policies to their personal devices, but they still want access to corporate email and documents. With Windows 10, you can create a consistent set of configurations across PCs, tablets, and phones through the common MDM layer.  -**MDM**: [MDM](https://www.microsoft.com/en-us/cloud-platform/mobile-device-management) gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, Group Policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. MDM also allows you to target Internet-connected devices to manage policies without using GP that requires on-premises domain-joined devices. This makes MDM the best choice for devices that are constantly on the go. +**MDM**: [MDM](https://www.microsoft.com/cloud-platform/mobile-device-management) gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, Group Policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. MDM also allows you to target Internet-connected devices to manage policies without using GP that requires on-premises domain-joined devices. This makes MDM the best choice for devices that are constantly on the go. **Group Policy** and **System Center Configuration Manager**: Your organization might still need to manage domain joined computers at a granular level such as Internet Explorer’s 1,500 configurable Group Policy settings. If so, Group Policy and System Center Configuration Manager continue to be excellent management choices: diff --git a/windows/client-management/mdm/accountmanagement-csp.md b/windows/client-management/mdm/accountmanagement-csp.md index 7dd8c78df7..294043dca3 100644 --- a/windows/client-management/mdm/accountmanagement-csp.md +++ b/windows/client-management/mdm/accountmanagement-csp.md @@ -1,7 +1,7 @@ --- title: AccountManagement CSP description: Used to configure settings in the Account Manager service -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/accountmanagement-ddf.md b/windows/client-management/mdm/accountmanagement-ddf.md index 1007c05b28..6f6df91fe0 100644 --- a/windows/client-management/mdm/accountmanagement-ddf.md +++ b/windows/client-management/mdm/accountmanagement-ddf.md @@ -1,7 +1,7 @@ --- title: AccountManagement DDF file description: Used to configure settings in the Account Manager service -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/accounts-csp.md b/windows/client-management/mdm/accounts-csp.md index 810e5c83fa..a0cc7de5dd 100644 --- a/windows/client-management/mdm/accounts-csp.md +++ b/windows/client-management/mdm/accounts-csp.md @@ -1,7 +1,7 @@ --- title: Accounts CSP description: The Accounts configuration service provider (CSP) is used by the enterprise (1) to rename a device, (2) to create a new local Windows account and joint it to a local user group. -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/accounts-ddf-file.md b/windows/client-management/mdm/accounts-ddf-file.md index 623ad0d420..0815b489ba 100644 --- a/windows/client-management/mdm/accounts-ddf-file.md +++ b/windows/client-management/mdm/accounts-ddf-file.md @@ -1,7 +1,7 @@ --- title: Accounts DDF file description: XML file containing the device description framework -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/activesync-csp.md b/windows/client-management/mdm/activesync-csp.md index 9761cd0e66..e2f9441b9c 100644 --- a/windows/client-management/mdm/activesync-csp.md +++ b/windows/client-management/mdm/activesync-csp.md @@ -4,7 +4,7 @@ description: ActiveSync CSP ms.assetid: c65093ef-bd36-4f32-9dab-edb7bcfb3188 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/activesync-ddf-file.md b/windows/client-management/mdm/activesync-ddf-file.md index 839dfccba1..6e4c1c5000 100644 --- a/windows/client-management/mdm/activesync-ddf-file.md +++ b/windows/client-management/mdm/activesync-ddf-file.md @@ -4,7 +4,7 @@ description: ActiveSync DDF file ms.assetid: c4cd4816-ad8f-45b2-9b81-8abb18254096 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md index 174966d463..1eae18e33a 100644 --- a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md +++ b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md @@ -4,7 +4,7 @@ description: Here's a step-by-step guide to adding an Azure Active Directory ten ms.assetid: 36D94BEC-A6D8-47D2-A547-EBD7B7D163FA ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/alljoynmanagement-csp.md b/windows/client-management/mdm/alljoynmanagement-csp.md index 1c55f8740e..e4d45bd4fd 100644 --- a/windows/client-management/mdm/alljoynmanagement-csp.md +++ b/windows/client-management/mdm/alljoynmanagement-csp.md @@ -4,7 +4,7 @@ description: The AllJoynManagement configuration service provider (CSP) allows a ms.assetid: 468E0EE5-EED3-48FF-91C0-89F9D159AA8C ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/alljoynmanagement-ddf.md b/windows/client-management/mdm/alljoynmanagement-ddf.md index 07ae810983..1a79f57833 100644 --- a/windows/client-management/mdm/alljoynmanagement-ddf.md +++ b/windows/client-management/mdm/alljoynmanagement-ddf.md @@ -4,7 +4,7 @@ description: AllJoynManagement DDF ms.assetid: 540C2E60-A041-4749-A027-BBAF0BB046E4 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/application-csp.md b/windows/client-management/mdm/application-csp.md index 265cdca9fe..d4fe92e943 100644 --- a/windows/client-management/mdm/application-csp.md +++ b/windows/client-management/mdm/application-csp.md @@ -4,7 +4,7 @@ description: APPLICATION configuration service provider ms.assetid: 0705b5e9-a1e7-4d70-a73d-7f758ffd8099 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/applicationcontrol-csp-ddf.md b/windows/client-management/mdm/applicationcontrol-csp-ddf.md index fa0bee9334..0cd8b04e7c 100644 --- a/windows/client-management/mdm/applicationcontrol-csp-ddf.md +++ b/windows/client-management/mdm/applicationcontrol-csp-ddf.md @@ -1,7 +1,7 @@ --- title: ApplicationControl CSP description: ApplicationControl CSP -ms.author: dansimp@microsoft.com +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md index 4f5c622cc0..7dc2e66ea2 100644 --- a/windows/client-management/mdm/applicationcontrol-csp.md +++ b/windows/client-management/mdm/applicationcontrol-csp.md @@ -1,7 +1,7 @@ --- title: ApplicationControl CSP description: ApplicationControl CSP -ms.author: dansimp@microsoft.com +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/applicationrestrictions-xsd.md b/windows/client-management/mdm/applicationrestrictions-xsd.md index fbdbc5c383..a088806e23 100644 --- a/windows/client-management/mdm/applicationrestrictions-xsd.md +++ b/windows/client-management/mdm/applicationrestrictions-xsd.md @@ -4,7 +4,7 @@ description: Here's the XSD for the ApplicationManagement/ApplicationRestriction ms.assetid: A5AA2B59-3736-473E-8F70-A90FD61EE426 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index 22a816cc20..79251bed03 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -4,7 +4,7 @@ description: AppLocker CSP ms.assetid: 32FEA2C9-3CAD-40C9-8E4F-E3C69637580F ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows @@ -17,14 +17,6 @@ ms.date: 07/25/2019 The AppLocker configuration service provider is used to specify which applications are allowed or disallowed. There is no user interface shown for apps that are blocked. -> **Note** -> When you create a list of allowed apps, all [inbox apps](#inboxappsandcomponents) are also blocked, and you must include them in your list of allowed apps. Don't forget to add the inbox apps for Phone, Messaging, Settings, Start, Email and accounts, Work and school, and other apps that you need. -> -> In Windows 10 Mobile, when you create a list of allowed apps, the [settings app that rely on splash apps](#settingssplashapps) are blocked. To unblock these apps, you must include them in your list of allowed apps. -> -> Delete/unenrollment is not properly supported unless Grouping values are unique across enrollments. If multiple enrollments use the same Grouping value, then unenrollment will not work as expected since there are duplicate URIs that get deleted by the resource manager. To prevent this problem, the Grouping value should include some randomness. The best practice is to use a randomly generated GUID. However, there is no requirement on the exact value of the node. - - The following diagram shows the AppLocker configuration service provider in tree format. ![applocker csp](images/provisioning-csp-applocker.png) @@ -39,6 +31,9 @@ Defines restrictions for applications. > When you create a list of allowed apps, all [inbox apps](#inboxappsandcomponents) are also blocked, and you must include them in your list of allowed apps. Don't forget to add the inbox apps for Phone, Messaging, Settings, Start, Email and accounts, Work and school, and other apps that you need. > > In Windows 10 Mobile, when you create a list of allowed apps, the [settings app that rely on splash apps](#settingssplashapps) are blocked. To unblock these apps, you must include them in your list of allowed apps. +> +> Delete/unenrollment is not properly supported unless Grouping values are unique across enrollments. If multiple enrollments use the same Grouping value, then unenrollment will not work as expected since there are duplicate URIs that get deleted by the resource manager. To prevent this problem, the Grouping value should include some randomness. The best practice is to use a randomly generated GUID. However, there is no requirement on the exact value of the node. + Additional information: @@ -156,22 +151,8 @@ Each of the previous nodes contains one or more of the following leaf nodes:

        Policy

        Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy.

        -

        Policy nodes are a Base64-encoded blob of the binary policy representation. The binary policy may be signed or unsigned.

        -

        For CodeIntegrity/Policy, you can use the certutil -encode command line tool to encode the data to base-64.

        -

        Here is a sample certutil invocation:

        - -``` -certutil -encode WinSiPolicy.p7b WinSiPolicy.cer -``` - -

        An alternative to using certutil would be to use the following PowerShell invocation:

        - -``` -[Convert]::ToBase64String($(Get-Content -Encoding Byte -ReadCount 0 -Path )) -``` - -

        If you are using hybrid MDM management with System Center Configuration Manager or using Intune, ensure that you are using Base64 as the Data type when using Custom OMA-URI functionality to apply the Code Integrity policy.

        -

        Data type is string. Supported operations are Get, Add, Delete, and Replace.

        +

        For nodes, other than CodeIntegrity, policy leaf data type is string. Supported operations are Get, Add, Delete, and Replace.

        +

        For CodeIntegrity/Policy, data type is Base64. Supported operations are Get, Add, Delete, and Replace.

        EnforcementMode

        @@ -186,6 +167,8 @@ certutil -encode WinSiPolicy.p7b WinSiPolicy.cer +> [!NOTE] +> To use Code Integrity Policy, you first need to convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet. Then a Base64-encoded blob of the binary policy representation should be created (for example, using the [certutil -encode](https://go.microsoft.com/fwlink/p/?LinkId=724364) command line tool) and added to the Applocker-CSP. ## Find publisher and product name of apps @@ -375,7 +358,8 @@ The product name is first part of the PackageFullName followed by the version nu The following list shows the apps that may be included in the inbox. -> **Note** This list identifies system apps that ship as part of Windows that you can add to your AppLocker policy to ensure proper functioning of the operating system. If you decide to block some of these apps, we recommend a thorough testing before deploying to your production environment. Failure to do so may result in unexpected failures and can significantly degrade the user experience. +> [!NOTE] +> This list identifies system apps that ship as part of Windows that you can add to your AppLocker policy to ensure proper functioning of the operating system. If you decide to block some of these apps, we recommend a thorough testing before deploying to your production environment. Failure to do so may result in unexpected failures and can significantly degrade the user experience. @@ -842,7 +826,7 @@ The following list shows the apps that may be included in the inbox. The following example disables the calendar application. -``` syntax +```xml @@ -866,7 +850,7 @@ The following example disables the calendar application. The following example blocks the usage of the map application. -``` syntax +```xml @@ -1406,7 +1390,7 @@ In this example, **MobileGroup0** is the node name. We recommend using a GUID fo ## Example for Windows 10 Holographic for Business The following example for Windows 10 Holographic for Business denies all apps and allows the minimum set of [inbox apps](#inboxappsandcomponents) to enable to enable a working device, as well as Settings. -``` syntax +```xml 1 diff --git a/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md b/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md index 548ad13c84..706b102207 100644 --- a/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md +++ b/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md @@ -1,7 +1,7 @@ --- title: Azure AD and Microsoft Intune - Automatic MDM enrollment in the new Portal description: Azure AD and Microsoft Intune - Automatic MDM enrollment in the new Portal -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 4cb839cd97..1e81851159 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1,20 +1,17 @@ --- title: BitLocker CSP description: BitLocker CSP -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows author: lomayor -ms.date: 08/11/2019 +ms.date: 08/05/2019 ms.reviewer: manager: dansimp --- # BitLocker CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - The BitLocker configuration service provider (CSP) is used by the enterprise to manage encryption of PCs and devices. This CSP was added in Windows 10, version 1703. Starting in Windows 10, version 1809, it is also supported in Windows 10 Pro. > [!NOTE] @@ -31,10 +28,10 @@ The following diagram shows the BitLocker configuration service provider in tree ![bitlocker csp](images/provisioning-csp-bitlocker.png) **./Device/Vendor/MSFT/BitLocker** -

        Defines the root node for the BitLocker configuration service provider.

        +Defines the root node for the BitLocker configuration service provider. **RequireStorageCardEncryption** -

        Allows the administrator to require storage card encryption on the device. This policy is valid only for a mobile SKU.

        +Allows the administrator to require storage card encryption on the device. This policy is valid only for a mobile SKU. @@ -57,14 +54,14 @@ The following diagram shows the BitLocker configuration service provider in tree
        -

        Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on.

        +Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on. - 0 (default) – Storage cards do not need to be encrypted. - 1 – Require Storage cards to be encrypted. -

        Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on.

        +Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on. -

        If you want to disable this policy use the following SyncML:

        +If you want to disable this policy use the following SyncML: ```xml @@ -85,11 +82,11 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -

        Data type is integer. Supported operations are Add, Get, Replace, and Delete.

        +Data type is integer. Supported operations are Add, Get, Replace, and Delete. **RequireDeviceEncryption** -

        Allows the administrator to require encryption to be turned on by using BitLocker\Device Encryption.

        +Allows the administrator to require encryption to be turned on by using BitLocker\Device Encryption. @@ -112,9 +109,26 @@ The following diagram shows the BitLocker configuration service provider in tree
        -

        Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on.

        +Data type is integer. Sample value for this node to enable this policy: 1. +Supported operations are Add, Get, Replace, and Delete. -

        If you want to disable this policy use the following SyncML:

        +Status of OS volumes and encryptable fixed data volumes are checked with a Get operation. Typically, BitLocker/Device Encryption will follow whichever value [EncryptionMethodByDriveType](#encryptionmethodbydrivetype) policy is set to. However, this policy setting will be ignored for self-encrypting fixed drives and self-encrypting OS drives. + +Encryptable fixed data volumes are treated similarly to OS volumes. However, fixed data volumes must meet additional criteria to be considered encryptable: + +- It must not be a dynamic volume. +- It must not be a recovery partition. +- It must not be a hidden volume. +- It must not be a system partition. +- It must not be backed by virtual storage. +- It must not have a reference in the BCD store. + +The following list shows the supported values: + +- 0 (default) – Disable. If the policy setting is not set or is set to 0, the device's enforcement status will not be checked. The policy will not enforce encryption and it will not decrypt encrypted volumes. +- 1 – Enable. The device's enforcement status will be checked. Setting this policy to 1 will trigger encryption of all drives (silently or non-silently based on [AllowWarningForOtherDiskEncryption](#allowwarningforotherdiskencryption) policy). + +If you want to disable this policy use the following SyncML: ```xml @@ -135,10 +149,9 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -

        Data type is integer. Supported operations are Add, Get, Replace, and Delete.

        +**EncryptionMethodByDriveType** -**EncryptionMethodByDriveType** -

        Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".

        +Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)". @@ -159,7 +172,7 @@ The following diagram shows the BitLocker configuration service provider in tree
        Homecross mark
        -

        ADMX Info:

        +ADMX Info:
        • GP English name: Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)
        • GP name: EncryptionMethodWithXts_Name
          • @@ -170,23 +183,23 @@ The following diagram shows the BitLocker configuration service provider in tree > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

          This setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress.

          +This setting allows you to configure the algorithm and cipher strength used by BitLocker Drive Encryption. This setting is applied when you turn on BitLocker. Changing the encryption method has no effect if the drive is already encrypted, or if encryption is in progress. -

          If you enable this setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10, version 1511.

          +If you enable this setting you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10, version 1511. -

          If you disable or do not configure this policy setting, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by any setup script.

          +If you disable or do not configure this policy setting, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method specified by any setup script. -

          Sample value for this node to enable this policy and set the encryption methods is:

          + Sample value for this node to enable this policy and set the encryption methods is: ```xml ``` -

          EncryptionMethodWithXtsOsDropDown_Name = Select the encryption method for operating system drives

          -

          EncryptionMethodWithXtsFdvDropDown_Name = Select the encryption method for fixed data drives.

          -

          EncryptionMethodWithXtsRdvDropDown_Name = Select the encryption method for removable data drives.

          +EncryptionMethodWithXtsOsDropDown_Name = Select the encryption method for operating system drives +EncryptionMethodWithXtsFdvDropDown_Name = Select the encryption method for fixed data drives. +EncryptionMethodWithXtsRdvDropDown_Name = Select the encryption method for removable data drives. -

          The possible values for 'xx' are:

          + The possible values for 'xx' are: - 3 = AES-CBC 128 - 4 = AES-CBC 256 @@ -196,7 +209,7 @@ The following diagram shows the BitLocker configuration service provider in tree > [!NOTE] > When you enable EncryptionMethodByDriveType, you must specify values for all three drives (operating system, fixed data, and removable data), otherwise it will fail (500 return status). For example, if you only set the encrytion method for the OS and removable drives, you will get a 500 return status. -

          If you want to disable this policy use the following SyncML:

          + If you want to disable this policy use the following SyncML: ```xml @@ -213,10 +226,10 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -

          Data type is string. Supported operations are Add, Get, Replace, and Delete.

          +Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesRequireStartupAuthentication** -

          This setting is a direct mapping to the Bitlocker Group Policy "Require additional authentication at startup".

          +This setting is a direct mapping to the Bitlocker Group Policy "Require additional authentication at startup". @@ -237,7 +250,7 @@ The following diagram shows the BitLocker configuration service provider in tree
          Homecross mark
          -

          ADMX Info:

          +ADMX Info:
          • GP English name: Require additional authentication at startup
          • GP name: ConfigureAdvancedStartup_Name
            • @@ -248,31 +261,31 @@ The following diagram shows the BitLocker configuration service provider in tree > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

            This setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This setting is applied when you turn on BitLocker.

            +This setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). This setting is applied when you turn on BitLocker. > [!NOTE] > Only one of the additional authentication options can be required at startup, otherwise an error occurs. -

            If you want to use BitLocker on a computer without a TPM, set the "ConfigureNonTPMStartupKeyUsage_Name" data. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive.

            +If you want to use BitLocker on a computer without a TPM, set the "ConfigureNonTPMStartupKeyUsage_Name" data. In this mode either a password or a USB drive is required for start-up. When using a startup key, the key information used to encrypt the drive is stored on the USB drive, creating a USB key. When the USB key is inserted the access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable or if you have forgotten the password then you will need to use one of the BitLocker recovery options to access the drive. -

            On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both.

            +On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require insertion of a USB flash drive containing a startup key, the entry of a 6-digit to 20-digit personal identification number (PIN), or both. > [!NOTE] > In Windows 10, version 1703 release B, you can use a minimum PIN of 4 digits. SystemDrivesMinimumPINLength policy must be set to allow PINs shorter than 6 digits. -

            If you enable this policy setting, users can configure advanced startup options in the BitLocker setup wizard.

            +If you enable this policy setting, users can configure advanced startup options in the BitLocker setup wizard. -

            If you disable or do not configure this setting, users can configure only basic options on computers with a TPM.

            +If you disable or do not configure this setting, users can configure only basic options on computers with a TPM. > [!NOTE] > If you want to require the use of a startup PIN and a USB flash drive, you must configure BitLocker settings using the command-line tool manage-bde instead of the BitLocker Drive Encryption setup wizard. -

            Sample value for this node to enable this policy is:

            +Sample value for this node to enable this policy is: ```xml ``` -

            Data id:

            +Data id:
            • ConfigureNonTPMStartupKeyUsage_Name = Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive).
            • ConfigureTPMStartupKeyUsageDropDown_Name = (for computer with TPM) Configure TPM startup key.
              • @@ -281,20 +294,20 @@ The following diagram shows the BitLocker configuration service provider in tree
            • ConfigureTPMUsageDropDown_Name = (for computer with TPM) Configure TPM startup.
            -

            The possible values for 'xx' are:

            +The possible values for 'xx' are:
            • true = Explicitly allow
            • false = Policy not set
            -

            The possible values for 'yy' are:

            +The possible values for 'yy' are:
            • 2 = Optional
            • 1 = Required
            • 0 = Disallowed
            -

            Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:

            +Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml @@ -310,10 +323,10 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -

            Data type is string. Supported operations are Add, Get, Replace, and Delete.

            +Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesMinimumPINLength** -

            This setting is a direct mapping to the Bitlocker Group Policy "Configure minimum PIN length for startup".

            +This setting is a direct mapping to the Bitlocker Group Policy "Configure minimum PIN length for startup". @@ -334,7 +347,7 @@ The following diagram shows the BitLocker configuration service provider in tree
            Homecross mark
            -

            ADMX Info:

            +ADMX Info:
            • GP English name:Configure minimum PIN length for startup
            • GP name: MinimumPINLength_Name
              • @@ -345,24 +358,24 @@ The following diagram shows the BitLocker configuration service provider in tree > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

              This setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits and can have a maximum length of 20 digits.

              +This setting allows you to configure a minimum length for a Trusted Platform Module (TPM) startup PIN. This setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits and can have a maximum length of 20 digits. > [!NOTE] > In Windows 10, version 1703 release B, you can use a minimum PIN length of 4 digits. > >In TPM 2.0 if minimum PIN length is set below 6 digits, Windows will attempt to update the TPM lockout period to be greater than the default when a PIN is changed. If successful, Windows will only reset the TPM lockout period back to default if the TPM is reset. This does not apply to TPM 1.2. -

              If you enable this setting, you can require a minimum number of digits to be used when setting the startup PIN.

              +If you enable this setting, you can require a minimum number of digits to be used when setting the startup PIN. -

              If you disable or do not configure this setting, users can configure a startup PIN of any length between 6 and 20 digits.

              +If you disable or do not configure this setting, users can configure a startup PIN of any length between 6 and 20 digits. -

              Sample value for this node to enable this policy is:

              +Sample value for this node to enable this policy is: ```xml ``` -

              Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:

              +Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml @@ -379,10 +392,10 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -

              Data type is string. Supported operations are Add, Get, Replace, and Delete.

              +Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesRecoveryMessage** -

              This setting is a direct mapping to the Bitlocker Group Policy "Configure pre-boot recovery message and URL" (PrebootRecoveryInfo_Name).

              +This setting is a direct mapping to the Bitlocker Group Policy "Configure pre-boot recovery message and URL" (PrebootRecoveryInfo_Name). @@ -403,7 +416,7 @@ The following diagram shows the BitLocker configuration service provider in tree
              Homecross mark
              -

              ADMX Info:

              +ADMX Info:
              • GP English name: Configure pre-boot recovery message and URL
              • GP name: PrebootRecoveryInfo_Name
                • @@ -414,21 +427,21 @@ The following diagram shows the BitLocker configuration service provider in tree > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

                This setting lets you configure the entire recovery message or replace the existing URL that are displayed on the pre-boot key recovery screen when the OS drive is locked. -

                +This setting lets you configure the entire recovery message or replace the existing URL that are displayed on the pre-boot key recovery screen when the OS drive is locked. -

                If you set the value to "1" (Use default recovery message and URL), the default BitLocker recovery message and URL will be displayed in the pre-boot key recovery screen. If you have previously configured a custom recovery message or URL and want to revert to the default message, you must keep the policy enabled and set the value "1" (Use default recovery message and URL). -

                If you set the value to "2" (Use custom recovery message), the message you set in the "RecoveryMessage_Input" data field will be displayed in the pre-boot key recovery screen. If a recovery URL is available, include it in the message.

                +If you set the value to "1" (Use default recovery message and URL), the default BitLocker recovery message and URL will be displayed in the pre-boot key recovery screen. If you have previously configured a custom recovery message or URL and want to revert to the default message, you must keep the policy enabled and set the value "1" (Use default recovery message and URL). -

                If you set the value to "3" (Use custom recovery URL), the URL you type in the "RecoveryUrl_Input" data field will replace the default URL in the default recovery message, which will be displayed in the pre-boot key recovery screen.

                +If you set the value to "2" (Use custom recovery message), the message you set in the "RecoveryMessage_Input" data field will be displayed in the pre-boot key recovery screen. If a recovery URL is available, include it in the message. -

                Sample value for this node to enable this policy is:

                +If you set the value to "3" (Use custom recovery URL), the URL you type in the "RecoveryUrl_Input" data field will replace the default URL in the default recovery message, which will be displayed in the pre-boot key recovery screen. + +Sample value for this node to enable this policy is: ```xml ``` -

                The possible values for 'xx' are:

                +The possible values for 'xx' are: - 0 = Empty - 1 = Use default recovery message and URL (in this case you don't need to specify a value for "RecoveryMessage_Input" or "RecoveryUrl_Input"). @@ -440,7 +453,7 @@ The following diagram shows the BitLocker configuration service provider in tree > [!NOTE] > When you enable SystemDrivesRecoveryMessage, you must specify values for all three settings (pre-boot recovery screen, recovery message, and recovery URL), otherwise it will fail (500 return status). For example, if you only specify values for message and URL, you will get a 500 return status. -

                Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:

                +Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml @@ -460,10 +473,10 @@ The following diagram shows the BitLocker configuration service provider in tree > [!NOTE] > Not all characters and languages are supported in pre-boot. It is strongly recommended that you test that the characters you use for the custom message or URL appear correctly on the pre-boot recovery screen. -

                Data type is string. Supported operations are Add, Get, Replace, and Delete.

                +Data type is string. Supported operations are Add, Get, Replace, and Delete. **SystemDrivesRecoveryOptions** -

                This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name).

                +This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected operating system drives can be recovered" (OSRecoveryUsage_Name). @@ -484,7 +497,7 @@ The following diagram shows the BitLocker configuration service provider in tree
                Homecross mark
                -

                ADMX Info:

                +ADMX Info:
                • GP English name: Choose how BitLocker-protected operating system drives can be recovered
                • GP name: OSRecoveryUsage_Name
                  • @@ -495,52 +508,52 @@ The following diagram shows the BitLocker configuration service provider in tree > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

                  This setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This setting is applied when you turn on BitLocker.

                  +This setting allows you to control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information. This setting is applied when you turn on BitLocker. -

                  The "OSAllowDRA_Name" (Allow certificate-based data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents.

                  +The "OSAllowDRA_Name" (Allow certificate-based data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected operating system drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. -

                  In "OSRecoveryPasswordUsageDropDown_Name" and "OSRecoveryKeyUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.

                  +In "OSRecoveryPasswordUsageDropDown_Name" and "OSRecoveryKeyUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. -

                  Set "OSHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting.

                  +Set "OSHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. -

                  Set "OSActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services), to choose which BitLocker recovery information to store in AD DS for operating system drives (OSActiveDirectoryBackupDropDown_Name). If you set "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you set "2" (Backup recovery password only), only the recovery password is stored in AD DS.

                  +Set "OSActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services), to choose which BitLocker recovery information to store in AD DS for operating system drives (OSActiveDirectoryBackupDropDown_Name). If you set "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you set "2" (Backup recovery password only), only the recovery password is stored in AD DS. -

                  Set the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.

                  +Set the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. > [!Note]
                  > If the "OSRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for operating system drives) data field is set, a recovery password is automatically generated. -

                  If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives.

                  +If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected operating system drives. -

                  If this setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.

                  +If this setting is disabled or not configured, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS. -

                  Sample value for this node to enable this policy is:

                  +Sample value for this node to enable this policy is: ```xml ``` -

                  The possible values for 'xx' are:

                  +The possible values for 'xx' are:
                  • true = Explicitly allow
                  • false = Policy not set
                  -

                  The possible values for 'yy' are:

                  +The possible values for 'yy' are:
                  • 2 = Allowed
                  • 1 = Required
                  • 0 = Disallowed
                  -

                  The possible values for 'zz' are:

                  +The possible values for 'zz' are:
                  • 2 = Store recovery passwords only
                  • 1 = Store recovery passwords and key packages
                  -

                  Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:

                  +Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml @@ -557,10 +570,10 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -

                  Data type is string. Supported operations are Add, Get, Replace, and Delete.

                  +Data type is string. Supported operations are Add, Get, Replace, and Delete. **FixedDrivesRecoveryOptions** -

                  This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" ().

                  +This setting is a direct mapping to the Bitlocker Group Policy "Choose how BitLocker-protected fixed drives can be recovered" (). @@ -581,7 +594,7 @@ The following diagram shows the BitLocker configuration service provider in tree
                  Homecross mark
                  -

                  ADMX Info:

                  +ADMX Info:
                  • GP English name: Choose how BitLocker-protected fixed drives can be recovered
                  • GP name: FDVRecoveryUsage_Name
                    • @@ -592,39 +605,39 @@ The following diagram shows the BitLocker configuration service provider in tree > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

                    This setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This setting is applied when you turn on BitLocker.

                    +This setting allows you to control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials. This setting is applied when you turn on BitLocker. -

                    The "FDVAllowDRA_Name" (Allow data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents.

                    +The "FDVAllowDRA_Name" (Allow data recovery agent) data field is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used it must be added from the Public Key Policies item in either the Group Policy Management Console or the Local Group Policy Editor. Consult the BitLocker Drive Encryption Deployment Guide on Microsoft TechNet for more information about adding data recovery agents. -

                    In "FDVRecoveryPasswordUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key.

                    +In "FDVRecoveryPasswordUsageDropDown_Name" (Configure user storage of BitLocker recovery information) set whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. -

                    Set "FDVHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting.

                    +Set "FDVHideRecoveryPage_Name" (Omit recovery options from the BitLocker setup wizard) to prevent users from specifying recovery options when they turn on BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you turn on BitLocker, instead BitLocker recovery options for the drive are determined by the policy setting. -

                    Set "FDVActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services) to enable saving the recovery key to AD.

                    +Set "FDVActiveDirectoryBackup_Name" (Save BitLocker recovery information to Active Directory Domain Services) to enable saving the recovery key to AD. -

                    Set the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds.

                    +Set the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. -

                    Set the "FDVActiveDirectoryBackupDropDown_Name" (Configure storage of BitLocker recovery information to AD DS) to choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "2" (Backup recovery password only) only the recovery password is stored in AD DS.

                    +Set the "FDVActiveDirectoryBackupDropDown_Name" (Configure storage of BitLocker recovery information to AD DS) to choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select "1" (Backup recovery password and key package), both the BitLocker recovery password and key package are stored in AD DS. Storing the key package supports recovering data from a drive that has been physically corrupted. If you select "2" (Backup recovery password only) only the recovery password is stored in AD DS. > [!Note]
                    > If the "FDVRequireActiveDirectoryBackup_Name" (Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives) data field is set, a recovery password is automatically generated. -

                    If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives.

                    +If you enable this setting, you can control the methods available to users to recover data from BitLocker-protected fixed data drives. -

                    If this setting is not configured or disabled, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS.

                    +If this setting is not configured or disabled, the default recovery options are supported for BitLocker recovery. By default a DRA is allowed, the recovery options can be specified by the user including the recovery password and recovery key, and recovery information is not backed up to AD DS. -

                    Sample value for this node to enable this policy is:

                    +Sample value for this node to enable this policy is: ```xml ``` -

                    The possible values for 'xx' are:

                    +The possible values for 'xx' are:
                    • true = Explicitly allow
                    • false = Policy not set
                    -

                    The possible values for 'yy' are:

                    +The possible values for 'yy' are:
                    • 2 = Allowed
                    • 1 = Required
                      • @@ -632,13 +645,13 @@ The following diagram shows the BitLocker configuration service provider in tree
                    -

                    The possible values for 'zz' are:

                    +The possible values for 'zz' are:
                    • 2 = Store recovery passwords only
                    • 1 = Store recovery passwords and key packages
                    -

                    Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:

                    +Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml @@ -655,10 +668,10 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -

                    Data type is string. Supported operations are Add, Get, Replace, and Delete.

                    +Data type is string. Supported operations are Add, Get, Replace, and Delete. **FixedDrivesRequireEncryption** -

                    This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name).

                    +This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to fixed drives not protected by BitLocker" (FDVDenyWriteAccess_Name). @@ -679,7 +692,7 @@ The following diagram shows the BitLocker configuration service provider in tree
                    Homecross mark
                    -

                    ADMX Info:

                    +ADMX Info:
                    • GP English name: Deny write access to fixed drives not protected by BitLocker
                    • GP name: FDVDenyWriteAccess_Name
                      • @@ -690,17 +703,17 @@ The following diagram shows the BitLocker configuration service provider in tree > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

                      This setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer.

                      +This setting determines whether BitLocker protection is required for fixed data drives to be writable on a computer. -

                      If you enable this setting, all fixed data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.

                      +If you enable this setting, all fixed data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. -

                      Sample value for this node to enable this policy is:

                      +Sample value for this node to enable this policy is: ```xml ``` -

                      If you disable or do not configure this setting, all fixed data drives on the computer will be mounted with read and write access. If you want to disable this policy use the following SyncML:

                      +If you disable or do not configure this setting, all fixed data drives on the computer will be mounted with read and write access. If you want to disable this policy use the following SyncML: ```xml @@ -717,10 +730,10 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -

                      Data type is string. Supported operations are Add, Get, Replace, and Delete.

                      +Data type is string. Supported operations are Add, Get, Replace, and Delete. **RemovableDrivesRequireEncryption** -

                      This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name).

                      +This setting is a direct mapping to the Bitlocker Group Policy "Deny write access to removable drives not protected by BitLocker" (RDVDenyWriteAccess_Name). @@ -741,7 +754,7 @@ The following diagram shows the BitLocker configuration service provider in tree
                      Homecross mark
                      -

                      ADMX Info:

                      +ADMX Info:
                      • GP English name: Deny write access to removable drives not protected by BitLocker
                      • GP name: RDVDenyWriteAccess_Name
                        • @@ -752,29 +765,29 @@ The following diagram shows the BitLocker configuration service provider in tree > [!TIP] > For a step-by-step guide to enable ADMX-backed policies, see [Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md). For additional information, see [Understanding ADMX-backed policies](understanding-admx-backed-policies.md). -

                        This setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive.

                        +This setting configures whether BitLocker protection is required for a computer to be able to write data to a removable data drive. -

                        If you enable this setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.

                        +If you enable this setting, all removable data drives that are not BitLocker-protected will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access. -

                        If the "RDVCrossOrg" (Deny write access to devices configured in another organization) option is set, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" group policy setting.

                        +If the "RDVCrossOrg" (Deny write access to devices configured in another organization) option is set, only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the "Provide the unique identifiers for your organization" group policy setting. -

                        If you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access.

                        +If you disable or do not configure this policy setting, all removable data drives on the computer will be mounted with read and write access. > [!Note]
                        > This policy setting can be overridden by the group policy settings under User Configuration\Administrative Templates\System\Removable Storage Access. If the "Removable Disks: Deny write access" group policy setting is enabled this policy setting will be ignored. -

                        Sample value for this node to enable this policy is:

                        +Sample value for this node to enable this policy is: ```xml ``` -

                        The possible values for 'xx' are:

                        +The possible values for 'xx' are:
                        • true = Explicitly allow
                        • false = Policy not set
                        -

                        Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML:

                        +Disabling the policy will let the system choose the default behaviors. If you want to disable this policy use the following SyncML: ```xml @@ -793,7 +806,7 @@ The following diagram shows the BitLocker configuration service provider in tree **AllowWarningForOtherDiskEncryption** -

                        Allows the admin to disable the warning prompt for other disk encryption on the user machines that are targeted when the RequireDeviceEncryption policy is also set to 1.

                        +Allows the admin to disable the warning prompt for other disk encryption on the user machines that are targeted when the RequireDeviceEncryption policy is also set to 1. > [!IMPORTANT] > Starting in Windows 10, version 1803, the value 0 can only be set for Azure Active Directory joined devices. When RequireDeviceEncryption is set to 1 and AllowWarningForOtherDiskEncryption is set to 0, Windows will attempt to silently enable [BitLocker](https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-overview). @@ -822,7 +835,7 @@ The following diagram shows the BitLocker configuration service provider in tree -

                        The following list shows the supported values:

                        +The following list shows the supported values: - 0 – Disables the warning prompt. Starting in Windows 10, version 1803, the value 0 can only be set for Azure Active Directory joined devices. Windows will attempt to silently enable BitLocker for value 0. - 1 (default) – Warning prompt allowed. diff --git a/windows/client-management/mdm/bitlocker-ddf-file.md b/windows/client-management/mdm/bitlocker-ddf-file.md index bb69c429fb..1fed0144fa 100644 --- a/windows/client-management/mdm/bitlocker-ddf-file.md +++ b/windows/client-management/mdm/bitlocker-ddf-file.md @@ -1,7 +1,7 @@ --- title: BitLocker DDF file description: BitLocker DDF file -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/bootstrap-csp.md b/windows/client-management/mdm/bootstrap-csp.md index 509638a1e4..1f88d3ae9f 100644 --- a/windows/client-management/mdm/bootstrap-csp.md +++ b/windows/client-management/mdm/bootstrap-csp.md @@ -4,7 +4,7 @@ description: BOOTSTRAP CSP ms.assetid: b8acbddc-347f-4543-a45b-ad2ffae3ffd0 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/browserfavorite-csp.md b/windows/client-management/mdm/browserfavorite-csp.md index 1d59d8ade7..9e1c5633df 100644 --- a/windows/client-management/mdm/browserfavorite-csp.md +++ b/windows/client-management/mdm/browserfavorite-csp.md @@ -4,7 +4,7 @@ description: BrowserFavorite CSP ms.assetid: 5d2351ff-2d6a-4273-9b09-224623723cbf ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/bulk-assign-and-reclaim-seats-from-user.md b/windows/client-management/mdm/bulk-assign-and-reclaim-seats-from-user.md index 9e077af341..d5a9dfc966 100644 --- a/windows/client-management/mdm/bulk-assign-and-reclaim-seats-from-user.md +++ b/windows/client-management/mdm/bulk-assign-and-reclaim-seats-from-user.md @@ -4,7 +4,7 @@ description: The Bulk assign and reclaim seats from users operation returns recl ms.assetid: 99E2F37D-1FF3-4511-8969-19571656780A ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md index 955a7207d1..d17799b5a8 100644 --- a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md @@ -1,13 +1,13 @@ --- title: Bulk enrollment description: Bulk enrollment is an efficient way to set up a large number of devices to be managed by an MDM server without the need to re-image the devices. In Windows 10. -MS-HAID: -- 'p\_phdevicemgmt.bulk\_enrollment' -- 'p\_phDeviceMgmt.bulk\_enrollment\_using\_Windows\_provisioning\_tool' +MS-HAID: + - 'p\_phdevicemgmt.bulk\_enrollment' + - 'p\_phDeviceMgmt.bulk\_enrollment\_using\_Windows\_provisioning\_tool' ms.assetid: DEB98FF3-CC5C-47A1-9277-9EF939716C87 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/cellularsettings-csp.md b/windows/client-management/mdm/cellularsettings-csp.md index d982a50e25..edb5e3bdfa 100644 --- a/windows/client-management/mdm/cellularsettings-csp.md +++ b/windows/client-management/mdm/cellularsettings-csp.md @@ -4,7 +4,7 @@ description: CellularSettings CSP ms.assetid: ce8b6f16-37ca-4aaf-98b0-306d12e326df ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/certificate-authentication-device-enrollment.md b/windows/client-management/mdm/certificate-authentication-device-enrollment.md index 3e90f99dc8..042efca28b 100644 --- a/windows/client-management/mdm/certificate-authentication-device-enrollment.md +++ b/windows/client-management/mdm/certificate-authentication-device-enrollment.md @@ -4,7 +4,7 @@ description: This section provides an example of the mobile device enrollment pr ms.assetid: 57DB3C9E-E4C9-4275-AAB5-01315F9D3910 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/certificate-renewal-windows-mdm.md b/windows/client-management/mdm/certificate-renewal-windows-mdm.md index 162fbea922..26580c5095 100644 --- a/windows/client-management/mdm/certificate-renewal-windows-mdm.md +++ b/windows/client-management/mdm/certificate-renewal-windows-mdm.md @@ -1,13 +1,13 @@ --- title: Certificate Renewal description: The enrolled client certificate expires after a period of use. -MS-HAID: -- 'p\_phdevicemgmt.certificate\_renewal' -- 'p\_phDeviceMgmt.certificate\_renewal\_windows\_mdm' +MS-HAID: + - 'p\_phdevicemgmt.certificate\_renewal' + - 'p\_phDeviceMgmt.certificate\_renewal\_windows\_mdm' ms.assetid: F910C50C-FF67-40B0-AAB0-CA7CE02A9619 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/certificatestore-csp.md b/windows/client-management/mdm/certificatestore-csp.md index 276c00951a..aab7f8755b 100644 --- a/windows/client-management/mdm/certificatestore-csp.md +++ b/windows/client-management/mdm/certificatestore-csp.md @@ -4,7 +4,7 @@ description: CertificateStore CSP ms.assetid: 0fe28629-3cc3-42a0-91b3-3624c8462fd3 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/certificatestore-ddf-file.md b/windows/client-management/mdm/certificatestore-ddf-file.md index 248e475b20..ae68a73283 100644 --- a/windows/client-management/mdm/certificatestore-ddf-file.md +++ b/windows/client-management/mdm/certificatestore-ddf-file.md @@ -4,7 +4,7 @@ description: This topic shows the OMA DM device description framework (DDF) for ms.assetid: D9A12D4E-3122-45C3-AD12-CC4FFAEC08B8 ms.reviewer: manager: dansimp -ms.author: lomayor +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/clientcertificateinstall-csp.md b/windows/client-management/mdm/clientcertificateinstall-csp.md index 5664409319..41612181c5 100644 --- a/windows/client-management/mdm/clientcertificateinstall-csp.md +++ b/windows/client-management/mdm/clientcertificateinstall-csp.md @@ -372,7 +372,7 @@ Data type is string. Enroll a client certificate through SCEP. -``` syntax +```xml @@ -571,7 +571,7 @@ Enroll a client certificate through SCEP. Add a PFX certificate. The PFX certificate password is encrypted with a custom certificate fro "My" store. -``` syntax +```xml diff --git a/windows/client-management/mdm/cm-proxyentries-csp.md b/windows/client-management/mdm/cm-proxyentries-csp.md index 432b10a418..301c28ea8e 100644 --- a/windows/client-management/mdm/cm-proxyentries-csp.md +++ b/windows/client-management/mdm/cm-proxyentries-csp.md @@ -90,7 +90,7 @@ Specifies the username used to connect to the proxy. To delete both a proxy and its associated connection, you must delete the proxy first, and then delete the connection. The following example shows how to delete the proxy and then the connection. -``` syntax +```xml diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 2579fa4d39..744a4be799 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -215,7 +215,7 @@ Supported product status values: Example: -``` syntax +```xml @@ -224,7 +224,7 @@ Example: ./Vendor/MSFT/Defender/Health/ProductStatus - + diff --git a/windows/client-management/mdm/devicestatus-csp.md b/windows/client-management/mdm/devicestatus-csp.md index 8d704d0165..2191e66e9c 100644 --- a/windows/client-management/mdm/devicestatus-csp.md +++ b/windows/client-management/mdm/devicestatus-csp.md @@ -277,23 +277,23 @@ Supported operation is Get. **DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq** Added in Windows, version 1709. Virtualization-based security hardware requirement status. The value is a 256 value bitmask. -- 0x0: System meets hardware configuration requirements -- 0x1: SecureBoot required -- 0x2: DMA Protection required -- 0x4: HyperV not supported for Guest VM -- 0x8: HyperV feature is not available +- 0x0: System meets hardware configuration requirements +- 0x1: SecureBoot required +- 0x2: DMA Protection required +- 0x4: HyperV not supported for Guest VM +- 0x8: HyperV feature is not available Supported operation is Get. **DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus** Added in Windows, version 1709. Virtualization-based security status. Value is one of the following: -- 0 - Running -- 1 - Reboot required -- 2 - 64 bit architecture required -- 3 - not licensed -- 4 - not configured -- 5 - System doesn't meet hardware requirements -- 42 – Other. Event logs in Microsoft-Windows-DeviceGuard have more details +- 0 - Running +- 1 - Reboot required +- 2 - 64 bit architecture required +- 3 - not licensed +- 4 - not configured +- 5 - System doesn't meet hardware requirements +- 42 – Other. Event logs in Microsoft-Windows-DeviceGuard have more details Supported operation is Get. @@ -301,11 +301,11 @@ Supported operation is Get. **DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus** Added in Windows, version 1709. Local System Authority (LSA) credential guard status. -- 0 - Running -- 1 - Reboot required -- 2 - Not licensed for Credential Guard -- 3 - Not configured -- 4 - VBS not running +- 0 - Running +- 1 - Reboot required +- 2 - Not licensed for Credential Guard +- 3 - Not configured +- 4 - VBS not running Supported operation is Get. diff --git a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md index 31cb8df991..5c2dcefdc4 100644 --- a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md +++ b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md @@ -73,7 +73,7 @@ When the PC is already enrolled in MDM, you can remotely collect logs from the P Example: Enable the Debug channel logging -``` syntax +```xml @@ -114,7 +114,7 @@ Example: Export the Debug logs ## Collect logs from Windows 10 Mobile devices -Since there is no Event Viewer in Windows 10 Mobile, you can use the [Field Medic](https://www.microsoft.com/en-us/p/field-medic/9wzdncrfjb82?activetab=pivot%3aoverviewtab) app to collect logs. +Since there is no Event Viewer in Windows 10 Mobile, you can use the [Field Medic](https://www.microsoft.com/p/field-medic/9wzdncrfjb82?activetab=pivot%3aoverviewtab) app to collect logs. **To collect logs manually** diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index 44c558fde0..6b3a628eb7 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -9,18 +9,22 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 06/26/2017 +ms.date: 08/05/2019 --- # DiagnosticLog CSP +The DiagnosticLog configuration service provider (CSP) is used in the following scenarios: +- [Controlling ETW trace sessions](#diagnosticlog-csp-for-controlling-etw-trace-sessions) +- [Triggering devices to upload existing event logs, log files, and registry values to cloud storage](#diagnosticlog-csp-for-triggering-devices-to-upload-files-to-cloud) -The DiagnosticLog configuration service provider (CSP) is used for generating and collecting diagnostic information from the device: Event Tracing for Windows (ETW) log files and current MDM configured state of the device. +## DiagnosticLog CSP for controlling ETW trace sessions +The DiagnosticLog CSP is used for generating and collecting diagnostic information from the device: Event Tracing for Windows (ETW) log files and current MDM configured state of the device. DiagnosticLog CSP supports the following type of event tracing: -- Collector-based tracing -- Channel-based tracing +- Collector-based tracing +- Channel-based tracing ### Collector-based tracing @@ -49,11 +53,10 @@ For each registered provider in this collector, the user can: The changes on **State**, **Keywords** and **TraceLevel** takes effect immediately while trace session is in progress. -> **Note**  Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. +> [!Note] +> Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. - - -### Channel-based tracing + ### Channel-based tracing The type of event tracing exports event data from a specific channel. This is only supported on the desktop. @@ -73,36 +76,31 @@ Here are the links to the DDFs: - [DiagnosticLog CSP version 1.2](diagnosticlog-ddf.md#version-1-2) - [DiagnosticLog CSP version 1.3](diagnosticlog-ddf.md#version-1-3) +- [DiagnosticLog CSP version 1.4](diagnosticlog-ddf.md#version-1-4) -The following diagram shows the DiagnosticLog configuration service provider in tree format. +The following diagram shows the DiagnosticLog CSP in tree format. ![diagnosticlog csp diagram](images/provisioning-csp-diagnosticlog.png) **./Vendor/MSFT/DiagnosticLog** -The root node for the DiagnosticLog configuration service provider. +The root node for the DiagnosticLog CSP. -The following steps describe the process for gathering diagnostics using this CSP. +To gather diagnostics using this CSP: 1. Specify a *CollectorName* for the container of the target ETW providers. 2. (Optional) Set logging and log file parameters using the following options: - - **TraceLogFileMode** - - **LogFileSizeLimitMB** - - Each of these are described later in this topic. + - TraceLogFileMode + - LogFileSizeLimitMB 3. Indicate one or more target ETW providers by supplying its *ProviderGUID* to the Add operation of EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*. 4. (Optional) Set logging and log file parameters using the following options: - - - **TraceLevel** - - **Keywords** - - Each of these are described later in this topic. - -5. Start logging using **TraceControl** EXECUTE command “START” + - TraceLevel + - Keywords +5. Start logging using **TraceControl** EXECUTE command “START”. 6. Perform actions on the target device that will generate activity in the log files. -7. Stop logging using **TraceControl** EXECUTE command “STOP” -8. Collect the log file located in the `%temp%` folder using the method described in [Reading a log file](#reading-a-log-file) +7. Stop logging using **TraceControl** EXECUTE command “STOP”. +8. Collect the log file located in the `%temp%` folder using the method described in [Reading a log file](#reading-a-log-file). **EtwLog** Node to contain the Error Tracing for Windows log. @@ -174,8 +172,6 @@ The following table represents the possible values: | 0 | Stopped | | 1 | Started | - - **EtwLog/Collectors/*CollectorName*/TraceLogFileMode** Specifies the log file logging mode. @@ -185,30 +181,10 @@ Supported operations are Get and Replace. The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - -
                        ValueDescription

                        EVENT_TRACE_FILE_MODE_SEQUENTIAL (0x00000001)

                        Writes events to a log file sequentially; stops when the file reaches its maximum size.

                        EVENT_TRACE_FILE_MODE_CIRCULAR (0x00000002)

                        Writes events to a log file. After the file reaches the maximum size, the oldest events are replaced with incoming events.

                        - - +| Value | Description | +|-------|--------------------| +| EVENT_TRACE_FILE_MODE_SEQUENTIAL (0x00000001) | Writes events to a log file sequentially; stops when the file reaches its maximum size. | +| EVENT_TRACE_FILE_MODE_CIRCULAR (0x00000002) | Writes events to a log file. After the file reaches the maximum size, the oldest events are replaced with incoming events. | **EtwLog/Collectors/*CollectorName*/TraceControl** Specifies the logging and report action state. @@ -222,8 +198,6 @@ The following table lists the possible values: | START | Start log tracing. | | STOP | Stop log tracing | - - The supported operation is Execute. After you have added a logging task, you can start a trace by running an Execute command on this node with the value START. @@ -295,8 +269,6 @@ Dynamic nodes to represent active provider configuration per provider GUID. > **Note**  Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. - - Supported operations are Add, Delete, and Get. Add a provider @@ -347,44 +319,15 @@ The data type is an integer. Supported operations are Get and Replace. -The following table lists the possible values. +The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        ValueDescription

                        1 – TRACE_LEVEL_CRITICAL

                        Abnormal exit or termination events

                        2 – TRACE_LEVEL_ERROR

                        Severe error events

                        3 – TRACE_LEVEL_WARNING

                        Warning events such as allocation failures

                        4 – TRACE_LEVEL_INFORMATION

                        Non-error events, such as entry or exit events

                        5 – TRACE_LEVEL_VERBOSE

                        Detailed information

                        - - +| Value | Description | +|-------|--------------------| +| 1 – TRACE_LEVEL_CRITICAL | Abnormal exit or termination events | +| 2 – TRACE_LEVEL_ERROR | Severe error events | +| 3 – TRACE_LEVEL_WARNING | Warning events such as allocation failures | +| 4 – TRACE_LEVEL_INFORMATION | Non-error events, such as entry or exit events | +| 5 – TRACE_LEVEL_VERBOSE | Detailed information | Set provider **TraceLevel** @@ -412,7 +355,7 @@ Set provider **TraceLevel** **EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*/Keywords** Specifies the provider keywords to be used as MatchAnyKeyword for this provider. -the data type is a string. +The data type is a string. Supported operations are Get and Replace. @@ -470,32 +413,11 @@ The data type is a boolean. Supported operations are Get and Replace. This change will be effective during active trace session. -The following table lists the possible values. Default value is TRUE. - - ---- - - - - - - - - - - - - - - - - -
                        ValueDescription

                        TRUE

                        Provider is enabled in the trace session.

                        FALSE

                        Provider is disables in the trace session.

                        - - +The following table lists the possible values: +| Value | Description | +|-------|--------------------| +| TRUE | Provider is enabled in the trace session. This is the default. | +| FALSE | Provider is disabled in the trace session. | Set provider **State** @@ -630,32 +552,12 @@ The data type is a boolean. Supported operations are Get and Replace. -The following table lists the possible values. +The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - -
                        ValueDescription

                        TRUE

                        Channel is enabled.

                        FALSE

                        Channel is disabled.

                        - - +| Value | Description | +|-------|--------------------| +| TRUE | Channel is enabled. | +| FALSE | Channel is disabled. | Get channel **State** @@ -897,26 +799,585 @@ Node to transfer the selected log file block to the DM server. **FileDownload/DMChannel/*FileContext*/DataBlocks/***BlockNumber* The data type is Base64. -The only supported operation is Get. +The supported operation is Get. + +**Policy** +Added in version 1.4 of the CSP in Windows 10, version 1903. Root node to control settings for channels in Event Log. + +The supported operation is Get. + +**Policy/Channels** +Added in version 1.4 of the CSP in Windows 10, version 1903. Node that contains Event Log channel settings. + +The supported operation is Get. + +**Policy/Channels/_ChannelName_** +Added in version 1.4 of the CSP in Windows 10, version 1903. Dynamic node to represent a registered channel. The node name must be a valid Windows event log channel name, such as ``Microsoft-Client-Licensing-Platform%2FAdmin``. When specifying the name in the LocURI, it must be URL encoded, otherwise it may unexpectedly translate into a different URI. + +Supported operations are Add, Delete, and Get. + +Add **Channel** +``` xml + + ​ + ​ + 2​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName​ + ​ + ​ + ​ + node​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +Delete **Channel** +``` xml + + ​ + ​ + 3​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +Get **Channel** +``` xml + + ​ + ​ + 4​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +**Policy/Channels/_ChannelName_/MaximumFileSize** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting specifies the maximum size of the log file in megabytes. + +If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte and 2 terabytes in megabyte increments. + +If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is integer. + +Add **MaximumFileSize** +``` xml + + ​ + ​ + 6​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + int​ + text/plain​ + ​ + 3​ + ​ + ​ + ​ + ​ + +``` + +Delete **MaximumFileSize** +``` xml + + ​ + ​ + 7​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +Get **MaximumFileSize** +``` xml + + ​ + ​ + 5​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **MaximumFileSize** +``` xml + + ​ + ​ + 8​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + int​ + text/plain​ + ​ + 5​ + ​ + ​ + ​ + ​ + +``` + +**Policy/Channels/_ChannelName_/SDDL** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting represents SDDL string controlling access to the channel. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is string. + +Default string is as follows: + +https://docs.microsoft.com/en-us/windows/desktop/WES/eventmanifestschema-channeltype-complextype. + +Add **SDDL** +``` xml + + ​ + ​ + 10​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + YourSDDL​ + ​ + ​ + ​ + ​ + +``` + +Delete **SDDL** +``` xml + + + ​ + ​ + 11​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Get **SDDL** +``` xml + + ​ + ​ + 9​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **SDDL** +``` xml + + ​ + ​ + 12​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + YourNewSDDL​ + ​ + ​ + ​ + ​ + +``` + +**Policy/Channels/_ChannelName_/ActionWhenFull** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting controls Event Log behavior when the log file reaches its maximum size. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is string. + +The following are the possible values: +- Truncate — When the log file reaches its maximum file size, new events are not written to the log and are lost. +- Overwrite — When the log file reaches its maximum file size, new events overwrite old events. +- Archive — When the log file reaches its maximum size, the log file is saved to the location specified by the "Archive Location" policy setting. If archive location value is not set, the new file is saved in the same directory as current log file. + +If you disable or do not configure this policy setting, the locally configured value will be used as default. Every channel that is installed, whether inbox or by ISVs, is responsible for defining its own local configuration, and that configuration can be changed by any administrator. Values set via this policy override but do not replace local configuration. + + +Add **ActionWhenFull** +``` xml + + ​ + ​ + 14​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + Archive​ + ​ + ​ + ​ + ​ + +``` + +Delete **ActionWhenFull** +``` xml + + ​ + ​ + 15​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Get **ActionWhenFull** +``` xml + + ​ + ​ + 13​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **ActionWhenFull** +``` xml + + ​ + ​ + 16​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + Truncate​ + ​ + ​ + ​ + ​ + +``` + +**Policy/Channels/_ChannelName_/Enabled** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting specifies whether the channel should be enabled or disabled. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is boolean. + +The following are the possible values: +- TRUE — Enables the channel. +- FALSE — Disables the channel. + +If you disable or do not configure this policy setting, the locally configured value is used as default. + +Get **Enabled** +``` xml + + ​ + ​ + 17​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Add **Enabled** +``` xml + + ​ + ​ + 18​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + bool​ + text/plain​ + ​ + TRUE​ + ​ + ​ + ​ + ​ + +``` + +Delete **Enabled** +``` xml + + ​ + ​ + 19​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **Enabled** +``` xml + + ​ + ​ + 20​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + bool​ + text/plain​ + ​ + FALSE​ + ​ + ​ + ​ + ​ + +``` + +## DiagnosticLog CSP for triggering devices to upload files to cloud +The DiagnosticLog CSP is used for triggering devices to upload existing event logs, log files, and registry values to cloud storage. The following section describes the nodes for the DiagnosticArchive functionality. + +**DiagnosticArchive** +Added in version 1.4 of the CSP in Windows 10, version 1903. Root note for the DiagnosticArchive functionality. + +The supported operation is Get. + +**DiagnosticArchive/ArchiveDefinition** +Added in version 1.4 of the CSP in Windows 10, version 1903. + +The supported operations are Add and Execute. + +The data type is string. + +Expected value: +Set and Execute are functionality equivalent, and each accepts an XML snippet (as a string) describing what data to gather and where to upload it when done. This XML defines what should be collected and compressed into a zip file to be uploaded to Azure blog storage. + +The following is an example of the XML. This example instructs that a zip file be created containing the output from a dump of the specified registry key, all the files in a folder, the output of two commands, all the files in another folder, the output of a command, all the Application events, two sets of files, and another command output. All of this will be uploaded to the blob storage URL as specified in the tags and must be in the noted format with the container and the key in the URL. The administrator can retrieve this URL from Azure. The file uploaded will be in the format DiagLogs-{ComputerName}-YYYYMMDDTHHMMSSZ.zip. + +``` xml + + f1e20cb4-9789-4f6b-8f6a-766989764c6d + {web address}/{container}{key} + HKLM\Software\Policies + C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\*.etl + %windir%\system32\ipconfig.exe /all + %windir%\system32\mdmdiagnosticstool.exe -out c:\ProgramData\temp\ + c:\ProgramData\temp\*.* + %windir%\system32\ping.exe -n 50 localhost + Application + %ProgramData%\Microsoft\DiagnosticLogCSP\Collectors\*.etl + %SystemRoot%\System32\LogFiles\wmi\*.etl.* + + %windir%\system32\pnputil.exe /enum-drivers + + +``` +Where: + +- ID is a unique GUID value that defines this particular run of the DiagnosticLog CSP. +- There can be multiple RegistryKey, FolderFiles, Command, and Events elements, which extract or execute and collect the output from the action specified. +- SasUrl is generated from the Azure Blob Storage UX in Azure such that it will allow write access to the blob to upload the zip file created by all the actions specified. + +**DiagnosticArchive/ArchiveResults** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting displays the results of the last archive run. + +The supported operation is Get. + +The data type is string. + +A Get to the above URI will return the results of the gathering of data for the last diagnostics request. For the example above it returns: + +``` xml + + + + + 1 + 1 + 0 + SyncHdr + 200 + + + 2 + 1 + 1 + Get + 200 + + + 3 + 1 + 1 + + + ./Vendor/MSFT/DiagnosticLog/DiagnosticArchive/ArchiveResults + + + + f1e20cb4-9789-4f6b-8f6a-766989764c6d + HKLM\Software\Policies + C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\*.etl + %windir%\system32\ipconfig.exe /all + %windir%\system32\mdmdiagnosticstool.exe -out c:\ProgramData\temp\ + c:\ProgramData\temp\*.* + %windir%\system32\ping.exe -n 50 localhost + Application + %ProgramData%\Microsoft\DiagnosticLogCSP\Collectors\*.etl + %SystemRoot%\System32\LogFiles\wmi\*.etl.* + %windir%\system32\pnputil.exe /enum-drivers + + + + + + + +``` +> [!Note] +> Each data gathering node is annotated with the HRESULT of the option and the collection is also annotated with an HRESULT. In this example, note that the mdmdiagnosticstool.exe command failed. ## Reading a log file - - -1. Enumerate log file under **./Vendor/MSFT/DiagnosticLog/FileDownload/DMChannel** -2. Select a log file in the Enumeration result -3. Set **BlockSizeKB** per DM server payload limitation -4. Get **BlockCount** to determine total read request -5. Set **BlockIndexToRead** to initialize read start point -6. Get **BlockData** for upload log block -7. Increase **BlockIndexToRead** -8. Repeat step 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)** - - - - - - - - - - +To read a log file: +1. Enumerate log file under **./Vendor/MSFT/DiagnosticLog/FileDownload/DMChannel**. +2. Select a log file in the Enumeration result. +3. Set **BlockSizeKB** per DM server payload limitation. +4. Get **BlockCount** to determine total read request. +5. Set **BlockIndexToRead** to initialize read start point. +6. Get **BlockData** for upload log block. +7. Increase **BlockIndexToRead**. +8. Repeat step 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)**. \ No newline at end of file diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index dc23032029..ec63a3f303 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -23,6 +23,7 @@ The content below are the latest versions of the DDF files: - [DiagnosticLog CSP version 1.2](#version-1-2) - [DiagnosticLog CSP version 1.3](#version-1-3) +- [DiagnosticLog CSP version 1.4](#version-1-4) ## DiagnosticLog CSP version 1.2 @@ -1284,6 +1285,893 @@ The content below are the latest versions of the DDF files: ``` +## DiagnosticLog CSP version 1.4 +```xml + + +]> + + 1.2 + + DiagnosticLog + ./Vendor/MSFT + + + + + + + + + + + + + + + com.microsoft/1.4/MDM/DiagnosticLog + + + + EtwLog + + + + + Root node of all types of event logging nodes that CSP manages. + + + + + + + + + + + + + + + Collectors + + + + + Root node of registered "Collector" nodes. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a registered 'Collector' node. CSP will maintain an ETW trace session for this collector with its name used as a unique identifier. In a collector, a valid ETW provider can be registered and unregistered. The collector's associated trace session will enable the registered providers in it if the provider's state is 'Enabled'. Each provider's state, trace level and keywords can be controlled separately. The name of this node must not be a valid Windows event channel name. It can be a etw provider guid as long as it is not equal to an already registered 'Provider' node name. + + + + + + + + + + CollectorName + + + + + + TraceStatus + + + + + This node is used for getting the status of this collector node's associated trace session. 1 means "in progress"; 0 means "not started or stopped". + + + + + + + + + + + text/plain + + + + + TraceLogFileMode + + + + + + 1 + This node is used for setting or getting the trace log file mode of this collector node's associated trace session. The only two allowed values are 1 and 2, which are EVENT_TRACE_FILE_MODE_SEQUENTIAL and EVENT_TRACE_FILE_MODE_CIRCULAR. Default value is 1. + + + + + + + + + + + text/plain + + + + + TraceControl + + + + + + This node is to trigger "start" and "stop" of this collector node's associated trace session. "Get" returns the name of this node. + + + + + + + + + + + text/plain + + + + + LogFileSizeLimitMB + + + + + + 4 + This node is used for setting or getting the trace log file size limit(in Megabytes) of this collector node's associated trace session. The value range is 1~2048. Default value is 4. + + + + + + + + + + + text/plain + + + + + Providers + + + + + Root node of all providers registered in this collector node. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents an ETW provider registered in this collector node. The node name must be a valid provider GUID. + + + + + + + + + + ProviderGuid + + + + + + Keywords + + + + + + "0" + This node is used for setting or getting the keywords of the event provider in this collector node's associated trace session. The string is in the form of hexadecimal digits and 16 chars wide. It'll be internally converted into ULONGLONG data type in the CSP. Default value is "0", which means all events from this provider are included. If the associated trace session is in progress, new keywords setting is applied immediately; if not, it'll be applied next time that session is started. + + + + + + + + + + + text/plain + + + + + TraceLevel + + + + + + 5 + This node is used for setting or getting the trace level of this event provider in this collector node's associated trace session. Default value is 5, which is TRACE_LEVEL_VERBOSE. If the associated trace session is in progress, new trace level setting is applied immediately;if not, it'll be applied next time that session is started. + + + + + + + + + + + text/plain + + + + + State + + + + + + true + This node is used for setting or getting the state of the event provider in this collector node's associated trace session. If the trace session isn't started, changing the value controls whether to enable the provider or not when session is started; if trace session is already started, changing its value causes enabling or disabling the provider in the live trace session. Default value is true. + + + + + + + + + + + text/plain + + + + + + + + + Channels + + + + + Root node of registered "Channel" nodes. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a registered 'Channel' node. The node name must be a valid Windows event log channel name, e.g. "Microsoft-Client-Licensing-Platform%2FAdmin". When specifying the name in the LocURI, it must be url encoded or it'll be translated into a different URI unexpectedly. + + + + + + + + + + ChannelName + + + + + + Export + + + + + + This node is to trigger exporting events into a log file from this node's associated Windows event channel. The log file's extension is .evtx, which is the standard extension of windows event channel log. The "Get" command returns the name of this node. + + + + + + + + + + + text/plain + + + + + State + + + + + + This node is used for setting or getting the 'Enabled' state of this node's associated windows event channel in the system. Setting it to "TRUE" enables the channel; setting it to "FALSE" disables the channel. + + + + + + + + + + + text/plain + + + + + Filter + + + + + + "" + This node is used for setting or getting the xpath query string to filter the events when exporting the log file from the channel. Default value is empty string. + + + + + + + + + + + text/plain + + + + + + + + DeviceStateData + + + + + Root node of all types of device state data that CSP exposes. + + + + + + + + + + + + + + + MdmConfiguration + + + + + This node is to trigger snapping of the Device Management state data with "SNAP". + + + + + + + + + + + text/plain + + + + + + FileDownload + + + + + Root node of all csp nodes that are related to log file download in csp. + + + + + + + + + + + + + + + DMChannel + + + + + Root node of all csp nodes that are used for controlling file download for their associated log file generated by logging csp nodes. + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a 'FileContext' node corresponding to a log file generated by one of the logging CSP nodes(underneath 'EtwLog' node). The node name must be the name of a registered 'Provider', 'Collector' or 'Channel' node. The log file and its location will be determined by CSP based on the node name. File download is done by dividing the log file into multiple blocks of configured block size and then sending the blocks as requested by MDM server. + + + + + + + + + + FileContext + + + + + + BlockSizeKB + + + + + + 4 + This node is used for setting or getting the block size (in Kilobytes) for the download of assoicated log file. The value range is 1~16. Default value is 4. + + + + + + + + + + + text/plain + + + + + BlockCount + + + + + This node is used for getting the total number of blocks for the associated log file. If the log file isn't generated yet, the value returned is -1; if the trace session is in progress, the value returned is -2. + + + + + + + + + + + text/plain + + + + + BlockIndexToRead + + + + + + This node is used for setting and getting the block index that points to the data block for 'BlockData' node. The value range is 0~(BlockCount-1). + + + + + + + + + + + text/plain + + + + + BlockData + + + + + This node is used to get the binary data of the block that 'BlockIndexToRead' node is pointing to. + + + + + + + + + + + + + + + + DataBlocks + + + + + Root node of all 'BlockNumber' nodes for the associated log file. The number of its children should be the total block count of the log file. No children nodes exist if 'BlockCount' node's value is less than 0. + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a 'BlockNumber' node. The node name is an integer equal to the index of the block which this node stands for. Therefore the node name should be ranging from 0 to (BlockCount -1). It returns the binary data of the block which this node is referring to. + + + + + + + + + + BlockNumber + + + + + + + + + + + Policy + + + + + Contains policy for diagnostic settings. + + + + + + + + + + + + + + + + + + Channels + + + + + Contains policy for Event Log channel settings. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a registered 'Channel' node. The node name must be a valid Windows event log channel name, e.g. "Microsoft-Client-Licensing-Platform%2FAdmin". When specifying the name in the LocURI, it must be url encoded or it'll be translated into a different URI unexpectedly. + + + + + + + + + + ChannelName + + + + + + MaximumFileSize + + + + + + + + Maximum size of the channel log file in MB. + + + + + + + + + + + text/plain + + + + + SDDL + + + + + + + + SDDL String controlling access to the channel. Default: https://docs.microsoft.com/en-us/windows/desktop/WES/eventmanifestschema-channeltype-complextype + + + + + + + + + + + + + + text/plain + + + + + ActionWhenFull + + + + + + + + Action to take when the log file reaches maximum size. "Truncate", "Overwrite", "Archive". + + + + + + + + + + + + + + text/plain + + + + + Enabled + + + + + + + + This policy setting specifies whether the channel should be enabled or disabled. Set value to TRUE to enable and FALSE to disable. + + + + + + + + + + + text/plain + + + + + + + + DiagnosticArchive + + + + + Root note for archive definition and collection. + + + + + + + + + + + + + + + ArchiveDefinition + + + + + + + + + + + + + + + + text/plain + + + + + ArchiveResults + + + + + Pull up the results of the last archive run. + + + + + + + + + + + + + + text/plain + + + + + + +``` + ## Related topics diff --git a/windows/client-management/mdm/dmacc-csp.md b/windows/client-management/mdm/dmacc-csp.md index 09b61984c1..aa61f9d50b 100644 --- a/windows/client-management/mdm/dmacc-csp.md +++ b/windows/client-management/mdm/dmacc-csp.md @@ -262,7 +262,7 @@ Stores specifies which certificate stores the DM client will search to find the Subject specifies the certificate to search for. For example, to specify that you want a certificate with a particular Subject attribute (“CN=Tester,O=Microsoft”), use the following: -``` syntax +```xml ``` diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 49635be46f..03e82dc9e8 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -56,7 +56,7 @@ Here is an easy way to get the EAP configuration from your desktop using the ras 9. Switch over to PowerShell and use the following cmdlets to retrieve the EAP configuration XML. - ``` syntax + ```powershell Get-VpnConnection -Name Test ``` @@ -80,17 +80,17 @@ Here is an easy way to get the EAP configuration from your desktop using the ras IdleDisconnectSeconds : 0 ``` - ``` syntax + ```powershell $a = Get-VpnConnection -Name Test ``` - ``` syntax + ```powershell $a.EapConfigXmlStream.InnerXml ``` Here is an example output - ``` syntax + ```xml 1300 13 diff --git a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md index f97a70c2f7..548a34e79e 100644 --- a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md @@ -19,20 +19,23 @@ This is a step-by-step guide to configuring ADMX-backed policies in MDM. Starting in Windows 10 version 1703, Mobile Device Management (MDM) policy configuration support was expanded to allow access of select Group Policy administrative templates (ADMX-backed policies) for Windows PCs via the [Policy configuration service provider (CSP)](policy-configuration-service-provider.md). Configuring ADMX-backed policies in Policy CSP is different from the typical way you configure a traditional MDM policy. Summary of steps to enable a policy: -- Find the policy from the list ADMX-backed policies. -- Find the Group Policy related information from the MDM policy description. -- Use the Group Policy Editor to determine whether there are parameters necessary to enable the policy. -- Create the data payload for the SyncML. +- Find the policy from the list ADMX-backed policies. +- Find the Group Policy related information from the MDM policy description. +- Use the Group Policy Editor to determine whether there are parameters necessary to enable the policy. +- Create the data payload for the SyncML. -See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Ingesting-Office-ADMX-Backed-policies-using/ba-p/354824) for a walk-through using Intune. +See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Ingesting-Office-ADMX-Backed-policies-using/ba-p/354824) and [Deploying ADMX-Backed policies using Microsoft Intune](https://blogs.technet.microsoft.com/senthilkumar/2018/05/21/intune-deploying-admx-backed-policies-using-microsoft-intune/) for a walk-through using Intune. >[!TIP] >Intune has added a number of ADMX-backed administrative templates in public preview. Check if the policy settings you need are available in a template before using the SyncML method described below. [Learn more about Intune's administrative templates.](https://docs.microsoft.com/intune/administrative-templates-windows) ## Enable a policy +> [!NOTE] +> See [Understanding ADMX-backed policies](https://docs.microsoft.com/en-us/windows/client-management/mdm/understanding-admx-backed-policies). + 1. Find the policy from the list [ADMX-backed policies](policy-configuration-service-provider.md#admx-backed-policies). You need the following information listed in the policy description. - - GP English name + - GP English name - GP name - GP ADMX file name - GP path diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 9f3f924a14..6360bcb775 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -22,6 +22,7 @@ Requirements: - The enterprise has configured a mobile device management (MDM) service - The enterprise AD must be [registered with Azure Active Directory (Azure AD)](azure-active-directory-integration-with-mdm.md) - The device should not already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with `error 0x80180026`) +- The minimum Windows Server version requirement is based on the Hybrid AAD join requirement. See [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-plan) for more information. > [!TIP] > For additional information, see the following topics: @@ -155,8 +156,8 @@ Requirements: >[!IMPORTANT] >If you do not see the policy, it may be because you don’t have the ADMX installed for Windows 10, version 1803 or version 1809. To fix the issue, follow these steps: > 1. Download: -> 1803 -->[Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)](https://www.microsoft.com/en-us/download/details.aspx?id=56880) or -> 1809 --> [Administrative Templates for Windows 10 October 2018 Update (1809)](https://www.microsoft.com/en-us/download/details.aspx?id=57576). +> 1803 -->[Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)](https://www.microsoft.com/download/details.aspx?id=56880) or +> 1809 --> [Administrative Templates for Windows 10 October 2018 Update (1809)](https://www.microsoft.com/download/details.aspx?id=57576). > 2. Install the package on the Primary Domain Controller (PDC). > 3. Navigate, depending on the version to the folder: > 1803 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 April 2018 Update (1803) v2**, or diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md index 85e0516dfd..429bf2fe21 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md @@ -1,7 +1,7 @@ --- title: EnrollmentStatusTracking CSP description: EnrollmentStatusTracking CSP -ms.author: dansimp@microsoft.com +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp.md b/windows/client-management/mdm/enrollmentstatustracking-csp.md index 40733a7170..080db28b5c 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp.md @@ -1,7 +1,7 @@ --- title: EnrollmentStatusTracking CSP description: EnrollmentStatusTracking CSP -ms.author: dansimp@microsoft.com +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/esim-enterprise-management.md b/windows/client-management/mdm/esim-enterprise-management.md index 1fad0a54a6..386f5a8c48 100644 --- a/windows/client-management/mdm/esim-enterprise-management.md +++ b/windows/client-management/mdm/esim-enterprise-management.md @@ -14,13 +14,13 @@ ms.topic: # How Mobile Device Management Providers support eSIM Management on Windows The eSIM Profile Management Solution puts the Mobile Device Management (MDM) Provider in the front and center. The whole idea is to leverage an already existing solution that customers are familiar with and that they use to manage devices. The expectations from an MDM are that it will leverage the same sync mechanism that it uses for device policies to push any policy to the eSIM profile, and be able to use Groups and Users the same way. This way, the eSIM profile download and installation happens on the background and not impacting the end user. Similarly, the IT admin would use the same method of managing the eSIM profiles (Assignment/de-assignment, etc.) the same way as they currently do device management. If you are a Mobile Device Management (MDM) Provider and would like to support eSIM Management on Windows, you should do the following: -- Onboard to Azure Active Directory -- Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you are looking to integrate/onboard to a mobile operator on a 1:1 basis, please contact them and learn more about their onboarding. If you would like to support multiple mobile operators, [orchestrator providers]( https://www.idemia.com/esim-management-facilitation) are there to act as a proxy that will handle MDM onboarding as well as mobile operator onboarding. Their main [role]( https://www.idemia.com/smart-connect-hub) is to enable the process to be as painless but scalable to all parties. -- Assess solution type that you would like to provide your customers -- Batch/offline solution -- IT Admin can manually import a flat file containing list of eSIM activation codes, and provision eSIM on LTE enabled devices. -- Operator does not have visibility over status of the eSIM profiles and device eSIM has been downloaded and installed to -- Real-time solution -- MDM automatically syncs with the Operator backend system for subscription pool and eSIM management, via sim vendor solution component. IT Admin can view subscription pool and provision eSIM in real time. -- Operator is notified of the status of each eSIM profile and has visibility on which devices are being used +- Onboard to Azure Active Directory +- Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you are looking to integrate/onboard to a mobile operator on a 1:1 basis, please contact them and learn more about their onboarding. If you would like to support multiple mobile operators, [orchestrator providers]( https://www.idemia.com/esim-management-facilitation) are there to act as a proxy that will handle MDM onboarding as well as mobile operator onboarding. Their main [role]( https://www.idemia.com/smart-connect-hub) is to enable the process to be as painless but scalable to all parties. +- Assess solution type that you would like to provide your customers +- Batch/offline solution +- IT Admin can manually import a flat file containing list of eSIM activation codes, and provision eSIM on LTE enabled devices. +- Operator does not have visibility over status of the eSIM profiles and device eSIM has been downloaded and installed to +- Real-time solution +- MDM automatically syncs with the Operator backend system for subscription pool and eSIM management, via sim vendor solution component. IT Admin can view subscription pool and provision eSIM in real time. +- Operator is notified of the status of each eSIM profile and has visibility on which devices are being used **Note:** The solution type is not noticeable to the end-user. The choice between the two is made between the MDM and the Mobile Operator. diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md index dff91fd372..12af80dacf 100644 --- a/windows/client-management/mdm/federated-authentication-device-enrollment.md +++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md @@ -167,6 +167,9 @@ AuthenticationServiceUrl?appru=&login_hint= After authentication is complete, the auth server should return an HTML form document with a POST method action of appid identified in the query string parameter. +> [!NOTE] +> To make an application compatible with strict Content Security Policy, it is usually necessary to make some changes to HTML templates and client-side code, add the policy header, and test that everything works properly once the policy is deployed. + ``` HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index a14f71ce2d..3870f7d385 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -314,16 +314,16 @@ For DHA-OnPrem & DHA-EMC scenarios, send a SyncML command to the HASEndpoint nod The following example shows a sample call that instructs a managed device to communicate with an enterprise managed DHA-Service. -``` syntax - - 1 - - - ./Vendor/MSFT/HealthAttestation/HASEndpoint - - www.ContosoDHA-Service - - +```xml + + 1 + + + ./Vendor/MSFT/HealthAttestation/HASEndpoint + + www.ContosoDHA-Service + + ``` @@ -334,24 +334,24 @@ Send a SyncML call to start collection of the DHA-Data. The following example shows a sample call that triggers collection and verification of health attestation data from a managed device. -``` syntax - - 1 - - - ./Vendor/MSFT/HealthAttestation/VerifyHealth - - - +```xml + + 1 + + + ./Vendor/MSFT/HealthAttestation/VerifyHealth + + + - - 2 - - - ./Vendor/MSFT/HealthAttestation/Status - - - + + 2 + + + ./Vendor/MSFT/HealthAttestation/Status + + + ``` ## **Step 4: Take action based on the clients response** @@ -364,21 +364,21 @@ After the client receives the health attestation request, it sends a response. T Here is a sample alert that is issued by DHA_CSP: -``` syntax - - 1 - 1226 - - - ./Vendor/MSFT/HealthAttestation/VerifyHealth - - - com.microsoft.mdm:HealthAttestation.Result - int - - 3 - - +```xml + + 1 + 1226 + + + ./Vendor/MSFT/HealthAttestation/VerifyHealth + + + com.microsoft.mdm:HealthAttestation.Result + int + + 3 + + ``` - If the response to the status node is not 0, 1 or 3, then troubleshoot the issue. For the complete list of status codes see [Device HealthAttestation CSP status and error codes](#device-healthattestation-csp-status-and-error-codes). @@ -389,35 +389,34 @@ Create a call to the **Nonce**, **Certificate** and **CorrelationId** nodes, and Here is an example: -``` syntax +```xml - 1 - - - ./Vendor/MSFT/HealthAttestation/Nonce - - AAAAAAAAAFFFFFFF - + 1 + + + ./Vendor/MSFT/HealthAttestation/Nonce + + AAAAAAAAAFFFFFFF + - - 2 - - - ./Vendor/MSFT/HealthAttestation/Certificate - - - - - - 3 - - - ./Vendor/MSFT/HealthAttestation/CorrelationId - - - + + 2 + + + ./Vendor/MSFT/HealthAttestation/Certificate + + + + + 3 + + + ./Vendor/MSFT/HealthAttestation/CorrelationId + + + ``` ## **Step 6: Forward device health attestation data to DHA-service** @@ -1019,8 +1018,8 @@ Each of these are described in further detail in the following sections, along w ## DHA-Report V3 schema -``` syntax - +```xml + **Note** In the prior version of the tool, an update to the app manifest was required to authorize the application. This is no longer necessary. - -11. Login to Store for Business and enable your application. For step-by-step guide, see [Configure an MDM provider](https://technet.microsoft.com/library/mt606939.aspx). - +See [Quickstart: Register an application with the Microsoft identity platform](https://docs.microsoft.com/azure/active-directory/develop/quickstart-register-app) for the steps to configure your Azure AD app. ## Azure AD Authentication for MTS diff --git a/windows/client-management/mdm/networkqospolicy-csp.md b/windows/client-management/mdm/networkqospolicy-csp.md index 564059ef4e..debd9dbd5a 100644 --- a/windows/client-management/mdm/networkqospolicy-csp.md +++ b/windows/client-management/mdm/networkqospolicy-csp.md @@ -16,13 +16,13 @@ manager: dansimp The NetworkQoSPolicy configuration service provider creates network Quality of Service (QoS) policies. A QoS policy performs a set of actions on network traffic based on a set of matching conditions. This CSP was added in Windows 10, version 1703. The following conditions are supported: -- Network traffic from a specific application name -- Network traffic from specific source or destination ports -- Network traffic from a specific IP protocol (TCP, UDP, or both) +- Network traffic from a specific application name +- Network traffic from specific source or destination ports +- Network traffic from a specific IP protocol (TCP, UDP, or both) The following actions are supported: -- Layer 2 tagging using a IEEE 802.1p priority value -- Layer 3 tagging using a differentiated services code point (DSCP) value +- Layer 2 tagging using a IEEE 802.1p priority value +- Layer 3 tagging using a differentiated services code point (DSCP) value > [!NOTE] > The NetworkQoSPolicy configuration service provider is supported only in Microsoft Surface Hub. @@ -49,9 +49,9 @@ The following diagram shows the NetworkQoSPolicy configuration service provider

                        Valid values are: - - 0 (default) - Both TCP and UDP - - 1 - TCP - - 2 - UDP +- 0 (default) - Both TCP and UDP +- 1 - TCP +- 2 - UDP

                        The data type is int. diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index f12fe88286..0e6b603e24 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -144,6 +144,13 @@ For details about Microsoft mobile device management protocols for Windows 10 s

                        Added new CSP in Windows 10, version 1903.

                        +DiagnosticLog CSP
                        +DiagnosticLog DDF +

                        Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
                        +Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults. +

                        + + EnrollmentStatusTracking CSP

                        Added new CSP in Windows 10, version 1903.

                        @@ -1896,6 +1903,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o |New or updated topic | Description| |--- | ---| +|[DiagnosticLog CSP](diagnosticlog-csp.md)
                        [DiagnosticLog DDF](diagnosticlog-ddf.md)|Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
                        Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults.| |[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)|Enhanced the article to include additional reference links and the following two topics:
                        Verify auto-enrollment requirements and settings, Troubleshoot auto-enrollment of devices.| ### July 2019 diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index b5cb013a88..008c0c74a3 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -199,12 +199,14 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 871c434dca..053896ccc4 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -195,33 +195,13 @@ The following list shows the supported values:
                        - - - -## Accounts policies supported by HoloLens 2 - -- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) - - - -## Accounts policies supported by HoloLens (1st gen) Commercial Suite - -- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) - - - -## Accounts policies supported by HoloLens (1st gen) Development Edition - -- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) - - -
                        - Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index 09639791f8..850e4ff945 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -92,12 +92,13 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - - + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index 7bbea44531..86d413d085 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -199,12 +199,13 @@ This setting supports a range of values between 0 and 1.
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - - + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index bb80f306e7..1657cb97f4 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -478,11 +478,11 @@ An XML blob that specifies the application restrictions company want to put to t > > Here's additional guidance for the upgrade process: > -> - Use Windows 10 product IDs for the apps listed in [inbox apps](applocker-csp.md#inboxappsandcomponents). -> - Use the new Microsoft publisher name (PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US") and Publisher="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" if you are using the publisher policy. Do not remove the Windows Phone 8.1 publisher if you are using it. -> - In the SyncML, you must use lowercase product ID. -> - Do not duplicate a product ID. Messaging and Skype Video use the same product ID. Duplicates cause an error. -> - You cannot disable or enable **Contact Support** and **Windows Feedback** apps using ApplicationManagement/ApplicationRestrictions policy, although these are listed in the [inbox apps](applocker-csp.md#inboxappsandcomponents). +> - Use Windows 10 product IDs for the apps listed in [inbox apps](applocker-csp.md#inboxappsandcomponents). +> - Use the new Microsoft publisher name (PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US") and Publisher="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" if you are using the publisher policy. Do not remove the Windows Phone 8.1 publisher if you are using it. +> - In the SyncML, you must use lowercase product ID. +> - Do not duplicate a product ID. Messaging and Skype Video use the same product ID. Duplicates cause an error. +> - You cannot disable or enable **Contact Support** and **Windows Feedback** apps using ApplicationManagement/ApplicationRestrictions policy, although these are listed in the [inbox apps](applocker-csp.md#inboxappsandcomponents). An application that is running may not be immediately terminated. @@ -537,7 +537,7 @@ Added in Windows 10, version 1607. Boolean value that disables the launch of al ADMX Info: -- GP English name: *Disable all apps from Microsoft Store * +- GP English name: *Disable all apps from Microsoft Store* - GP name: *DisableStoreApps* - GP path: *Windows Components/Store* - GP ADMX file name: *WindowsStore.admx* @@ -1040,34 +1040,6 @@ XSD: - - - - -## ApplicationManagement policies supported by HoloLens 2 - -- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) - - - - -## ApplicationManagement policies supported by HoloLens (ist gen) Commercial Suite - -- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) - - - -## ApplicationManagement policies supported by HoloLens (1st gen) Development Edition - -- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) - -
                        Footnotes: @@ -1078,3 +1050,4 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md index 6f998bebf9..ce22da2a1b 100644 --- a/windows/client-management/mdm/policy-csp-appruntime.md +++ b/windows/client-management/mdm/policy-csp-appruntime.md @@ -89,12 +89,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index 7ecd3a228b..6719816427 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -1812,7 +1812,7 @@ ADMX Info: -Specifies a list of process paths (may contain wildcards) which are candidates for using virtual components (shell extensions, browser helper objects, etc). Only processes whose full path matches one of these items can use virtual components. +Specifies a list of process paths (may contain wildcards) which are candidates for using virtual components (shell extensions, browser helper objects, etc.). Only processes whose full path matches one of these items can use virtual components. > [!TIP] @@ -1833,12 +1833,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index f5630e76f5..bcb75801ca 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -226,12 +226,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 6ce830a730..fa0ff7ed0c 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -241,7 +241,7 @@ Preview release in Windows 10, version 1709. Supported in the next release. Spe Value type is integer. -Here is an example scenario: At Contoso, there are a lot of shared devices and kiosks that employees throughout the day using as many as 20 different devices. To minimize the loss in productivity when employees have to login with username and password everytime they pick up a device, the IT admin deploys SharePC CSP and Authentication/AllowFidoDeviceSignon policy to shared devices. The IT admin provisions and distributes FIDO 2.0 devices to employees, which allows them to authenticate to various shared devices and PCs. +Here is an example scenario: At Contoso, there are a lot of shared devices and kiosks that employees throughout the day using as many as 20 different devices. To minimize the loss in productivity when employees have to login with username and password every time they pick up a device, the IT admin deploys SharePC CSP and Authentication/AllowFidoDeviceSignon policy to shared devices. The IT admin provisions and distributes FIDO 2.0 devices to employees, which allows them to authenticate to various shared devices and PCs. @@ -364,7 +364,7 @@ This policy is intended for use on Shared PCs to enable a quick first sign-in ex Value type is integer. Supported values: - 0 - (default) The feature defaults to the existing SKU and device capabilities. -- 1 - Enabled. Auto connect new non-admin AZure AD accounts to pre-configured candidate local accounts +- 1 - Enabled. Auto connect new non-admin Azure AD accounts to pre-configured candidate local accounts - 2 - Disabled. Do not auto connect new non-admin Azure AD accounts to pre-configured local accounts @@ -499,30 +499,6 @@ Value type is string. - - - - -## Authentication policies supported by HoloLens 2 - -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) -- [Authentication/PreferredAadTenantDomainName](#authentication-preferredaadtenantdomainname) - - - -## Authentication policies supported by HoloLens (1st gen) Commercial Suite - -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) -- [Authentication/PreferredAadTenantDomainName](#authentication-preferredaadtenantdomainname) - - - -## Authentication policies supported by HoloLens (1st gen) Development Edition - -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) - - -
                        Footnotes: @@ -533,3 +509,4 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index 0845e952f8..0f89d7ad50 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -242,12 +242,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-bitlocker.md b/windows/client-management/mdm/policy-csp-bitlocker.md index 85d8f6acdc..f160212054 100644 --- a/windows/client-management/mdm/policy-csp-bitlocker.md +++ b/windows/client-management/mdm/policy-csp-bitlocker.md @@ -86,7 +86,7 @@ The following list shows the supported values: > [!NOTE] > To manage encryption of PCs and devices, use [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md index 32fe01163f..c7305f22ee 100644 --- a/windows/client-management/mdm/policy-csp-bits.md +++ b/windows/client-management/mdm/policy-csp-bits.md @@ -91,7 +91,7 @@ If BITS/BandwidthThrottlingStartTime or BITS/BandwidthThrottlingEndTime are NOT This policy specifies the bandwidth throttling **end time** that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy is based on the 24-hour clock. -Value type is integer. Default value is 17 (5 pm). +Value type is integer. Default value is 17 (5 PM). Supported value range: 0 - 23 @@ -101,7 +101,7 @@ Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrott If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. -Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. +Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -176,7 +176,7 @@ Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrott If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. -Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. +Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -251,7 +251,7 @@ Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrott If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. -Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. +Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -494,14 +494,14 @@ Supported values range: 0 - 999
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 2475975ca6..d834300ed0 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -341,34 +341,18 @@ The default value is an empty string. For more information, see [ServicesAllowed +
                        +Footnotes: +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - -## Bluetooth policies supported by HoloLens 2 - -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) - - - -## Bluetooth policies supported by HoloLens (1st gen) Commercial Suite - -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) - - - -## Bluetooth policies supported by HoloLens (1st gen) Development Edition - -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) - - -
                        - +
                        ## ServicesAllowedList usage guide @@ -481,14 +465,4 @@ Disabling file transfer shall have the following effects - Fsquirt shall not allow sending of files - Fsquirt shall not allow receiving of files - Fsquirt shall display error message informing user of policy preventing file transfer -- 3rd-party apps shall not be permitted to send or receive files using MSFT Bluetooth API - -
                        -Footnotes: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 3rd-party apps shall not be permitted to send or receive files using MSFT Bluetooth API \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index a397e2cdfa..8f07ea575b 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -319,7 +319,7 @@ To verify AllowAutofill is set to 0 (not allowed): 1. Open Microsoft Edge. 2. In the upper-right corner of the browser, click **…**. 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. -4. Verify the setting **Save form entries** is greyed out. +4. Verify the setting **Save form entries** is grayed out. @@ -629,9 +629,9 @@ ADMX Info: Supported values: -- Blank (default) - Do not send tracking information but let users choose to send tracking information to sites they visit. -- 0 - Never send tracking information. -- 1 - Send tracking information. +- Blank (default) - Do not send tracking information but let users choose to send tracking information to sites they visit. +- 0 - Never send tracking information. +- 1 - Send tracking information. Most restricted value: 1 @@ -641,7 +641,7 @@ To verify AllowDoNotTrack is set to 0 (not allowed): 1. Open Microsoft Edge or Microsoft Edge for Windows 10 Mobile. 2. In the upper-right corner of the browser, click **…**. 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. -4. Verify the setting **Send Do Not Track requests** is greyed out. +4. Verify the setting **Send Do Not Track requests** is grayed out. @@ -3961,44 +3961,6 @@ Supported values: Most restricted value: 0 - - - - -## Browser policies supported by HoloLens 2 - -- [Browser/AllowAutofill](#browser-allowautofill) -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) - - - -## Browser policies supported by HoloLens (1st gen) Commercial Suite - -- [Browser/AllowAutofill](#browser-allowautofill) -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) - - - -## Browser policies supported by HoloLens (1st gen) Development Edition - -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) - -
                        Footnotes: @@ -4009,3 +3971,5 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + + diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index 0852d91632..64551b503d 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -88,30 +88,13 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - - - -## Camera policies that can be set using Exchange Active Sync (EAS) - -- [Camera/AllowCamera](#camera-allowcamera) - - - -## Camera policies supported by IoT Core - -- [Camera/AllowCamera](#camera-allowcamera) - - - -## Camera policies supported by Microsoft Surface Hub - -- [Camera/AllowCamera](#camera-allowcamera) - - + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index ff738aa2e1..9a09add801 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -329,30 +329,13 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - - - -## Cellular policies that can be set using Exchange Active Sync (EAS) - -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) - - - -## Cellular policies supported by IoT Core - -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) - - - -## Cellular policies supported by Microsoft Surface Hub - -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) - - + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index d86d214339..aadc67164b 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -120,7 +120,7 @@ Most restricted value is 0. The following list shows the supported values: -- 0 – Disallow Bluetooth. If this is set to 0, the radio in the Bluetooth control panel will be greyed out and the user will not be able to turn Bluetooth on. +- 0 – Disallow Bluetooth. If this is set to 0, the radio in the Bluetooth control panel will be grayed out and the user will not be able to turn Bluetooth on. - 1 – Reserved. If this is set to 1, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on. - 2 (default) – Allow Bluetooth. If this is set to 2, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on. @@ -418,7 +418,7 @@ This setting supports a range of values between 0 and 1. Validation: -If the Connectivity/AllowPhonePCLinking policy is configured to value 0, the add a phone button in the Phones section in settings will be greyed out and clicking it will not launch the window for a user to enter their phone number. +If the Connectivity/AllowPhonePCLinking policy is configured to value 0, the add a phone button in the Phones section in settings will be grayed out and clicking it will not launch the window for a user to enter their phone number. Device that has previously opt-in to MMX will also stop showing on the device list. @@ -942,7 +942,7 @@ Determines whether a user can install and configure the Network Bridge. Important: This settings is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting does not apply. -The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segements together. This connection appears in the Network Connections folder. +The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segments together. This connection appears in the Network Connections folder. If you disable this setting or do not configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting does not remove an existing Network Bridge from the user's computer. @@ -963,30 +963,6 @@ ADMX Info: - - - - -## Connectivity policies supported by HoloLens 2 - -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) - - - -## Connectivity policies supported by HoloLens (1st gen) Commercial Suite - -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) - - - -## Connectivity policies supported by HoloLens (1st gen) Development Edition - -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) - -
                        Footnotes: @@ -996,4 +972,5 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 6 - Added in Windows 10, version 1903. + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index c9d03ef5de..92db88b0ff 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -106,12 +106,13 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - - + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index 1e3b1dd91e..c90e160c5d 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -216,19 +216,13 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - - - -## CredentialProviders policies supported by IoT Core - -- [CredentialProviders/AllowPINLogon](#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](#credentialproviders-blockpicturepassword) - - + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md index 80a987c29b..6d6549c026 100644 --- a/windows/client-management/mdm/policy-csp-credentialsdelegation.md +++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md @@ -91,12 +91,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index 723426a323..480fd54f21 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -160,12 +160,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index 4aaf66a50c..088711a7c3 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -148,21 +148,15 @@ Lists the Cryptographic Cipher Algorithms allowed for SSL connections. Format is - - -## Cryptography policies supported by Microsoft Surface Hub - -- [Cryptography/AllowFipsAlgorithmPolicy](#cryptography-allowfipsalgorithmpolicy) -- [Cryptography/TLSCipherSuites](#cryptography-tlsciphersuites) - -
                        Footnotes: -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in Windows 10, version 1809. +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index cfa533aef2..c8866cf5c0 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -133,18 +133,13 @@ Setting used by Windows 8.1 Selective Wipe.
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - - - -## DataProtection policies supported by IoT Core - -- [DataProtection/AllowDirectMemoryAccess](#dataprotection-allowdirectmemoryaccess) - - + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index 1268e6243c..cab2e300d4 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -111,12 +111,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index f796a9ae53..3d598448d3 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 01/26/2019 +ms.date: 08/26/2019 ms.reviewer: manager: dansimp --- @@ -205,8 +205,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off scanning on archived files. +- 1 (default) – Allowed. Scans the archive files. @@ -267,8 +267,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off behavior monitoring. +- 1 (default) – Allowed. Turns on real-time behavior monitoring. @@ -330,8 +330,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off the Microsoft Active Protection Service. +- 1 (default) – Allowed. Turns on the Microsoft Active Protection Service. @@ -392,8 +392,8 @@ ADMX Info: The following list shows the supported values: -- 0 (default) – Not allowed. -- 1 – Allowed. +- 0 (default) – Not allowed. Turns off email scanning. +- 1 – Allowed. Turns on email scanning. @@ -454,8 +454,8 @@ ADMX Info: The following list shows the supported values: -- 0 (default) – Not allowed. -- 1 – Allowed. +- 0 (default) – Not allowed. Disables scanning on mapped network drives. +- 1 – Allowed. Scans mapped network drives. @@ -502,7 +502,7 @@ The following list shows the supported values: > This policy is only enforced in Windows 10 for desktop. -Allows or disallows a full scan of removable drives. +Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned. @@ -516,8 +516,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off scanning on removable drives. +- 1 (default) – Allowed. Scans removable drives. @@ -756,8 +756,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off the real-time monitoring service. +- 1 (default) – Allowed. Turns on and runs the real-time monitoring service. @@ -818,8 +818,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off scanning of network files. +- 1 (default) – Allowed. Scans network files. @@ -934,8 +934,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Prevents users from accessing UI. +- 1 (default) – Allowed. Lets users access UI. @@ -1821,7 +1821,7 @@ ADMX Info: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -Added in Windows 10, version 1709. This policy allows you to turn network protection on (block/audit) or off in Windows Defender Exploit Guard. Network protection is a feature of Windows Defender Exploit Guard that protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. Value type is integer. +Added in Windows 10, version 1709. This policy allows you to turn network protection on (block/audit) or off. Network protection protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. Value type is integer. If you enable this setting, network protection is turned on and employees can't turn it off. Its behavior can be controlled by the following options: Block and Audit. If you enable this policy with the ""Block"" option, users/apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Windows Defender Security Center. @@ -2773,46 +2773,13 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. - - -## Defender policies supported by Microsoft Surface Hub - -- [Defender/AllowArchiveScanning](#defender-allowarchivescanning) -- [Defender/AllowBehaviorMonitoring](#defender-allowbehaviormonitoring) -- [Defender/AllowCloudProtection](#defender-allowcloudprotection) -- [Defender/AllowEmailScanning](#defender-allowemailscanning) -- [Defender/AllowFullScanOnMappedNetworkDrives](#defender-allowfullscanonmappednetworkdrives) -- [Defender/AllowFullScanRemovableDriveScanning](#defender-allowfullscanremovabledrivescanning) -- [Defender/AllowIOAVProtection](#defender-allowioavprotection) -- [Defender/AllowIntrusionPreventionSystem](#defender-allowintrusionpreventionsystem) -- [Defender/AllowOnAccessProtection](#defender-allowonaccessprotection) -- [Defender/AllowRealtimeMonitoring](#defender-allowrealtimemonitoring) -- [Defender/AllowScanningNetworkFiles](#defender-allowscanningnetworkfiles) -- [Defender/AllowScriptScanning](#defender-allowscriptscanning) -- [Defender/AllowUserUIAccess](#defender-allowuseruiaccess) -- [Defender/AvgCPULoadFactor](#defender-avgcpuloadfactor) -- [Defender/DaysToRetainCleanedMalware](#defender-daystoretaincleanedmalware) -- [Defender/ExcludedExtensions](#defender-excludedextensions) -- [Defender/ExcludedPaths](#defender-excludedpaths) -- [Defender/ExcludedProcesses](#defender-excludedprocesses) -- [Defender/PUAProtection](#defender-puaprotection) -- [Defender/RealTimeScanDirection](#defender-realtimescandirection) -- [Defender/ScanParameter](#defender-scanparameter) -- [Defender/ScheduleQuickScanTime](#defender-schedulequickscantime) -- [Defender/ScheduleScanDay](#defender-schedulescanday) -- [Defender/ScheduleScanTime](#defender-schedulescantime) -- [Defender/SignatureUpdateInterval](#defender-signatureupdateinterval) -- [Defender/SubmitSamplesConsent](#defender-submitsamplesconsent) -- [Defender/ThreatSeverityDefaultAction](#defender-threatseveritydefaultaction) - - diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 66ac43c7f6..951388e477 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -1701,101 +1701,6 @@ This policy allows an IT Admin to define the following: - - - - - - - - - - - -## DeliveryOptimization policies supported by IoT Core - -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DOCacheHost](#deliveryoptimization-docachehost) -- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) -- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) -- [DeliveryOptimization/DODelayCacheServerFallbackBackground](#deliveryoptimization-dodelaycacheserverfallbackbackground) -- [DeliveryOptimization/DODelayCacheServerFallbackForeground](#deliveryoptimization-dodelaycacheserverfallbackforeground) -- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOGroupIdSource](#deliveryoptimization-dogroupidsource) -- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](#deliveryoptimization-dominbatterypercentageallowedtoupload) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) -- [DeliveryOptimization/DORestrictPeerSelectionBy](#deliveryoptimization-dorestrictpeerselectionby) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) - - - -## DeliveryOptimization policies supported by IoT Enterprise - -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DOCacheHost](#deliveryoptimization-docachehost) -- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) -- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) -- [DeliveryOptimization/DODelayCacheServerFallbackBackground](#deliveryoptimization-dodelaycacheserverfallbackbackground) -- [DeliveryOptimization/DODelayCacheServerFallbackForeground](#deliveryoptimization-dodelaycacheserverfallbackforeground) -- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOGroupIdSource](#deliveryoptimization-dogroupidsource) -- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](#deliveryoptimization-dominbatterypercentageallowedtoupload) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) -- [DeliveryOptimization/DORestrictPeerSelectionBy](#deliveryoptimization-dorestrictpeerselectionby) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) - - - - -## DeliveryOptimization policies supported by Microsoft Surface Hub - -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) - -
                        Footnotes: @@ -1806,3 +1711,5 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + + diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index ebe8a9efb2..4d1a10abe5 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -90,18 +90,13 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - - - -## Desktop policies supported by Microsoft Surface Hub - -- [Desktop/PreventUserRedirectionOfProfileFolders](#desktop-preventuserredirectionofprofilefolders) - - + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index 44a9b306d9..c06a4e40e9 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -285,14 +285,14 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md index c945a7c66c..786c883fe0 100644 --- a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md +++ b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md @@ -199,26 +199,6 @@ In most cases, an IT Pro does not need to define this policy. Instead, it is exp
                        - - - - -## DeviceHealthMonitoring policies supported by IoT Core - -- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](#devicehealthmonitoring-allowdevicehealthmonitoring) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](#devicehealthmonitoring-configdevicehealthmonitoringscope) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) - - - -## DeviceHealthMonitoring policies supported by IoT Enterprise - -- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](#devicehealthmonitoring-allowdevicehealthmonitoring) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](#devicehealthmonitoring-configdevicehealthmonitoringscope) -- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) - - -
                        Footnotes: - 1 - Added in Windows 10, version 1607. @@ -226,4 +206,6 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 6 - Added in Windows 10, version 1903. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 1ff5f4fa3a..75e6a2bd5a 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -12,7 +12,6 @@ author: manikadhiman # Policy CSP - DeviceInstallation -
                        @@ -111,13 +110,6 @@ ADMX Info: - - - - - - - To enable this policy, use the following SyncML. This example allows Windows to install compatible devices with a device ID of USB\Composite or USB\Class_FF. To configure multiple classes, use `` as a delimiter. @@ -148,6 +140,11 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i <<< Section end 2018/11/15 12:26:41.751 <<< [Exit status: SUCCESS] ``` + + + + +
                        @@ -222,13 +219,6 @@ ADMX Info: - - - - - - - To enable this policy, use the following SyncML. This example allows Windows to install: - Floppy Disks, ClassGUID = {4d36e980-e325-11ce-bfc1-08002be10318} @@ -266,6 +256,11 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i <<< Section end 2018/11/15 12:26:41.751 <<< [Exit status: SUCCESS] ``` + + + + +
                        @@ -311,8 +306,6 @@ If you enable this policy setting, Windows does not retrieve device metadata for If you disable or do not configure this policy setting, the setting in the Device Installation Settings dialog box controls whether Windows retrieves device metadata from the Internet. - - > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). @@ -340,8 +333,6 @@ ADMX Info: - -
                        @@ -386,7 +377,6 @@ If you enable this policy setting, Windows is prevented from installing or updat If you disable or do not configure this policy setting, Windows is allowed to install or update the device driver for any device that is not described by the "Prevent installation of devices that match any of these device IDs," "Prevent installation of devices for these device classes," or "Prevent installation of removable devices" policy setting. - > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). @@ -407,13 +397,6 @@ ADMX Info: - - - - - - - To enable this policy, use the following SyncML. This example prevents Windows from installing devices that are not specifically described by any other policy setting. @@ -448,7 +431,11 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i You can also block installation by using a custom profile in Intune. ![Custom profile](images/custom-profile-prevent-other-devices.png) + + + +
                        @@ -512,9 +499,10 @@ ADMX Info: - GP ADMX file name: *deviceinstallation.admx* - - + + +
                        To enable this policy, use the following SyncML. This example prevents Windows from installing compatible devices with a device ID of USB\Composite or USB\Class_FF. To configure multiple classes, use &#xF000; as a delimiter. To apply the policy to matching device classes that are already installed, set DeviceInstall_IDs_Deny_Retroactive to true. @@ -552,6 +540,11 @@ You can also block installation and usage of prohibited peripherals by using a c For example, this custom profile blocks installation and usage of USB devices with hardware IDs "USB\Composite" and "USB\Class_FF", and applies to USB devices with matching hardware IDs that are already installed. ![Custom profile](images/custom-profile-prevent-device-ids.png) + + + + + @@ -614,9 +607,10 @@ ADMX Info: - GP ADMX file name: *deviceinstallation.admx* - -
                        + + + To enable this policy, use the following SyncML. This example prevents Windows from installing: - Floppy Disks, ClassGUID = {4d36e980-e325-11ce-bfc1-08002be10318} @@ -653,15 +647,20 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i <<< Section end 2018/11/15 12:26:41.751 <<< [Exit status: SUCCESS] ``` + + -Footnote: + + +
                        + +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. - - +- 6 - Added in Windows 10, version 1903. + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 524745b05b..dd583b02dc 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -387,12 +387,12 @@ Specifies whether device lock is enabled. > [!Important] > **DevicePasswordEnabled** should not be set to Enabled (0) when WMI is used to set the EAS DeviceLock policies given that it is Enabled by default in Policy CSP for back compat with Windows 8.x. If **DevicePasswordEnabled** is set to Enabled(0) then Policy CSP will return an error stating that **DevicePasswordEnabled** already exists. Windows 8.x did not support DevicePassword policy. When disabling **DevicePasswordEnabled** (1) then this should be the only policy set from the DeviceLock group of policies listed below: > - **DevicePasswordEnabled** is the parent policy of the following: -> - AllowSimpleDevicePassword -> - MinDevicePasswordLength -> - AlphanumericDevicePasswordRequired -> - MinDevicePasswordComplexCharacters  -> - DevicePasswordExpiration -> - DevicePasswordHistory +> - AllowSimpleDevicePassword +> - MinDevicePasswordLength +> - AlphanumericDevicePasswordRequired +> - MinDevicePasswordComplexCharacters  +> - DevicePasswordExpiration +> - DevicePasswordHistory > - MaxDevicePasswordFailedAttempts > - MaxInactivityTimeDeviceLock @@ -1207,54 +1207,6 @@ Most restricted value is 0. - - - - -## DeviceLock policies supported by HoloLens 2 - -- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordExpiration](#devicelock-devicepasswordexpiration) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) - - - - -## DeviceLock policies supported by HoloLens (1st gen) Commercial Suite - -- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) - - - -## DeviceLock policies supported by HoloLens (1st gen) Development Edition - -- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) - - -
                        Footnotes: @@ -1265,3 +1217,5 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index e6bdb26828..1bda716377 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -349,12 +349,14 @@ To validate on Desktop, do the following:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-dmaguard.md b/windows/client-management/mdm/policy-csp-dmaguard.md index 84edbd082b..da361d9226 100644 --- a/windows/client-management/mdm/policy-csp-dmaguard.md +++ b/windows/client-management/mdm/policy-csp-dmaguard.md @@ -105,14 +105,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 75f755f4fb..56e547eb48 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -182,12 +182,14 @@ The policy value is expected to be a `````` seperated list of printer na
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md index 606cfc2ceb..255d2c5715 100644 --- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md +++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md @@ -325,12 +325,14 @@ The default value is an empty string. Otherwise, the value should contain a URL.
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md index d498c385d6..c1dd1a8584 100644 --- a/windows/client-management/mdm/policy-csp-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-errorreporting.md @@ -364,12 +364,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md index a12bf88937..c12aeb4299 100644 --- a/windows/client-management/mdm/policy-csp-eventlogservice.md +++ b/windows/client-management/mdm/policy-csp-eventlogservice.md @@ -287,12 +287,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 7e61e7696e..f3f3c0854d 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -1639,28 +1639,6 @@ Supported values: - - - - -## Experience policies supported by HoloLens 2 - -- [Experience/AllowCortana](#experience-allowcortana) -- [Experience/AllowManualMDMUnenrollment](#experience-allowmanualmdmunenrollment) - - - -## Experience policies supported by HoloLens (1st gen) Commercial Suite - -- [Experience/AllowCortana](#experience-allowcortana) - - - -## Experience policies supported by HoloLens (1st gen) Development Edition - -- [Experience/AllowCortana](#experience-allowcortana) - -
                        Footnotes: @@ -1671,3 +1649,4 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index 8e0abebf9d..bd99331c3a 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -65,7 +65,7 @@ manager: dansimp -Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see [Protect devices from exploits with Windows Defender Exploit Guard](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard) and [Import, export, and deploy Exploit Protection configurations](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml). +Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see [Protect devices from exploits](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/exploit-protection) and [Import, export, and deploy Exploit Protection configurations](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml). The system settings require a reboot; the application settings do not require a reboot. @@ -109,12 +109,14 @@ Here is an example:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md index f2666b4442..20df4e5b6a 100644 --- a/windows/client-management/mdm/policy-csp-fileexplorer.md +++ b/windows/client-management/mdm/policy-csp-fileexplorer.md @@ -146,12 +146,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-games.md b/windows/client-management/mdm/policy-csp-games.md index 750f00f237..7160e21904 100644 --- a/windows/client-management/mdm/policy-csp-games.md +++ b/windows/client-management/mdm/policy-csp-games.md @@ -78,12 +78,14 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md index 12cb543539..752f2010f7 100644 --- a/windows/client-management/mdm/policy-csp-handwriting.md +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -92,12 +92,14 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index d13267b269..e77d5a4eb3 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -13428,7 +13428,7 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T ADMX Info: -- GP English name: *Remove "Run this time" button for outdated ActiveX controls in Internet Explorer * +- GP English name: *Remove "Run this time" button for outdated ActiveX controls in Internet Explorer* - GP name: *VerMgmtDisableRunThisTime* - GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* - GP ADMX file name: *inetres.admx* @@ -16504,7 +16504,7 @@ Also, see the "Security zones: Do not allow users to change policies" policy. ADMX Info: -- GP English name: *Security Zones: Use only machine settings * +- GP English name: *Security Zones: Use only machine settings* - GP name: *Security_HKLM_only* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -17427,38 +17427,6 @@ ADMX Info: - - - - - - - - - - - - -## InternetExplorer policies supported by IoT Core - -- [InternetExplorer/DisableActiveXVersionListAutoDownload](#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableCompatView](#internetexplorer-disablecompatview) -- [InternetExplorer/DisableGeolocation](#internetexplorer-disablegeolocation) - - - -## InternetExplorer policies supported by IoT Enterprise - -- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](#internetexplorer-allowenhancedsuggestionsinaddressbar) -- [InternetExplorer/DisableActiveXVersionListAutoDownload](#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableCompatView](#internetexplorer-disablecompatview) -- [InternetExplorer/DisableFeedsBackgroundSync](#internetexplorer-disablefeedsbackgroundsync) -- [InternetExplorer/DisableGeolocation](#internetexplorer-disablegeolocation) -- [InternetExplorer/DisableWebAddressAutoComplete](#internetexplorer-disablewebaddressautocomplete) -- [InternetExplorer/NewTabDefaultPage](#internetexplorer-newtabdefaultpage) - - -
                        Footnotes: @@ -17469,3 +17437,7 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + + + + diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index 2df8f06e1a..58ad5ba29e 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -416,14 +416,14 @@ Devices joined to Azure Active Directory in a hybrid environment need to interac
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 99fb4e9a1b..351f5e5e34 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -370,12 +370,14 @@ The value is an int 1-1440 that specifies the amount of minutes the session is i
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-lanmanworkstation.md index d185745718..28ed33797b 100644 --- a/windows/client-management/mdm/policy-csp-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-lanmanworkstation.md @@ -88,12 +88,14 @@ This setting supports a range of values between 0 and 1.
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index 4c7c69815e..c933be9fb3 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -147,12 +147,14 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index ec391230a3..74c59adcec 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -3460,14 +3460,14 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index 0f90b19790..b775445fbd 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -88,12 +88,14 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md index 1028e204b8..7cb5bf15bc 100644 --- a/windows/client-management/mdm/policy-csp-maps.md +++ b/windows/client-management/mdm/policy-csp-maps.md @@ -145,12 +145,14 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md index b2efd6a840..745d653627 100644 --- a/windows/client-management/mdm/policy-csp-messaging.md +++ b/windows/client-management/mdm/policy-csp-messaging.md @@ -198,12 +198,14 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md index 4e53332f72..acea48e305 100644 --- a/windows/client-management/mdm/policy-csp-mssecurityguide.md +++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md @@ -372,12 +372,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index 722b58c97c..ec20518e9d 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -256,12 +256,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index 9404b184fc..aac7ebd8b6 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -477,12 +477,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index 1624dfe21f..638cc7018d 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -237,12 +237,14 @@ Validation:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 643ff5cea3..5b5da040da 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -1561,8 +1561,6 @@ Default value for unattended sleep timeout (plugged in): - -
                        Footnotes: @@ -1573,3 +1571,6 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + + + diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index 16470df06b..7220444c6a 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -261,12 +261,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index 65dea5a83d..d2d5b890fa 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -5241,49 +5241,6 @@ ADMX Info: - - - - -## Privacy policies supported by HoloLens 2 - -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) -- [LetAppsAccessAccountInfo](#privacy-letappsaccessaccountinfo) -- [LetAppsAccessAccountInfo_ForceAllowTheseApps](#privacy-letappsaccessaccountinfo-forceallowtheseapps) -- [LetAppsAccessAccountInfo_ForceDenyTheseApps](#privacy-letappsaccessaccountinfo-forcedenytheseapps) -- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](#privacy-letappsaccessaccountinfo-userincontroloftheseapps) -- [LetAppsAccessBackgroundSpatialPerception](#privacy-letappsaccessbackgroundspatialperception) -- [LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps](#privacy-letappsaccessbackgroundspatialperception-forceallowtheseapps) -- [LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps](#privacy-letappsaccessbackgroundspatialperception-forcedenytheseapps) -- [LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps](#privacy-letappsaccessbackgroundspatialperception-userincontroloftheseapps) -- [Privacy/LetAppsAccessCamera](#privacy-letappsaccesscamera) -- [Privacy/LetAppsAccessLocation](#privacy-letappsaccesslocation) -- [Privacy/LetAppsAccessMicrophone](#privacy-letappsaccessmicrophone) - - - -## Privacy policies supported by HoloLens (1st gen) Commercial Suite - -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) - - - -## Privacy policies supported by HoloLens (1st gen) Development Edition - -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) - - -## Privacy policies supported by Windows 10 IoT Core -- [Privacy/LetAppsActivateWithVoice](#privacy-letappsactivatewithvoice) -- [Privacy/LetAppsActivateWithVoiceAboveLock](#privacy-letappsactivatewithvoiceabovelock) - - - -## Privacy policies supported by Windows 10 IoT Enterprise -- [Privacy/LetAppsActivateWithVoice](#privacy-letappsactivatewithvoice) -- [Privacy/LetAppsActivateWithVoiceAboveLock](#privacy-letappsactivatewithvoiceabovelock) - -
                        Footnotes: @@ -5294,3 +5251,5 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + + diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index 338d517c12..c6e88e8bc0 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -336,12 +336,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index c9c9ba51bf..3f901d522c 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -447,12 +447,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md index ba8a7d6310..8d76918842 100644 --- a/windows/client-management/mdm/policy-csp-remotemanagement.md +++ b/windows/client-management/mdm/policy-csp-remotemanagement.md @@ -365,7 +365,7 @@ If you disable or do not configure this policy setting, the WinRM service will n The service listens on the addresses specified by the IPv4 and IPv6 filters. The IPv4 filter specifies one or more ranges of IPv4 addresses, and the IPv6 filter specifies one or more ranges of IPv6addresses. If specified, the service enumerates the available IP addresses on the computer and uses only addresses that fall within one of the filter ranges. -You should use an asterisk (*) to indicate that the service listens on all available IP addresses on the computer. When * is used, other ranges in the filter are ignored. If the filter is left blank, the service does not listen on any addresses. +You should use an asterisk (\*) to indicate that the service listens on all available IP addresses on the computer. When \* is used, other ranges in the filter are ignored. If the filter is left blank, the service does not listen on any addresses. For example, if you want the service to listen only on IPv4 addresses, leave the IPv6 filter empty. @@ -1029,12 +1029,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md index ade921ae21..48ec861646 100644 --- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md +++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md @@ -171,12 +171,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md index 21cfd117d2..6bf43c0535 100644 --- a/windows/client-management/mdm/policy-csp-remoteshell.md +++ b/windows/client-management/mdm/policy-csp-remoteshell.md @@ -484,12 +484,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 2ee10fa612..0ca2dc4914 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -52,12 +52,6 @@ manager: dansimp -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. @@ -132,15 +126,23 @@ Here is an example: ``` + +> [!Note] +> * You should include the local administrator while modifying the administrators group to prevent accidental loss of access +> * Include the entire UPN after AzureAD
                        +Footnotes: -Take note: -* You should include the local administrator while modifying the administrators group to prevent accidental loss of access -* Include the entire UPN after AzureAD - +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index f551f810e3..d1b35bda00 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -918,27 +918,6 @@ The following list shows the supported values: - - - - -## Search policies supported by HoloLens 2 - -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) - - - -## Search policies supported by HoloLens (1st gen) Commercial Suite - -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) - - - -## Search policies supported by HoloLens (1st gen) Development Edition - -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) - -
                        Footnotes: @@ -949,3 +928,5 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index 22bddbe478..5018d1a105 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -741,27 +741,6 @@ The following list shows the supported values: - - - - -## Security policies supported by HoloLens 2 - -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) - - - -## Security policies supported by HoloLens (1st gen) Commercial Suite - -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) - - - -## Security policies supported by HoloLens (1st gen) Development Edition - -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) - -
                        Footnotes: @@ -772,3 +751,4 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md index 9ce3ab68b9..15a529a427 100644 --- a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -1,7 +1,7 @@ --- title: Policy CSP - ServiceControlManager description: Policy CSP - ServiceControlManager -ms.author: Heidi.Lohr +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index 81727ffef1..bfd4bd4760 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -806,11 +806,11 @@ If the policy is not specified, the behavior will be that no pages are affected. The format of the PageVisibilityList value is as follows: -- The value is a unicode string up to 10,000 characters long, which will be used without case sensitivity. -- There are two variants: one that shows only the given pages and one which hides the given pages. -- The first variant starts with the string "showonly:" and the second with the string "hide:". -- Following the variant identifier is a semicolon-delimited list of page identifiers, which must not have any extra whitespace. -- Each page identifier is the ms-settings:xyz URI for the page, minus the ms-settings: prefix, so the identifier for the page with URI "ms-settings:network-wifi" would be just "network-wifi". +- The value is a unicode string up to 10,000 characters long, which will be used without case sensitivity. +- There are two variants: one that shows only the given pages and one which hides the given pages. +- The first variant starts with the string "showonly:" and the second with the string "hide:". +- Following the variant identifier is a semicolon-delimited list of page identifiers, which must not have any extra whitespace. +- Each page identifier is the ms-settings:xyz URI for the page, minus the ms-settings: prefix, so the identifier for the page with URI "ms-settings:network-wifi" would be just "network-wifi". The default value for this setting is an empty string, which is interpreted as show everything. @@ -841,30 +841,6 @@ To validate on Desktop, do the following: - - - - -## Settings policies supported by HoloLens 2 - -- [Settings/AllowDateTime](#settings-allowdatetime) -- [Settings/AllowVPN](#settings-allowvpn) - - - -## Settings policies supported by HoloLens (1st gen) Commercial Suite - -- [Settings/AllowDateTime](#settings-allowdatetime) -- [Settings/AllowVPN](#settings-allowvpn) - - - -## Settings policies supported by HoloLens (1st gen) Development Edition - -- [Settings/AllowDateTime](#settings-allowdatetime) -- [Settings/AllowVPN](#settings-allowvpn) - -
                        Footnotes: @@ -875,3 +851,4 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index 333716f687..2ecdcf1777 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -212,12 +212,14 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index 0f385479cb..1897316311 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -84,27 +84,6 @@ The following list shows the supported values: - - - - -## Speech policies supported by HoloLens 2 - -- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) - - - -## Speech policies supported by HoloLens (1st gen) Commercial Suite - -- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) - - - -## Speech policies supported by HoloLens (1st gen) Development Edition - -- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) - -
                        Footnotes: @@ -115,3 +94,4 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 05e37d1dc9..bd12c8d9b7 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -1856,14 +1856,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 02d36e60d9..09a9bad5ae 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -654,18 +654,16 @@ ADMX Info: - -
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index af2069854f..eade9cb700 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -1068,7 +1068,7 @@ If you disable or don't configure this policy setting, the Delete diagnostic dat ADMX Info: -- GP English name: *Disable deleting diagnostic data * +- GP English name: *Disable deleting diagnostic data* - GP name: *DisableDeviceDelete* - GP element: *DisableDeviceDelete* - GP path: *Data Collection and Preview Builds* @@ -1131,7 +1131,7 @@ If you disable or don't configure this policy setting, the Diagnostic Data Viewe ADMX Info: -- GP English name: *Disable diagnostic data viewer. * +- GP English name: *Disable diagnostic data viewer.* - GP name: *DisableDiagnosticDataViewer* - GP element: *DisableDiagnosticDataViewer* - GP path: *Data Collection and Preview Builds* @@ -1578,32 +1578,6 @@ The following list shows the supported values: - - - - -## System policies supported by HoloLens 2 - -- [System/AllowCommercialDataPipeline](#system-allowcommercialdatapipeline) -- [System/AllowLocation](#system-allowlocation) -- [System/AllowStorageCard](#system-allowstoragecard) -- [System/AllowTelemetry](#system-allowtelemetry) - - - -## System policies supported by HoloLens (1st gen) Commercial Suite - -- [System/AllowLocation](#system-allowlocation) -- [System/AllowTelemetry](#system-allowtelemetry) - - - -## System policies supported by HoloLens (1st gen) Development Edition - -- [System/AllowLocation](#system-allowlocation) -- [System/AllowTelemetry](#system-allowtelemetry) - -
                        Footnotes: @@ -1614,3 +1588,5 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index 1b98e5a487..94edf1165e 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -336,12 +336,14 @@ GP Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md index 5e4b03fa34..eab903e15a 100644 --- a/windows/client-management/mdm/policy-csp-taskmanager.md +++ b/windows/client-management/mdm/policy-csp-taskmanager.md @@ -70,8 +70,8 @@ manager: dansimp This setting determines whether non-administrators can use Task Manager to end tasks. Value type is integer. Supported values: - - 0 - Disabled. EndTask functionality is blocked in TaskManager. - - 1 - Enabled (default). Users can perform EndTask in TaskManager. +- 0 - Disabled. EndTask functionality is blocked in TaskManager. +- 1 - Enabled (default). Users can perform EndTask in TaskManager. @@ -89,14 +89,14 @@ When the policy is set to 0 - users CANNOT execute 'End task' on processes in Ta
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index ca2b448d50..c289a0638d 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -70,12 +70,14 @@ Added in Windows 10, version 1803. This setting determines whether the specific
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index ce3e59ecc4..dd9948d56b 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -1330,30 +1330,13 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. - - - - -## TextInput policies supported by Microsoft Surface Hub - -- [TextInput/AllowIMELogging](#textinput-allowimelogging) -- [TextInput/AllowIMENetworkAccess](#textinput-allowimenetworkaccess) -- [TextInput/AllowInputPanel](#textinput-allowinputpanel) -- [TextInput/AllowJapaneseIMESurrogatePairCharacters](#textinput-allowjapaneseimesurrogatepaircharacters) -- [TextInput/AllowJapaneseIVSCharacters](#textinput-allowjapaneseivscharacters) -- [TextInput/AllowJapaneseNonPublishingStandardGlyph](#textinput-allowjapanesenonpublishingstandardglyph) -- [TextInput/AllowJapaneseUserDictionary](#textinput-allowjapaneseuserdictionary) -- [TextInput/AllowLanguageFeaturesUninstall](#textinput-allowlanguagefeaturesuninstall) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208](#textinput-excludejapaneseimeexceptjis0208) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](#textinput-excludejapaneseimeexceptjis0208andeudc) -- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](#textinput-excludejapaneseimeexceptshiftjis) - +- 6 - Added in Windows 10, version 1903. + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index 5feefe04ae..025ea3bdfd 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -130,9 +130,6 @@ Specifies the time zone to be applied to the device. This is the standard Window - - -
                        Footnotes: @@ -142,4 +139,6 @@ Footnotes: - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in Windows 10, version 1903. \ No newline at end of file +- 6 - Added in Windows 10, version 1903. + + diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md index ec68e060bc..082308817e 100644 --- a/windows/client-management/mdm/policy-csp-troubleshooting.md +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -1,7 +1,7 @@ --- title: Policy CSP - Troubleshooting description: Policy CSP - Troubleshooting -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 92367a4c2e..86359678c2 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 05/21/2019 +ms.date: 08/16/2019 ms.reviewer: manager: dansimp --- @@ -1053,7 +1053,7 @@ Supported values: -Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from. +Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from. As of 1903, the branch readiness levels of Semi-Annual Channel (Targeted) and Semi-Annual Channel have been combined into one Semi-Annual Channel set with a value of 16. For devices on 1903 and later releases, the value of 32 is not a supported value. @@ -1071,8 +1071,8 @@ The following list shows the supported values: - 2 {0x2} - Windows Insider build - Fast (added in Windows 10, version 1709) - 4 {0x4} - Windows Insider build - Slow (added in Windows 10, version 1709) - 8 {0x8} - Release Windows Insider build (added in Windows 10, version 1709) -- 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted). -- 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. +- 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted). +- 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. (*Only applicable to releases prior to 1903, for all releases 1903 and after the Semi-annual Channel and Semi-annual Channel (Targeted) into a single Semi-annual Channel with a value of 16) @@ -2418,13 +2418,11 @@ The following list shows the supported values: To validate this policy: -1. Enable the policy ensure the device is on a cellular network. +1. Enable the policy and ensure the device is on a cellular network. 2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: - - `regd delete HKEY_USERS\S-1-5-21-2702878673-795188819-444038987-2781\software\microsoft\windows\currentversion\windowsupdate /v LastAutoAppUpdateSearchSuccessTime /f` - - - `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\Automatic App Update"""" /I""` - -3. Verify that any downloads that are above the download size limit will complete without being paused. + ```TShell + exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' + ``` @@ -2472,11 +2470,6 @@ Added in Windows 10, version 1703. Specifies whether to ignore the MO download > [!WARNING] > Setting this policy might cause devices to incur costs from MO operators. - - - `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\AUScheduledInstall"""" /I""` - -3. Verify that any downloads that are above the download size limit will complete without being paused. - The following list shows the supported values: @@ -2489,7 +2482,10 @@ The following list shows the supported values: To validate this policy: 1. Enable the policy and ensure the device is on a cellular network. -2. Run the scheduled task on phone to check for OS updates in the background. For example, on a mobile device, run the following commands in TShell: +2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: + ```TShell + exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' + ``` @@ -3874,20 +3870,20 @@ The following list shows the supported values: Example -``` syntax - - $CmdID$ - - - chr - text/plain - - - ./Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl - - http://abcd-srv:8530 - - +```xml + + $CmdID$ + + + chr + text/plain + + + ./Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl + + http://abcd-srv:8530 + + ``` @@ -3955,69 +3951,6 @@ ADMX Info: - - - - -## Update policies supported by HoloLens 2 - -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/BranchReadinessLevel](#update-branchreadinesslevel) -- [Update/DeferFeatureUpdatesPeriodInDays](#update-deferfeatureupdatesperiodindays) -- [Update/DeferQualityUpdatesPeriodInDays](#update-deferqualityupdatesperiodindays) -- [Update/ManagePreviewBuilds](#update-managepreviewbuilds) -- [Update/PauseFeatureUpdates](#update-pausefeatureupdates) -- [Update/PauseQualityUpdates](#update-pausequalityupdates) -- [Update/ScheduledInstallDay](#update-scheduledinstallday) -- [Update/ScheduledInstallTime](#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](#update-updateserviceurl) - - - - -## Update policies supported by HoloLens (1st gen) Commercial Suite - -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) -- [Update/RequireUpdateApproval](#update-requireupdateapproval) -- [Update/ScheduledInstallDay](#update-scheduledinstallday) -- [Update/ScheduledInstallTime](#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](#update-updateserviceurl) - - - - -## Update policies supported by HoloLens (1st gen) Development Edition - -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) -- [Update/RequireUpdateApproval](#update-requireupdateapproval) -- [Update/ScheduledInstallDay](#update-scheduledinstallday) -- [Update/ScheduledInstallTime](#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](#update-updateserviceurl) - - - - -## Update policies supported by IoT Core - -- [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) -- [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates) -- [Update/ConfigureDeadlineGracePeriod](#update-configuredeadlinegraceperiod) -- [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot) - - - -## Update policies supported by IoT Enterprise - -- [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) -- [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates) -- [Update/ConfigureDeadlineGracePeriod](#update-configuredeadlinegraceperiod) -- [Update/ConfigureDeadlineNoAutoReboot](#update-configuredeadlinenoautoreboot) -
                        Footnotes: @@ -4028,3 +3961,4 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index bf7b2a8067..0676a9df9c 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -1600,12 +1600,14 @@ GP Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 9bc832c1ff..9e5e7bac19 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -381,49 +381,6 @@ Supported operations are Add, Delete, Get, and Replace. - - - - -## Wifi policies that can be set using Exchange Active Sync (EAS) - -- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](#wifi-allowwifi) - - - -## Wifi policies supported by HoloLens 2 - -- [Wifi/AllowManualWiFiConfiguration](#wifi-allowmanualwificonfiguration) - - - -## Wifi policies supported by HoloLens (1st gen) Commercial Suite - -- [Wifi/AllowManualWiFiConfiguration](#wifi-allowmanualwificonfiguration) - - - -## Wifi policies supported by HoloLens (1st gen) Development Edition - -- [Wifi/AllowManualWiFiConfiguration](#wifi-allowmanualwificonfiguration) - - - -## Wifi policies supported by IoT Core - -- [Wifi/AllowAutoConnectToWiFiSenseHotspots](#wifi-allowautoconnecttowifisensehotspots) -- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](#wifi-allowwifi) -- [Wifi/WLANScanMode](#wifi-wlanscanmode) - - - -## Wifi policies supported by Microsoft Surface Hub - -- [WiFi/AllowWiFiHotSpotReporting](#wifi-allowwifihotspotreporting) - -
                        Footnotes: @@ -434,3 +391,4 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index 6824a34e5c..0888c1a02a 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -97,12 +97,13 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - - + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index cc8580325d..f851afd08e 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -1426,14 +1426,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index ca2a0c7b72..d20bb37601 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -149,12 +149,14 @@ Value type is int. The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index dd40314d62..a8e9418f2e 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -544,9 +544,6 @@ To validate on Desktop, do the following: - - -
                        Footnotes: @@ -557,3 +554,6 @@ Footnotes: - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. - 6 - Added in Windows 10, version 1903. + + + diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index 9e2d0223b5..69eb80be17 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -94,12 +94,14 @@ ADMX Info:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 1ba5d5ec2d..e8bdaab780 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -473,12 +473,14 @@ The following list shows the supported values:
                        -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/remotelock-csp.md b/windows/client-management/mdm/remotelock-csp.md index ea985de378..3ea4ca8ee0 100644 --- a/windows/client-management/mdm/remotelock-csp.md +++ b/windows/client-management/mdm/remotelock-csp.md @@ -117,7 +117,7 @@ A Get operation on this node must follow an Exec operation on the /RemoteLock/Lo Initiate a remote lock of the device. -``` syntax +```xml 1 @@ -130,7 +130,7 @@ Initiate a remote lock of the device. Initiate a remote lock and PIN reset of the device. To successfully retrieve the new device-generated PIN, the commands must be executed together and in the proper sequence as shown below. -``` syntax +```xml 1 diff --git a/windows/client-management/mdm/remotering-csp.md b/windows/client-management/mdm/remotering-csp.md index 21149dd08e..726df442f0 100644 --- a/windows/client-management/mdm/remotering-csp.md +++ b/windows/client-management/mdm/remotering-csp.md @@ -31,14 +31,14 @@ The supported operation is Exec. The following sample shows how to initiate a remote ring on the device. -``` syntax +```xml - 5 - - - ./Vendor/MSFT/RemoteRing/Ring - - + 5 + + + ./Vendor/MSFT/RemoteRing/Ring + + ``` diff --git a/windows/client-management/mdm/reporting-csp.md b/windows/client-management/mdm/reporting-csp.md index 44828e2d90..1f1391ff33 100644 --- a/windows/client-management/mdm/reporting-csp.md +++ b/windows/client-management/mdm/reporting-csp.md @@ -81,7 +81,7 @@ Supported operations are Get and Replace. Retrieve all available Windows Information Protection (formerly known as Enterprise Data Protection) logs starting from the specified StartTime. -``` syntax +```xml @@ -104,7 +104,7 @@ Retrieve all available Windows Information Protection (formerly known as Enterpr Retrieve a specified number of security auditing logs starting from the specified StartTime. -``` syntax +```xml diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md index 91478addbe..9b8b3ce65d 100644 --- a/windows/client-management/mdm/securitypolicy-csp.md +++ b/windows/client-management/mdm/securitypolicy-csp.md @@ -199,7 +199,7 @@ The following security roles are supported. Setting a security policy: -``` syntax +```xml @@ -209,7 +209,7 @@ Setting a security policy: Querying a security policy: -``` syntax +```xml @@ -222,7 +222,7 @@ Querying a security policy: Setting a security policy: -``` syntax +```xml … @@ -245,7 +245,7 @@ Setting a security policy: Querying a security policy: -``` syntax +```xml … diff --git a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md index 7791fe19fd..0e0293bca8 100644 --- a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md +++ b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md @@ -53,7 +53,7 @@ The following table shows the OMA DM versions that are supported. The following example shows the general structure of the XML document sent by the server using OMA DM version 1.2.1 for demonstration purposes only. The initial XML packages exchanged between client and server could contain additional XML tags. For a detailed description and samples for those packages, see the [OMA Device Management Protocol 1.2.1](https://go.microsoft.com/fwlink/p/?LinkId=526902) specification. -``` syntax +```xml 1.2 @@ -107,7 +107,7 @@ The following example shows the header component of a DM message. In this case,   -``` syntax +```xml 1.2 DM/1.2 @@ -130,7 +130,7 @@ SyncBody contains one or more DM commands. The SyncBody can contain multiple DM The following example shows the body component of a DM message. In this example, SyncBody contains only one command, Get. This is indicated by the <Final /> tag that occurs immediately after the terminating tag for the Get command. -``` syntax +```xml @@ -157,7 +157,7 @@ The Replace command is used to update a device setting. The following example illustrates how to use the Replace command to update a device setting. -``` syntax +```xml 1.2 DM/1.2 diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md index ded1d293de..09ea7f32d0 100644 --- a/windows/client-management/mdm/supl-csp.md +++ b/windows/client-management/mdm/supl-csp.md @@ -481,7 +481,7 @@ Adding a SUPL and a V2 UPL account to the same device. Values in italic must be Adding a SUPL account to a device. Values in italic must be replaced with correct settings for the mobile operator network. A valid binary blob must be included for the root certificate data value. -``` syntax +```xml diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index 50b1862e82..fcb23c170c 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -39,52 +39,52 @@ The following diagram shows the SurfaceHub CSP management objects in tree format

                        Here's a SyncML example. -``` syntax - - - - 1 - - - ./Vendor/MSFT/SurfaceHub/DeviceAccount/UserPrincipalName - - - chr - - user@contoso.com - - - - 2 - - - ./Vendor/MSFT/SurfaceHub/DeviceAccount/Password - - - chr - - password - - - - 3 - - - ./Vendor/MSFT/SurfaceHub/DeviceAccount/ValidateAndCommit - - - - - 4 - - - ./Vendor/MSFT/SurfaceHub/DeviceAccount/ErrorContext - - - - - - +```xml + + + + 1 + + + ./Vendor/MSFT/SurfaceHub/DeviceAccount/UserPrincipalName + + + chr + + user@contoso.com + + + + 2 + + + ./Vendor/MSFT/SurfaceHub/DeviceAccount/Password + + + chr + + password + + + + 3 + + + ./Vendor/MSFT/SurfaceHub/DeviceAccount/ValidateAndCommit + + + + + 4 + + + ./Vendor/MSFT/SurfaceHub/DeviceAccount/ErrorContext + + + + + + ```

                        To use a device account from Active Directory diff --git a/windows/client-management/mdm/tpmpolicy-csp.md b/windows/client-management/mdm/tpmpolicy-csp.md index e546efa7f6..36f46f9df1 100644 --- a/windows/client-management/mdm/tpmpolicy-csp.md +++ b/windows/client-management/mdm/tpmpolicy-csp.md @@ -37,20 +37,20 @@ The following diagram shows the TPMPolicy configuration service provider in tree Here is an example: -``` syntax - - 101 - - - - ./Vendor/MSFT/TpmPolicy/IsActiveZeroExhaust - - - - bool - text/plain - - true - - +```xml + + 101 + + + + ./Vendor/MSFT/TpmPolicy/IsActiveZeroExhaust + + + + bool + text/plain + + true + + ``` diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index 233e581a91..33001ff094 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -23,8 +23,8 @@ In addition to standard policies, the Policy CSP can now also handle ADMX-backed ADMX files can either describe operating system (OS) Group Policies that are shipped with Windows or they can describe settings of applications, which are separate from the OS and can usually be downloaded and installed on a PC. Depending on the specific category of the settings that they control (OS or application), the administrative template settings are found in the following two locations in the Local Group Policy Editor: -- OS settings: Computer Configuration/Administrative Templates -- Application settings: User Configuration/Administrative Templates +- OS settings: Computer Configuration/Administrative Templates +- Application settings: User Configuration/Administrative Templates In a domain controller/Group Policy ecosystem, Group Policies are automatically added to the registry of the client computer or user profile by the Administrative Templates Client Side Extension (CSE) whenever the client computer processes a Group Policy. Conversely, in an MDM-managed client, ADMX files are leveraged to define policies independent of Group Policies. Therefore, in an MDM-managed client, a Group Policy infrastructure, including the Group Policy Service (gpsvc.exe), is not required. @@ -42,17 +42,17 @@ To capture the end-to-end MDM handling of ADMX Group Policies, an IT administrat The ADMX file that the MDM ISV uses to determine what UI to display to the IT administrator is the same ADMX file that the client uses for the policy definition. The ADMX file is processed either by the OS at build time or set by the client at OS runtime. In either case, the client and the MDM ISV must be synchronized with the ADMX policy definitions. Each ADMX file corresponds to a Group Policy category and typically contains several policy definitions, each of which represents a single Group Policy. For example, the policy definition for the “Publishing Server 2 Settings” is contained in the appv.admx file, which holds the policy definitions for the Microsoft Application Virtualization (App-V) Group Policy category. Group Policy option button setting: -- If **Enabled** is selected, the necessary data entry controls are displayed for the user in the UI. When IT administrator enters the data and clicks **Apply**, the following events occur: - - The MDM ISV server sets up a Replace SyncML command with a payload that contains the user-entered data. - - The MDM client stack receives this data, which causes the Policy CSP to update the device’s registry per the ADMX-backed policy definition. +- If **Enabled** is selected, the necessary data entry controls are displayed for the user in the UI. When IT administrator enters the data and clicks **Apply**, the following events occur: + - The MDM ISV server sets up a Replace SyncML command with a payload that contains the user-entered data. + - The MDM client stack receives this data, which causes the Policy CSP to update the device’s registry per the ADMX-backed policy definition. -- If **Disabled** is selected and you click **Apply**, the following events occur: - - The MDM ISV server sets up a Replace SyncML command with a payload set to ``. - - The MDM client stack receives this command, which causes the Policy CSP to either delete the device’s registry settings, set the registry keys, or both, per the state change directed by the ADMX-backed policy definition. +- If **Disabled** is selected and you click **Apply**, the following events occur: + - The MDM ISV server sets up a Replace SyncML command with a payload set to ``. + - The MDM client stack receives this command, which causes the Policy CSP to either delete the device’s registry settings, set the registry keys, or both, per the state change directed by the ADMX-backed policy definition. -- If **Not Configured** is selected and you click **Apply**, the following events occur: - - MDM ISV server sets up a Delete SyncML command. - - The MDM client stack receives this command, which causes the Policy CSP to delete the device’s registry settings per the ADMX-backed policy definition. +- If **Not Configured** is selected and you click **Apply**, the following events occur: + - MDM ISV server sets up a Delete SyncML command. + - The MDM client stack receives this command, which causes the Policy CSP to delete the device’s registry settings per the ADMX-backed policy definition. The following diagram shows the main display for the Group Policy Editor. diff --git a/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md b/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md index 300711d733..5bdd2eaf0f 100644 --- a/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md +++ b/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md @@ -50,17 +50,17 @@ New-CimInstance -Namespace $namespaceName -ClassName $className -Property @{Pare Get-CimInstance -Namespace $namespaceName -ClassName $className # Query instances with matching properties -Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" +Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" # Modify existing instance -$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" +$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" $obj.WLANScanMode=500 Set-CimInstance -CimInstance $obj # Delete existing instance try { - $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" + $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" Remove-CimInstance -CimInstance $obj } catch [Exception] @@ -113,9 +113,9 @@ $session = New-CimSession # Create a new instance for MDM_Policy_User_Config01_Authentication02 ########################################################################## $newInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") $newInstance.CimInstanceProperties.Add($property) -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") $newInstance.CimInstanceProperties.Add($property) $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("AllowEAPCertSSO", 1, "Sint32", "Property") $newInstance.CimInstanceProperties.Add($property) @@ -138,9 +138,9 @@ $session.EnumerateInstances($namespaceName, $className, $options) # with matching properties ########################################################################## $getInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") $getInstance.CimInstanceProperties.Add($property) -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") $getInstance.CimInstanceProperties.Add($property) try { @@ -155,9 +155,9 @@ catch [Exception] # Modify existing instance for MDM_Policy_User_Config01_Authentication02 ########################################################################## $getInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") $getInstance.CimInstanceProperties.Add($property) -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") $getInstance.CimInstanceProperties.Add($property) try { @@ -174,9 +174,9 @@ catch [Exception] # Delete existing instance for MDM_Policy_User_Config01_Authentication02 ########################################################################## $getInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") $getInstance.CimInstanceProperties.Add($property) -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") $getInstance.CimInstanceProperties.Add($property) try { @@ -209,7 +209,7 @@ $params.Add($param) try { - $instance = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT' and InstanceID='WindowsLicensing'" + $instance = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT' and InstanceID='WindowsLicensing'" $session.InvokeMethod($namespaceName, $instance, $methodName, $params) } catch [Exception] diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md index 5fa7655902..fa5597ecf6 100644 --- a/windows/client-management/mdm/vpnv2-csp.md +++ b/windows/client-management/mdm/vpnv2-csp.md @@ -598,7 +598,7 @@ Value type is bool. Supported operations include Get, Add, Replace, and Delete. Profile example -``` syntax +```xml @@ -657,244 +657,241 @@ Profile example AppTriggerList -``` syntax +```xml - - 10013 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/0/App/Id - - %PROGRAMFILES%\Internet Explorer\iexplore.exe - - - - 10014 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/1/App/Id - - %PROGRAMFILES% (x86)\Internet Explorer\iexplore.exe - - - - - 10015 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/2/App/Id - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - + + 10013 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/0/App/Id + + %PROGRAMFILES%\Internet Explorer\iexplore.exe + + + + 10014 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/1/App/Id + + %PROGRAMFILES% (x86)\Internet Explorer\iexplore.exe + + + + + 10015 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/2/App/Id + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + ``` RouteList and ExclusionRoute -``` syntax - - - 10008 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/Address - - 192.168.0.0 - - - - 10009 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/PrefixSize - - - int - - 24 - - - - 10010 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/ExclusionRoute - - - bool - - true - - - +```xml + + 10008 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/Address + + 192.168.0.0 + + + + 10009 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/PrefixSize + + + int + + 24 + + + + 10010 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/ExclusionRoute + + + bool + + true + + ``` DomainNameInformationList -``` syntax - - - - 10013 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DomainName - - .contoso.com - - - - 10014 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DnsServers - - 192.168.0.11,192.168.0.12 - - - +```xml + + + 10013 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DomainName + + .contoso.com + + + + 10014 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DnsServers + + 192.168.0.11,192.168.0.12 + + + - - 10013 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/DomainName - - .contoso.com - - - - - 10015 - - -./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/WebProxyServers - - 192.168.0.100:8888 - - - + + 10013 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/DomainName + + .contoso.com + + + + + 10015 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/WebProxyServers + + 192.168.0.100:8888 + + + - - - 10016 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DomainName - - finance.contoso.com - - - - 10017 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DnsServers - - 192.168.0.11,192.168.0.12 - - - + + + 10016 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DomainName + + finance.contoso.com + + + + 10017 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DnsServers + + 192.168.0.11,192.168.0.12 + + + - - - 10016 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/DomainName - - finance.contoso.com - - - - 10017 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/WebProxyServers - - 192.168.0.11:8080 - - - + + + 10016 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/DomainName + + finance.contoso.com + + + + 10017 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/WebProxyServers + + 192.168.0.11:8080 + + + - - 10016 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DomainName - - . - - - - 10017 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DnsServers - - 192.168.0.11,192.168.0.12 - - - + + 10016 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DomainName + + . + + + + 10017 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DnsServers + + 192.168.0.11,192.168.0.12 + + + - - - 10016 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/DomainName - - . - - - - 10017 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/WebProxyServers - - 192.168.0.11 - - + + + 10016 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/DomainName + + . + + + + 10017 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/WebProxyServers + + 192.168.0.11 + + ``` AutoTrigger -``` syntax +```xml - 10010 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/AutoTrigger - - - bool - - true - - + 10010 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/AutoTrigger + + + bool + + true + + ``` Persistent -``` syntax +```xml - 10010 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/Persistent - - - bool - - true - - + 10010 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/Persistent + + + bool + + true + + ``` TrafficFilterLIst App -``` syntax +```xml Desktop App 10013 @@ -929,7 +926,7 @@ TrafficFilterLIst App Protocol, LocalPortRanges, RemotePortRanges, LocalAddressRanges, RemoteAddressRanges, RoutingPolicyType, EDPModeId, RememberCredentials, AlwaysOn, Lockdown, DnsSuffix, TrustedNetworkDetection -``` syntax +```xml Protocol $CmdID$ @@ -1077,7 +1074,7 @@ Protocol Proxy - Manual or AutoConfigUrl -``` syntax +```xml Manual $CmdID$ @@ -1103,7 +1100,7 @@ Manual Device Compliance - Sso -``` syntax +```xml Enabled 10011 @@ -1143,7 +1140,7 @@ Device Compliance - Sso PluginProfile -``` syntax +```xml PluginPackageFamilyName @@ -1181,7 +1178,7 @@ PluginPackageFamilyName NativeProfile -``` syntax +```xml Servers 10001 diff --git a/windows/client-management/mdm/vpnv2-profile-xsd.md b/windows/client-management/mdm/vpnv2-profile-xsd.md index 2aa15af132..dd82298d1b 100644 --- a/windows/client-management/mdm/vpnv2-profile-xsd.md +++ b/windows/client-management/mdm/vpnv2-profile-xsd.md @@ -23,7 +23,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro ```xml - + @@ -344,7 +344,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro ## Plug-in profile example -``` syntax +```xml testserver1.contoso.com;testserver2.contoso..com diff --git a/windows/client-management/mdm/w7-application-csp.md b/windows/client-management/mdm/w7-application-csp.md index 0a7adafa8c..eff35b4fd4 100644 --- a/windows/client-management/mdm/w7-application-csp.md +++ b/windows/client-management/mdm/w7-application-csp.md @@ -160,7 +160,7 @@ Stores specifies which certificate stores the DM client will search to find the Subject specifies the certificate to search for. For example, to specify that you want a certificate with a particular Subject attribute (“CN=Tester,O=Microsoft”), use the following: -``` syntax +```xml ``` diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 7db7e01ffb..79992abc08 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -121,7 +121,7 @@ These XML examples show how to perform various tasks using OMA DM. The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwork,' a proxy URL 'testproxy,' and port 80. -``` syntax +```xml @@ -160,7 +160,7 @@ The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwor The following example shows how to query Wi-Fi profiles installed on an MDM server. -``` syntax +```xml 301 @@ -173,7 +173,7 @@ The following example shows how to query Wi-Fi profiles installed on an MDM serv The following example shows the response. -``` syntax +```xml 3 1 @@ -190,17 +190,17 @@ The following example shows the response. The following example shows how to remove a network with SSID ‘MyNetwork’ and no proxy. Removing all network authentication types is done in this same manner. -``` syntax +```xml - 300 - - 301 - - - ./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml - - - + 300 + + 301 + + + ./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml + + + ``` @@ -208,21 +208,21 @@ The following example shows how to remove a network with SSID ‘MyNetwork’ an The following example shows how to add PEAP-MSCHAPv2 network with SSID ‘MyNetwork’ and root CA validation for server certificate. -``` syntax +```xml - 300 - - 301 - - - ./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml - - - chr - - MyNetworkMyNetworkfalseESSmanualWPA2AEStrueuser2500025true InsertCertThumbPrintHere truefalse26falsefalsefalsetruefalse - - + 300 + + 301 + + + ./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml + + + chr + + MyNetworkMyNetworkfalseESSmanualWPA2AEStrueuser2500025true InsertCertThumbPrintHere truefalse26falsefalsefalsetruefalse + + ``` diff --git a/windows/client-management/mdm/win32compatibilityappraiser-csp.md b/windows/client-management/mdm/win32compatibilityappraiser-csp.md index f4394c7d54..2570e65b3d 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-csp.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-csp.md @@ -11,7 +11,7 @@ ms.reviewer: manager: dansimp --- -# Win32CompatibilityAppraiser CSP +# Win32CompatibilityAppraiser CSP > [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md index 6ae22efd72..2508fa2863 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md @@ -120,7 +120,7 @@ The following list describes the characteristics and parameters. ## Examples -``` syntax +```xml diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md index 0b9e8aa3aa..7831cfbce6 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md @@ -30,9 +30,9 @@ Interior node. Supported operation is Get. **Settings/AllowWindowsDefenderApplicationGuard** Turn on Windows Defender Application Guard in Enterprise Mode. Value type is integer. Supported operations are Add, Get, Replace, and Delete. - - - 0 - Stops Application Guard in Enterprise Mode. Trying to access non-enterprise domains on the host will not automatically get transferred into the insolated environment. - - 1 - Enables Application Guard in Enterprise Mode. Trying to access non-enterprise websites on the host will automatically get transferred into the container. + +- 0 - Stops Application Guard in Enterprise Mode. Trying to access non-enterprise domains on the host will not automatically get transferred into the insolated environment. +- 1 - Enables Application Guard in Enterprise Mode. Trying to access non-enterprise websites on the host will automatically get transferred into the container. **Settings/ClipboardFileType** Determines the type of content that can be copied from the host to Application Guard environment and vice versa. Value type is integer. Supported operations are Add, Get, Replace, and Delete. diff --git a/windows/client-management/mdm/windowslicensing-csp.md b/windows/client-management/mdm/windowslicensing-csp.md index f5372d05f6..58a5040b72 100644 --- a/windows/client-management/mdm/windowslicensing-csp.md +++ b/windows/client-management/mdm/windowslicensing-csp.md @@ -196,7 +196,7 @@ Values: **CheckApplicability** -``` syntax +```xml @@ -223,7 +223,7 @@ Values: **Edition** -``` syntax +```xml @@ -241,7 +241,7 @@ Values: **LicenseKeyType** -``` syntax +```xml @@ -259,7 +259,7 @@ Values: **Status** -``` syntax +```xml @@ -277,7 +277,7 @@ Values: **UpgradeEditionWithProductKey** -``` syntax +```xml @@ -304,7 +304,7 @@ Values: **UpgradeEditionWithLicense** -``` syntax +```xml diff --git a/windows/client-management/mdm/windowssecurityauditing-csp.md b/windows/client-management/mdm/windowssecurityauditing-csp.md index ea9dd8e10a..ffd68aa965 100644 --- a/windows/client-management/mdm/windowssecurityauditing-csp.md +++ b/windows/client-management/mdm/windowssecurityauditing-csp.md @@ -39,7 +39,7 @@ Supported operations are Get and Replace. Enable logging of audit events. -``` syntax +```xml diff --git a/windows/client-management/mdm/wmi-providers-supported-in-windows.md b/windows/client-management/mdm/wmi-providers-supported-in-windows.md index 4d421e7c6a..b6fb182eae 100644 --- a/windows/client-management/mdm/wmi-providers-supported-in-windows.md +++ b/windows/client-management/mdm/wmi-providers-supported-in-windows.md @@ -27,7 +27,7 @@ The child node names of the result from a WMI query are separated by a forward s Get the list of network adapters from the device. -``` syntax +```xml ./cimV2/Win32_NetworkAdapter @@ -37,7 +37,7 @@ Get the list of network adapters from the device. Result -``` syntax +```xml ./cimV2/Win32_NetworkAdapter diff --git a/windows/client-management/new-policies-for-windows-10.md b/windows/client-management/new-policies-for-windows-10.md index 2c02926ece..da9546ba23 100644 --- a/windows/client-management/new-policies-for-windows-10.md +++ b/windows/client-management/new-policies-for-windows-10.md @@ -25,6 +25,232 @@ ms.topic: reference Windows 10 includes the following new policies for management. [Download the complete set of Administrative Template (.admx) files for Windows 10](https://www.microsoft.com/download/details.aspx?id=56121). + +## New Group Policy settings in Windows 10, version 1809 + +The following Group Policy settings were added in Windows 10, version 1809: + +**Start Menu and Taskbar** + +- Start Menu and Taskbar\Force Start to be either full screen size or menu size +- Start Menu and Taskbar\Remove "Recently added" list from Start Menu +- Start Menu and Taskbar\Remove All Programs list from the Start menu +- Start Menu and Taskbar\Remove frequent programs list from the Start Menu + +**System** + +- System\Group Policy\Allow asynchronous user Group Policy processing when logging on through Remote Desktop Services +- System\Group Policy\Configure Applications preference extension policy processing +- System\Group Policy\Configure Data Sources preference extension policy processing +- System\Group Policy\Configure Devices preference extension policy processing +- System\Group Policy\Configure Drive Maps preference extension policy processing +- System\Group Policy\Configure Environment preference extension policy processing +- System\Group Policy\Configure Files preference extension policy processing +- System\Group Policy\Configure Folder Options preference extension policy processing +- System\Group Policy\Configure Folders preference extension policy processing +- System\Group Policy\Configure Ini Files preference extension policy processing +- System\Group Policy\Configure Internet Settings preference extension policy processing +- System\Group Policy\Configure Local Users and Groups preference extension policy processing +- System\Group Policy\Configure Network Options preference extension policy processing +- System\Group Policy\Configure Network Shares preference extension policy processing +- System\Group Policy\Configure Power Options preference extension policy processing +- System\Group Policy\Configure Printers preference extension policy processing +- System\Group Policy\Configure Regional Options preference extension policy processing +- System\Group Policy\Configure Registry preference extension policy processing +- System\Group Policy\Configure Scheduled Tasks preference extension policy processing +- System\Group Policy\Configure Services preference extension policy processing +- System\Group Policy\Configure Shortcuts preference extension policy processing +- System\Group Policy\Configure Start Menu preference extension policy processing +- System\Group Policy\Logging and tracing\Configure Applications preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Data Sources preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Devices preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Drive Maps preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Environment preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Files preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Folder Options preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Folders preference logging and tracing +- System\Group Policy\Logging and tracing\Configure INI Files preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Internet Settings preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Local Users and Groups preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Network Options preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Network Shares preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Power Options preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Printers preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Regional Options preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Registry preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Scheduled Tasks preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Services preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Shortcuts preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Start Menu preference logging and tracing +- System\Kernel DMA Protection\Enumeration policy for external devices incompatible with Kernel DMA Protection +- System\OS Policies\Allow Clipboard History +- System\OS Policies\Allow Clipboard synchronization across devices + +**Windows Components** + +- Windows Components\Data Collection and Preview Builds\Configure Microsoft 365 Update Readiness upload endpoint +- Windows Components\Data Collection and Preview Builds\Disable deleting diagnostic data +- Windows Components\Data Collection and Preview Builds\Disable diagnostic data viewer +- Windows Components\Delivery Optimization\[Reserved for future use] Cache Server Hostname +- Windows Components\Location and Sensors\Windows Location Provider\Turn off Windows Location Provider +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\DFS Management +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\File Server Resource Manager +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Share and Storage Management +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Storage Manager for SANs +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\DFS Management Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\Disk Management Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\File Server Resource Manager Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\Share and Storage Management Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\Storage Manager for SANS Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy Management Editor +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy Starter GPO Editor +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Application snap-ins +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Applications preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Control Panel Settings (Computers) +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Control Panel Settings (Users) +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Data Sources preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Devices preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Drive Maps preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Environment preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Files preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Folder Options preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Folders preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Ini Files preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Internet Settings preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Local Users and Groups preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Network Options preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Network Shares preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Power Options preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Preferences tab +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Printers preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Regional Options preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Registry preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Scheduled Tasks preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Services preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Shortcuts preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Start Menu preference extension +- Windows Components\OOBE\Don't launch privacy settings experience on user logon +- Windows Components\OOBE\Don't launch privacy settings experience on user logon +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Do not use Remote Desktop Session Host server IP address when virtual IP address is not available +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Select the network adapter to be used for Remote Desktop IP Virtualization +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Turn off Windows Installer RDS Compatibility +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Turn on Remote Desktop IP Virtualization +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Allow remote start of unlisted programs +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Turn off Fair Share CPU Scheduling +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection\Allow time zone redirection +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection\Do not allow Clipboard redirection +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection\Redirect only the default client printer +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection\Redirect only the default client printer +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker\Use RD Connection Broker load balancing +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Allow desktop composition for remote desktop sessions +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Always show desktop on connection +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Do not allow font smoothing +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Remove remote desktop wallpaper +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for logoff of RemoteApp sessions +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for logoff of RemoteApp sessions +- Windows Components\Windows Defender Antivirus\Configure detection for potentially unwanted applications +- Windows Components\Windows Defender Antivirus\Scan\Configure low CPU priority for scheduled scans +- Windows Components\Windows Defender Application Guard\Allow camera and microphone access in Windows Defender Application Guard +- Windows Components\Windows Defender Application Guard\Allow users to trust files that open in Windows Defender Application Guard +- Windows Components\Windows Defender Application Guard\Allow Windows Defender Application Guard to use Root Certificate Authorities from the user’s device +- Windows Components\Windows Defender Application Guard\Configure additional sources for untrusted files in Windows Defender Application Guard +- Windows Components\Windows Hello for Business\Use Windows Hello for Business certificates as smart card certificates +- Windows Components\Windows Media Player\Do Not Show First Use Dialog Boxes +- Windows Components\Windows Media Player\Prevent Automatic Updates +- Windows Components\Windows Media Player\Prevent CD and DVD Media Information Retrieval +- Windows Components\Windows Media Player\Prevent Desktop Shortcut Creation +- Windows Components\Windows Media Player\Prevent Media Sharing +- Windows Components\Windows Media Player\Prevent Music File Media Information Retrieval +- Windows Components\Windows Media Player\Prevent Quick Launch Toolbar Shortcut Creation +- Windows Components\Windows Media Player\Prevent Radio Station Preset Retrieval +- Windows Components\Windows Media Player\Prevent Video Smoothing +- Windows Components\Windows Media Player\Networking\Configure HTTP Proxy +- Windows Components\Windows Media Player\Networking\Configure MMS Proxy +- Windows Components\Windows Media Player\Networking\Configure Network Buffering +- Windows Components\Windows Media Player\Networking\Configure RTSP Proxy +- Windows Components\Windows Media Player\Networking\Hide Network Tab +- Windows Components\Windows Media Player\Networking\Streaming Media Protocols +- Windows Components\Windows Media Player\Playback\Allow Screen Saver +- Windows Components\Windows Media Player\Playback\Prevent Codec Download +- Windows Components\Windows Media Player\User Interface\Do Not Show Anchor +- Windows Components\Windows Media Player\User Interface\Hide Privacy Tab +- Windows Components\Windows Media Player\User Interface\Hide Security Tab +- Windows Components\Windows Media Player\User Interface\Set and Lock Skin +- Windows Components\Windows Security\Account protection\Hide the Account protection area +- Windows Components\Windows Security\App and browser protection\Hide the App and browser protection area +- Windows Components\Windows Security\App and browser protection\Prevent users from modifying settings +- Windows Components\Windows Security\Device performance and health\Hide the Device performance and health area +- Windows Components\Windows Security\Device security\Disable the Clear TPM button +- Windows Components\Windows Security\Device security\Hide the Device security area +- Windows Components\Windows Security\Device security\Hide the Secure boot area +- Windows Components\Windows Security\Device security\Hide the Security processor (TPM) troubleshooter page +- Windows Components\Windows Security\Device security\Hide the TPM Firmware Update recommendation +- Windows Components\Windows Security\Enterprise Customization\Configure customized contact information +- Windows Components\Windows Security\Enterprise Customization\Configure customized notifications +- Windows Components\Windows Security\Enterprise Customization\Specify contact company name +- Windows Components\Windows Security\Enterprise Customization\Specify contact email address or Email ID +- Windows Components\Windows Security\Enterprise Customization\Specify contact phone number or Skype ID +- Windows Components\Windows Security\Enterprise Customization\Specify contact website +- Windows Components\Windows Security\Family options\Hide the Family options area +- Windows Components\Windows Security\Firewall and network protection\Hide the Firewall and network protection area +- Windows Components\Windows Security\Notifications\Hide all notifications +- Windows Components\Windows Security\Notifications\Hide non-critical notifications +- Windows Components\Windows Security\Systray\Hide Windows Security Systray +- Windows Components\Windows Security\Virus and threat protection\Hide the Ransomware data recovery area +- Windows Components\Windows Security\Virus and threat protection\Hide the Virus and threat protection area +- Windows Components\Windows Update\Display options for update notifications +- Windows Components\Windows Update\Remove access to "Pause updates" feature + +**Control Panel** + +- Control Panel\Settings Page Visibility +- Control Panel\Regional and Language Options\Allow users to enable online speech recognition services + +**Network** + +- Network\Windows Connection Manager\Enable Windows to soft-disconnect a computer from a network + + +## New Group Policy settings in Windows 10, version 1803 + +The following Group Policy settings were added in Windows 10, version 1803: + +**System** + +- System\Credentials Delegation\Encryption Oracle Remediation +- System\Group Policy\Phone-PC linking on this device +- System\OS Policies\Allow upload of User Activities + +**Windows Components** + +- Windows Components\App Privacy\Let Windows apps access an eye tracker device +- Windows Components\Cloud Content\Turn off Windows Spotlight on Settings +- Windows Components\Data Collection and Preview Builds\Allow device name to be sent in Windows diagnostic data +- Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in setting user interface +- Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in change notifications +- Windows Components\Delivery Optimization\Maximum Background Download Bandwidth (percentage) +- Windows Components\Delivery Optimization\Maximum Foreground Download Bandwidth (percentage) +- Windows Components\Delivery Optimization\Select the source of Group IDs +- Windows Components\Delivery Optimization\Delay background download from http (in secs) +- Windows Components\Delivery Optimization\Delay Foreground download from http (in secs) +- Windows Components\Delivery Optimization\Select a method to restrict Peer Selection +- Windows Components\Delivery Optimization\Set Business Hours to Limit Background Download Bandwidth +- Windows Components\Delivery Optimization\Set Business Hours to Limit Foreground Download Bandwidth +- Windows Components\IME\Turn on Live Sticker +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection\Do not allow video capture redirection +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Use hardware graphics adapters for all Remote Desktop Services sessions +- Windows Components\Search\Allow Cortana Page in OOBE on an AAD account +- Windows Components\Store\Disable all apps from Microsoft Store +- Windows Components\Text Input\Allow Uninstallation of Language Features +- Windows Components\Text Input\Improve inking and typing recognition +- Windows Components\Windows Defender Application Guard\Allow hardware-accelerated rendering for Windows Defender Application Guard +- Windows Components\Windows Defender Security Center\Account protection\Hide the Account protection area +- Windows Components\Windows Defender Security Center\Device security\Hide the Device security area +- Windows Components\Windows Defender Security Center\Device security\Hide the Security processor (TPM) troubleshooter page +- Windows Components\Windows Defender Security Center\Device security\Hide the Secure boot area +- Windows Components\Windows Defender Security Center\Virus and threat protection\Hide the Ransomware data recovery area + + ## New Group Policy settings in Windows 10, version 1709 The following Group Policy settings were added in Windows 10, version 1709: diff --git a/windows/client-management/reset-a-windows-10-mobile-device.md b/windows/client-management/reset-a-windows-10-mobile-device.md index 945ba0f15a..e90c985fdb 100644 --- a/windows/client-management/reset-a-windows-10-mobile-device.md +++ b/windows/client-management/reset-a-windows-10-mobile-device.md @@ -66,7 +66,7 @@ To perform a "wipe and persist" reset, preserving the provisioning applied to th ``` -## Reset using the UI +## Reset using the UI 1. On your mobile device, go to **Settings** > **System** > **About** > **Reset your Phone** diff --git a/windows/client-management/system-failure-recovery-options.md b/windows/client-management/system-failure-recovery-options.md new file mode 100644 index 0000000000..04dcbbafc9 --- /dev/null +++ b/windows/client-management/system-failure-recovery-options.md @@ -0,0 +1,205 @@ +--- +title: Configure system failure and recovery options in Windows +description: Learn about the system failure and recovery options in Windows. +ms.prod: w10 +ms.sitesec: library +ms.topic: troubleshooting +author: Deland-Han +ms.localizationpriority: medium +ms.author: delhan +ms.date: 8/22/2019 +ms.reviewer: +manager: dcscontentpm +--- + +# Configure system failure and recovery options in Windows + +This article describes how to configure the actions that Windows takes when a system error (also referred to as a bug check, system crash, fatal system error, or Stop error) occurs. You can configure the following actions: + +- Write an event to the System log. + +- Alert administrators (if you have set up administrative alerts). + +- Put system memory into a file that advanced users can use for debugging. + +- Automatically restart the computer. + +>[!Note] +> You must be logged on as an administrator or a member of the Administrators group to complete this procedure. If your computer is connected to a network, network policy settings may prevent you from completing this procedure. + +## Configuring system failure and recovery options + +> [!IMPORTANT] +> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur. + +The options are available in the **Startup and Recovery** dialog box. You can also use the following methods: + +- Modify the values under the following registry subkey: + + **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl** + +- To modify the option on your local computer, use the command line utility (Wmic.exe) to access Windows Management Instrumentation (WMI). + +Follow these steps to view the options in **Startup and Recovery**. (The registry value and Wmic commands are also listed for each option.) + +1. In Control Panel, select **System and Security > System**. + +2. Select **Advanced system settings**, select the **Advanced** tab, and select **Settings** in the **Startup and Recovery** area. + +### Under "System failure" + +Select the check boxes for the actions that you want Windows to perform when a system error occurs. + +#### Write an event to the System log + +This option specifies that event information is recorded in the System log. By default, this option is turned on. + +To turn off this option, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set WriteToSystemLog = False + ``` + +- Set the **LogEvent** DWORD value to **0**. + +#### Send an administrative alert + +The option specifies that administrators are notified of the system error if you configured administrative alerts. By default, this option is turned on. + +To turn off this option, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set SendAdminAlert = False + ``` + +- Set the **SendAlert** DWORD value to **0**. + +#### Automatically restart + +The option specifies that Windows automatically restarts your computer. By default, this option is turned on. + +To turn off this option, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set AutoReboot = False + ``` + +- Set the **AutoReboot** DWORD value to **0**. + +### Under "Write debugging information" + +Select one of the following type of information that you want Windows to record in a memory dump file if the computer stops unexpectedly: + +#### (none) + +The option does not record any information in a memory dump file. + +To specify that you do not want Windows to record information in a memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugInfoType = 0 + ``` +- Set the **CrashDumpEnabled** DWORD value to **0**. + +#### Small Memory Dump + +The option records the smallest amount of information to help identify the problem. This option requires a paging file of at least 2 megabytes (MB) on the boot volume of your computer, and specifies that Windows will create a new file each time the system stops unexpectedly. A history of these files is stored in the folder that is listed under Small Dump Directory (%SystemRoot%\Minidump). In Windows XP and Windows Server 2003, the small memory dump file is used together with the Windows Error Reporting feature. + +To specify that you want to use a small memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugInfoType = 3 + ``` + +- Set the **CrashDumpEnabled** DWORD value to **3**. + +To specify that you want to use a folder as your Small Dump Directory, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set MiniDumpDirectory = + ``` + +- Set the **MinidumpDir** Expandable String Value to \. + +#### Kernel Memory Dump + +The option records only kernel memory. This option stores more information than a small memory dump file, but it takes less time to complete than a complete memory dump file. The file is stored in %SystemRoot%\Memory.dmp by default, and any previous kernel or complete memory dump files are overwritten if the **Overwrite any existing file** check box is selected. If you set this option, you must have a sufficiently large paging file on the boot volume. The required size depends on the amount of RAM in your computer However, the maximum amount of space that must be available for a kernel memory dump on a 32-bit system is 2 GB plus 16 MB. On a 64-bit system, the maximum amount of space that must be available for a kernel memory dump is the size of the RAM plus 128 MB. The following table provides guidelines for the size of the paging file: + +|RAM size |Paging file should be no smaller than| +|-------|-----------------| +|256 MB–1,373 MB |1.5 times the RAM size| +|1,374 MB or greater |32-bit system: 2 GB plus 16 MB
                        64-bit system: size of the RAM plus 128 MB| + +To specify that you want to use a kernel memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugInfoType = 2 + ``` + +- Set the **CrashDumpEnabled** DWORD value to **2**. + +To specify that you want to use a file as your memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugFilePath = + ``` + +- Set the **DumpFile** Expandable String Value to \. + +To specify that you do not want to overwrite any previous kernel or complete memory dump files, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set OverwriteExistingDebugFile = 0 + ``` + +- Set the **Overwrite** DWORD value to **0**. + +#### Complete Memory Dump + +The option records the contents of system memory when the computer stops unexpectedly. This option is not available on computers that have 2 or more GB of RAM. If you select this option, you must have a paging file on the boot volume that is sufficient to hold all the physical RAM plus 1 MB. The file is stored as specified in %SystemRoot%\Memory.dmp by default. + +The extra megabyte is required for a complete memory dump file because Windows writes a header in addition to dumping the memory contents. The header contains a crash dump signature and specifies the values of some kernel variables. The header information does not require a full megabyte of space, but Windows sizes your paging file in increments of megabytes. + +To specify that you want to use a complete memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugInfoType = 1 + ``` + +- Set the **CrashDumpEnabled** DWORD value to **1**. + +To specify that you want to use a file as your memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugFilePath = + ``` + +- Set the DumpFile Expandable String Value to \. + +To specify that you do not want to overwrite any previous kernel or complete memory dump files, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set OverwriteExistingDebugFile = 0 + ``` + +- Set the **Overwrite** DWORD value to **0**. + +>[!Note] +>If you contact Microsoft Support about a Stop error, you might be asked for the memory dump file that is generated by the Write Debugging Information option. + +To view system failure and recovery settings for your local computer, type **wmic recoveros** at a command prompt, and then press Enter. To view system failure and recovery settings for a remote computer on your local area network, type **wmic /node: recoveros** at a command prompt, and then press Enter. + +>[!Note] +>To successfully use these Wmic.exe command line examples, you must be logged on by using a user account that has administrative rights on the computer. If you are not logged on by using a user account that has administrative rights on the computer, use the **/user:user_name** and **/password:password** switches. + +### Tips + +- To take advantage of the dump file feature, your paging file must be on the boot volume. If you have moved the paging file to another volume, you must move it back to the boot volume before you use this feature. + +- If you set the Kernel Memory Dump or the Complete Memory Dump option, and you select the **Overwrite any existing file** check box, Windows always writes to the same file name. To save individual dump files, click to clear the **Overwrite any existing file** check box, and then change the file name after each Stop error. + +- You can save some memory if you click to clear the **Write an event to the system log** and **Send an administrative alert** check boxes. The memory that you save depends on the computer, but these features typically require about 60 to 70 KB. + +## References + +[Varieties of Kernel-Mode Dump Files](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/varieties-of-kernel-mode-dump-files) diff --git a/windows/client-management/troubleshoot-inaccessible-boot-device.md b/windows/client-management/troubleshoot-inaccessible-boot-device.md index 146160c8a3..27b46491dc 100644 --- a/windows/client-management/troubleshoot-inaccessible-boot-device.md +++ b/windows/client-management/troubleshoot-inaccessible-boot-device.md @@ -17,7 +17,7 @@ manager: dansimp This article provides steps to troubleshoot **Stop error 7B: Inaccessible_Boot_Device**. This error may occur after some changes are made to the computer, or immediately after you deploy Windows on the computer. -## Causes of the Inaccessible_Boot_Device Stop error +## Causes of the Inaccessible_Boot_Device Stop error Any one of the following factors may cause the stop error: @@ -37,7 +37,7 @@ Any one of the following factors may cause the stop error: * Corrupted files in the **Boot** partition (for example, corruption in the volume that is labeled **SYSTEM** when you run the `diskpart` > `list vol` command) -## Troubleshoot this error +## Troubleshoot this error Start the computer in [Windows Recovery Mode (WinRE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference#span-identrypointsintowinrespanspan-identrypointsintowinrespanspan-identrypointsintowinrespanentry-points-into-winre). To do this, follow these steps. @@ -47,9 +47,9 @@ Start the computer in [Windows Recovery Mode (WinRE)](https://docs.microsoft.com 3. On the **System Recovery Options** screen, select **Next** > **Command Prompt** . -### Verify that the boot disk is connected and accessible +### Verify that the boot disk is connected and accessible -#### Step 1 +#### Step 1 At the WinRE Command prompt, run `diskpart`, and then run `list disk`. @@ -67,7 +67,7 @@ If the computer uses a Unified Extensible Firmware Interface (UEFI) startup inte If the computer uses a basic input/output system (BIOS) interface, there will not be an asterisk in the **Dyn** column. -#### Step 2 +#### Step 2 If the `list disk` command lists the OS disks correctly, run the `list vol` command in `diskpart`. @@ -88,7 +88,7 @@ If the `list disk` command lists the OS disks correctly, run the `list vol` comm >[!NOTE] >If the disk that contains the OS is not listed in the output, you will have to engage the OEM or virtualization manufacturer. -### Verify the integrity of Boot Configuration Database +### Verify the integrity of Boot Configuration Database Check whether the Boot Configuration Database (BCD) has all the correct entries. To do this, run `bcdedit` at the WinRE command prompt. @@ -163,7 +163,7 @@ If you do not have a Windows 10 ISO, you must format the partition and copy **bo 4. Right-click the partition, and then format it. -### Troubleshooting if this issue occurs after a Windows Update installation +### Troubleshooting if this issue occurs after a Windows Update installation Run the following command to verify the Windows update installation and dates: @@ -171,7 +171,7 @@ Run the following command to verify the Windows update installation and dates: Dism /Image:: /Get-packages ``` -After you run this command, you will see the **Install pending** and **Uninstall Pending ** packages: +After you run this command, you will see the **Install pending** and **Uninstall Pending** packages: ![Dism output](images/pendingupdate.png) @@ -203,9 +203,9 @@ After you run this command, you will see the **Install pending** and **Uninstall 11. Expand **Control\Session Manager**. Check whether the **PendingFileRenameOperations** key exists. If it does, back up the **SessionManager** key, and then delete the **PendingFileRenameOperations** key. -### Verifying boot critical drivers and services +### Verifying boot critical drivers and services -#### Check services +#### Check services 1. Follow steps 1-10 in the "Troubleshooting if this issue occurs after an Windows Update installation" section. (Step 11 does not apply to this procedure.) @@ -235,7 +235,7 @@ ren SYSTEM SYSTEM.old copy OSdrive:\Windows\System32\config\RegBack\SYSTEM OSdrive:\Windows\System32\config\ ``` -#### Check upper and lower filter drivers +#### Check upper and lower filter drivers Check whether there are any non-Microsoft upper and lower filter drivers on the computer and that they do not exist on another, similar working computer. if they do exist, remove the upper and lower filter drivers: @@ -268,7 +268,7 @@ The reason that these entries may affect us is because there may be an entry in >[!NOTE] >If there actually is a service that is set to **0** or **1** that corresponds to an **UpperFilters** or **LowerFilters** entry, setting the service to disabled in the **Services** registry (as discussed in steps 2 and 3 of the Check services section) without removing the **Filter Driver** entry causes the computer to crash and generate a 0x7b Stop error. -### Running SFC and Chkdsk +### Running SFC and Chkdsk If the computer still does not start, you can try to run a **chkdisk** process on the system drive, and also run System File Checker. To do this, run the following commands at a WinRE command prompt: diff --git a/windows/client-management/troubleshoot-stop-errors.md b/windows/client-management/troubleshoot-stop-errors.md index 26d48d6ccb..0c13fc8950 100644 --- a/windows/client-management/troubleshoot-stop-errors.md +++ b/windows/client-management/troubleshoot-stop-errors.md @@ -107,8 +107,8 @@ You can use the Microsoft DumpChk (Crash Dump File Checker) tool to verify that More information on how to use Dumpchk.exe to check your dump files: -- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk) -- [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk) +- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk) +- [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk) ### Pagefile Settings diff --git a/windows/client-management/troubleshoot-windows-freeze.md b/windows/client-management/troubleshoot-windows-freeze.md index 920e5a1ff0..664dc7700e 100644 --- a/windows/client-management/troubleshoot-windows-freeze.md +++ b/windows/client-management/troubleshoot-windows-freeze.md @@ -145,8 +145,8 @@ If the computer is no longer frozen and now is running in a good state, use the Use the Dump Check Utility (Dumpchk.exe) to read a memory dump file or verify that the file was created correctly. You can use the Microsoft DumpChk (Crash Dump File Checker) tool to verify that the memory dump files are not corrupted or invalid. -- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk) -- [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk) +- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk) +- [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk) Learn how to use Dumpchk.exe to check your dump files: diff --git a/windows/client-management/troubleshoot-windows-startup.md b/windows/client-management/troubleshoot-windows-startup.md index 1dcdb40a64..70bda5a8f5 100644 --- a/windows/client-management/troubleshoot-windows-startup.md +++ b/windows/client-management/troubleshoot-windows-startup.md @@ -14,8 +14,40 @@ manager: dansimp # Advanced troubleshooting for Windows start-up issues -In these topics, you will learn how to troubleshoot common problems related to Windows start-up. +In these topics, you will learn how to troubleshoot common problems that are related to Windows startup. -- [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md) -- [Advanced troubleshooting for Stop error or blue screen error](troubleshoot-stop-errors.md) -- [Advanced troubleshooting for Windows-based computer freeze issues](troubleshoot-windows-freeze.md) +## How it works + +When Microsoft Windows experiences a condition that compromises safe system operation, the system halts. These Windows startup problems are categorized in the following groups: + +- Bug check: Also commonly known as a system crash, a kernel error, or a Stop error. + +- No boot: The system may not produce a bug check but is unable to start up into Windows. + +- Freeze: Also known as "system hang". + +## Best practices + +To understand the underlying cause of Windows startup problems, it's important that the system be configured correctly. Here are some best practices for configuration: + +### Page file settings + +- [Introduction of page file](introduction-page-file.md) + +- [How to determine the appropriate page file size for 64-bit versions of Windows](determine-appropriate-page-file-size.md) + +### Memory dump settings + +- [Configure system failure and recovery options in Windows](system-failure-recovery-options.md) + +- [Generate a kernel or complete crash dump](generate-kernel-or-complete-crash-dump.md) + +## Troubleshooting + +These articles will walk you through the resources you need to troubleshoot Windows startup issues: + +- [Advanced troubleshooting for Windows boot problems](https://docs.microsoft.com/en-us/windows/client-management/advanced-troubleshooting-boot-problems) + +- [Advanced troubleshooting for Stop error or blue screen error](https://docs.microsoft.com/en-us/windows/client-management/troubleshoot-stop-errors) + +- [Advanced troubleshooting for Windows-based computer freeze issues](https://docs.microsoft.com/en-us/windows/client-management/troubleshoot-windows-freeze) diff --git a/windows/client-management/windows-10-mobile-and-mdm.md b/windows/client-management/windows-10-mobile-and-mdm.md index 3dc34d0551..da7f583966 100644 --- a/windows/client-management/windows-10-mobile-and-mdm.md +++ b/windows/client-management/windows-10-mobile-and-mdm.md @@ -27,11 +27,11 @@ Employees increasingly depend on smartphones to complete daily work tasks, but t Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement using a comprehensive mobile device management solution. **In this article** -- [Deploy](#deploy) -- [Configure](#configure) -- [Apps](#apps) -- [Manage](#manage) -- [Retire](#retire) +- [Deploy](#deploy) +- [Configure](#configure) +- [Apps](#apps) +- [Manage](#manage) +- [Retire](#retire) ## Deploy @@ -108,7 +108,7 @@ MDM enrollment can also be initiated with a provisioning package. This option en Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen will determine who controls the device and influence your management capabilities. ->**Note:** Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, etc. Both an [MSA](https://www.microsoft.com/en-us/account/) and an [Azure AD account](https://www.microsoft.com/en-us/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) give access to these services. +>**Note:** Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, etc. Both an [MSA](https://www.microsoft.com/account/) and an [Azure AD account](https://www.microsoft.com/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) give access to these services. The following table describes the impact of identity choice on device management characteristics of the personal and corporate device scenarios. @@ -186,7 +186,7 @@ For both personal and corporate deployment scenarios, an MDM system is the essen Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](https://azure.microsoft.com/documentation/articles/active-directory-editions/)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. **Mobile Device Management** -Microsoft [Intune](https://www.microsoft.com/en-us/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. +Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. You can also integrate Intune with Configuration Manager to gain a single console for managing all devices in the cloud and on premises, mobile or PC. For more information, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](https://technet.microsoft.com/library/jj884158.aspx). For guidance on choosing between a stand-alone Intune installation and Intune integrated with System Center Configuration Manager, see Choose between Intune by itself or integrating Intune with System Center Configuration Manager. Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. MDM providers that support Windows 10 Mobile currently include: AirWatch, Citrix, MobileIron, SOTI, Blackberry and others. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. @@ -365,18 +365,18 @@ You can define and deploy APN profiles in MDM systems that configure cellular da - **APN name** The APN name - *IP connection type* The IP connection type; set to one of the following values: - - IPv4 only - - IPv6 only - - IPv4 and IPv6 concurrently - - IPv6 with IPv4 provided by 46xlat + - IPv4 only + - IPv6 only + - IPv4 and IPv6 concurrently + - IPv6 with IPv4 provided by 46xlat - **LTE attached** Whether the APN should be attached as part of an LTE Attach - **APN class ID** The globally unique identifier that defines the APN class to the modem - **APN authentication type** The APN authentication type; set to one of the following values: - - None - - Auto - - PAP - - CHAP - - MSCHAPv2 + - None + - Auto + - PAP + - CHAP + - MSCHAPv2 - **User name** The user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type - **Password** The password for the user account specified in User name - **Integrated circuit card ID** The integrated circuit card ID associated with the cellular connection profile diff --git a/windows/configuration/configure-windows-10-taskbar.md b/windows/configuration/configure-windows-10-taskbar.md index 4389cbd5e6..037e389943 100644 --- a/windows/configuration/configure-windows-10-taskbar.md +++ b/windows/configuration/configure-windows-10-taskbar.md @@ -2,7 +2,7 @@ title: Configure Windows 10 taskbar (Windows 10) description: Admins can pin apps to users' taskbars. keywords: ["taskbar layout","pin apps"] -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: dansimp diff --git a/windows/configuration/cortana-at-work/cortana-at-work-overview.md b/windows/configuration/cortana-at-work/cortana-at-work-overview.md index b3077aeaf7..cca8151178 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-overview.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-overview.md @@ -53,7 +53,7 @@ Your organization must have an Azure AD tenant and your employees’ devices mus ## Cortana and privacy We understand that there are some questions about Cortana and your organization’s privacy, including concerns about what info is collected by Cortana, where the info is saved, how to manage what data is collected, how to turn Cortana off, how to opt completely out of data collection, and what info is shared with other Microsoft apps and services. For more details about these concerns, see the [Cortana, Search, and privacy: FAQ](https://windows.microsoft.com/windows-10/cortana-privacy-faq) topic. -Cortana is covered under the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement). +Cortana is covered under the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement). ## See also - [What is Cortana?](https://go.microsoft.com/fwlink/p/?LinkId=746818) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md index f731e345d8..7d96f06030 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md @@ -18,7 +18,7 @@ manager: dansimp - Windows 10 Mobile, version 1703 >[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement). +>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement). Cortana automatically finds patterns in your email, suggesting reminders based things that you said you would do so you don’t forget about them. For example, Cortana recognizes that if you include the text, _I’ll get this to you by the end of the week_ in an email, you're making a commitment to provide something by a specific date. Cortana can now suggest that you be reminded about this event, letting you decide whether to keep it or to cancel it. diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md index aa221c4b9e..7ac4b1ff90 100644 --- a/windows/configuration/customize-and-export-start-layout.md +++ b/windows/configuration/customize-and-export-start-layout.md @@ -176,7 +176,7 @@ If the Start layout is applied by Group Policy or MDM, and the policy is removed 2. [Export the Start layout](#export-the-start-layout). 3. Open the layout .xml file. There is a `` element. Add `LayoutCustomizationRestrictionType="OnlySpecifiedGroups"` to the **DefaultLayoutOverride** element as follows: - ``` syntax + ```xml ``` diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md index 0647e4eec3..3cd4ad2b71 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md @@ -12,7 +12,6 @@ author: dansimp ms.localizationpriority: medium ms.author: dansimp ms.topic: article -ms.date: 11/15/2017 --- # Customize Windows 10 Start and taskbar with Group Policy diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index 56de2504c6..369f3eb6fb 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -12,7 +12,6 @@ author: dansimp ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 11/15/2017 --- # Customize Windows 10 Start and taskbar with provisioning packages @@ -23,12 +22,12 @@ ms.date: 11/15/2017 - Windows 10 ->**Looking for consumer information?** [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) +> **Looking for consumer information?** [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) In Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, version 1703, you can use a provisioning package that you create with Windows Configuration Designer to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated simply by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. ->[!IMPORTANT] ->If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy. +> [!IMPORTANT] +> If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy. **Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions. @@ -39,15 +38,16 @@ Three features enable Start and taskbar layout control: - The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. - >[!NOTE] - >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/import-startlayout) cmdlet. + > [!NOTE] + > To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/import-startlayout) cmdlet. - [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include `` or create an .xml file just for the taskbar configuration. - In Windows Configuration Designer, you use the **Policies/Start/StartLayout** setting to provide the contents of the .xml file that defines the Start and taskbar layout. - -## Prepare the Start layout XML file + + +## Prepare the Start layout XML file The **Export-StartLayout** cmdlet produces an XML file. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout section to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout section to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. @@ -61,8 +61,8 @@ The **Export-StartLayout** cmdlet produces an XML file. Because Windows Configur Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md) ->[!IMPORTANT] ->When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. +> [!IMPORTANT] +> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. 1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). @@ -76,8 +76,8 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 6. Expand **Runtime settings** > **Policies** > **Start**, and click **StartLayout**. - >[!TIP] - >If **Start** is not listed, check the type of settings you selected in step 4. You must create the project using settings for **All Windows desktop editions**. + > [!TIP] + > If **Start** is not listed, check the type of settings you selected in step 4. You must create the project using settings for **All Windows desktop editions**. 7. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the layout.xml file in a later step. @@ -130,7 +130,6 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L ## Related topics - - [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) - [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) - [Customize and export Start layout](customize-and-export-start-layout.md) @@ -139,12 +138,3 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L - [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) - - - - - - - - - diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json index 1ca640e263..af378be469 100644 --- a/windows/configuration/docfx.json +++ b/windows/configuration/docfx.json @@ -33,6 +33,7 @@ "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", + "audience": "ITPro", "ms.topic": "article", "feedback_system": "GitHub", "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md index fa57936276..bbe21777b6 100644 --- a/windows/configuration/guidelines-for-assigned-access-app.md +++ b/windows/configuration/guidelines-for-assigned-access-app.md @@ -68,7 +68,7 @@ In Windows 10, version 1803 and later, you can install the **Kiosk Browser** app Kiosk Browser settings | Use this setting to --- | --- -Blocked URL Exceptions | Specify URLs that people can navigate to, even though the URL is in your blocked URL list. You can use wildcards.

                        For example, if you want people to be limited to `contoso.com` only, you would add `contoso.com` to blocked URL exception list and then block all other URLs. +Blocked URL Exceptions | Specify URLs that people can navigate to, even though the URL is in your blocked URL list. You can use wildcards.

                        For example, if you want people to be limited to `http://contoso.com` only, you would add `.contoso.com` to blocked URL exception list and then block all other URLs. Blocked URLs | Specify URLs that people can't navigate to. You can use wildcards.

                        If you want to limit people to a specific site, add `https://*` to the blocked URL list, and then specify the site to be allowed in the blocked URL exceptions list. Default URL | Specify the URL that Kiosk Browser will open with. **Tip!** Make sure your blocked URLs don't include your default URL. Enable End Session Button | Show a button in Kiosk Browser that people can use to reset the browser. End Session will clear all browsing data and navigate back to the default URL. diff --git a/windows/configuration/index.md b/windows/configuration/index.md index 6517e9e14f..ca42852107 100644 --- a/windows/configuration/index.md +++ b/windows/configuration/index.md @@ -7,10 +7,10 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: high -author: jdeckerms -ms.author: jdecker +manager: dansimp +author: dansimp +ms.author: dansimp ms.topic: article -ms.date: 05/11/2018 --- # Configure Windows 10 diff --git a/windows/configuration/kiosk-mdm-bridge.md b/windows/configuration/kiosk-mdm-bridge.md index b08ebebd2c..51eeccc08b 100644 --- a/windows/configuration/kiosk-mdm-bridge.md +++ b/windows/configuration/kiosk-mdm-bridge.md @@ -35,7 +35,8 @@ Here’s an example to set AssignedAccess configuration: $nameSpaceName="root\cimv2\mdm\dmmap" $className="MDM_AssignedAccess" $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -$obj.Configuration = @" +Add-Type -AssemblyName System.Web +$obj.Configuration = [System.Web.HttpUtility]::HtmlEncode(@" @@ -84,7 +85,7 @@ $obj.Configuration = @" -"@ +"@) Set-CimInstance -CimInstance $obj ``` diff --git a/windows/configuration/kiosk-prepare.md b/windows/configuration/kiosk-prepare.md index c3491784d7..af5a26163b 100644 --- a/windows/configuration/kiosk-prepare.md +++ b/windows/configuration/kiosk-prepare.md @@ -21,15 +21,15 @@ ms.topic: article - Windows 10 Pro, Enterprise, and Education ->[!WARNING] ->For kiosks in public-facing environments with auto sign-in enabled, you should use a user account with least privilege, such as a local standard user account. +> [!WARNING] +> For kiosks in public-facing environments with auto sign-in enabled, you should use a user account with the least privileges, such as a local standard user account. > ->Assigned access can be configured via Windows Management Instrumentation (WMI) or configuration service provider (CSP) to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. +> Assigned access can be configured via Windows Management Instrumentation (WMI) or configuration service provider (CSP) to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that might allow an attacker subverting the assigned access application to gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. ->[!IMPORTANT] ->[User account control (UAC)](https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode. +> [!IMPORTANT] +> [User account control (UAC)](https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode. > ->Kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk. +> Kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk. ## Configuration recommendations @@ -60,19 +60,19 @@ Logs can help you [troubleshoot issues](multi-app-kiosk-troubleshoot.md) kiosk i In addition to the settings in the table, you may want to set up **automatic logon** for your kiosk device. When your kiosk device restarts, whether from an update or power outage, you can sign in the assigned access account manually or you can configure the device to sign in to the assigned access account automatically. Make sure that Group Policy settings applied to the device do not prevent automatic sign in. ->[!NOTE] ->If you are using a Windows 10 and later device restriction CSP to set "Preferred Azure AD tenant domain", this will break the "User logon type" auto-login feature of the Kiosk profile. +> [!NOTE] +> If you are using a Windows 10 and later device restriction CSP to set "Preferred Azure AD tenant domain", this will break the "User logon type" auto-login feature of the Kiosk profile. ->[!TIP] ->If you use the [kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) or [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) to configure your kiosk, you can set an account to sign in automatically in the wizard or XML. +> [!TIP] +> If you use the [kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) or [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) to configure your kiosk, you can set an account to sign in automatically in the wizard or XML. **How to edit the registry to have an account sign in automatically** 1. Open Registry Editor (regedit.exe). - >[!NOTE] - >If you are not familiar with Registry Editor, [learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002). + > [!NOTE] + > If you are not familiar with Registry Editor, [learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002). 2. Go to @@ -94,8 +94,8 @@ In addition to the settings in the table, you may want to set up **automatic log 4. Close Registry Editor. The next time the computer restarts, the account will sign in automatically. ->[!TIP] ->You can also configure automatic sign-in [using the Autologon tool from Sysinternals](https://docs.microsoft.com/sysinternals/downloads/autologon). +> [!TIP] +> You can also configure automatic sign-in [using the Autologon tool from Sysinternals](https://docs.microsoft.com/sysinternals/downloads/autologon). ## Interactions and interoperability @@ -245,13 +245,13 @@ The following table describes some features that have interoperability issues we + - ## Testing your kiosk in a virtual machine (VM) Customers sometimes use virtual machines (VMs) to test configurations before deploying those configurations to physical devices. If you use a VM to test your single-app kiosk configuration, you need to know how to connect to the VM properly. -A single-app kiosk configuration runs an app above the lockscreen. It doesn't work when it's accessed remotely, which includes *enhanced* sessions in Hyper-V. +A single-app kiosk configuration runs an app above the lock screen. It doesn't work when it's accessed remotely, which includes *enhanced* sessions in Hyper-V. When you connect to a VM configured as a single-app kiosk, you need a *basic* session rather than an enhanced session. In the following image, notice that **Enhanced session** is not selected in the **View** menu; that means it's a basic session. @@ -259,4 +259,4 @@ When you connect to a VM configured as a single-app kiosk, you need a *basic* se To connect to a VM in a basic session, do not select **Connect** in the connection dialog, as shown in the following image, but instead, select the **X** button in the upper-right corner to cancel the dialog. -![Do not select connect button, use close X in corner](images/vm-kiosk-connect.png) +![Do not select the connect button, use "close X" in the top corner](images/vm-kiosk-connect.png) diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md index fec62e33fd..92c0f753d1 100644 --- a/windows/configuration/kiosk-single-app.md +++ b/windows/configuration/kiosk-single-app.md @@ -51,6 +51,7 @@ Method | Description + ## Set up a kiosk in local Settings >App type: UWP @@ -122,6 +123,7 @@ To remove assigned access, choose **Turn off assigned access and sign out of the + ## Set up a kiosk using Windows PowerShell @@ -182,6 +184,7 @@ Clear-AssignedAccess + ## Set up a kiosk using the kiosk wizard in Windows Configuration Designer >App type: UWP or Windows desktop application @@ -234,6 +237,7 @@ When you use the **Provision kiosk devices** wizard in Windows Configuration Des + ## Set up a kiosk or digital sign using Microsoft Intune or other MDM service >App type: UWP diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md index 2cde6940fa..cf28c53e4a 100644 --- a/windows/configuration/kiosk-xml.md +++ b/windows/configuration/kiosk-xml.md @@ -16,7 +16,7 @@ ms.author: dansimp ms.topic: article --- -# Assigned Access configuration (kiosk) XML reference +# Assigned Access configuration (kiosk) XML reference **Applies to** @@ -26,7 +26,7 @@ ms.topic: article ## Full XML sample >[!NOTE] ->Updated for Windows 10, version 1903, and Windows 10 Prerelease +>Updated for Windows 10, version 1903, and Windows 10 Insider Preview (19H2, 20H1 builds). ```xml @@ -255,7 +255,7 @@ This sample demonstrates that both UWP and Win32 apps can be configured to autom ``` ## [Preview] Global Profile Sample XML -Global Profile is currently supported in Windows 10 Prerelease. Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lock down mode, or used as mitigation when a profile cannot be determined for an user. +Global Profile is currently supported in Windows 10 Insider Preview (19H2, 20H1 builds). Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lock down mode, or used as mitigation when a profile cannot be determined for an user. This sample demonstrates that only a global profile is used, no active user configured. Global profile will be applied when every non-admin account logs in ```xml @@ -394,7 +394,7 @@ Below sample shows dedicated profile and global profile mixed usage, aauser woul ``` ## [Preview] Folder Access sample xml -In Windows 10 1809 release, folder access is locked down that when common file dialog is opened, IT Admin can specify if user has access to the Downloads folder, or no access to any folder at all. This restriction has be redesigned for finer granulatity and easier use, available in current Windows 10 Prerelease. +In Windows 10, version 1809, folder access is locked down so that when common file dialog is opened, IT Admin can specify if the user has access to the Downloads folder, or no access to any folder at all. This restriction has been redesigned for finer granulatity and easier use, and is available in Windows 10 Insider Preview (19H2, 20H1 builds). IT Admin now can specify user access to Downloads folder, Removable drives, or no restrictions at all. Note that Downloads and Removable Drives can be allowed at the same time. @@ -636,7 +636,7 @@ IT Admin now can specify user access to Downloads folder, Removable drives, or n ## XSD for AssignedAccess configuration XML >[!NOTE] ->Updated for Windows 10, version 1903 and Windows 10 Prerelease. +>Updated for Windows 10, version 1903 and Windows 10 Insider Preview (19H2, 20H1 builds). Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. ```xml @@ -859,7 +859,7 @@ Here is the schema for new features introduced in Windows 10 1809 release                         ``` -Schema for Windows 10 prerelease +Schema for Windows 10 Insider Preview (19H2, 20H1 builds) ```xml ``` -To authorize a compatible configuration XML that includes 1809 or prerelease elements and attributes, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. e.g. to configure auto-launch feature which is added in 1809 release, use below sample, notice an alias r1809 is given to the 201810 namespace for 1809 release, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. +To authorize a compatible configuration XML that includes elements and attributes from Windows 10, version 1809 or newer, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the auto-launch feature which is added in Windows 10, version 1809, use the following sample. Notice an alias r1809 is given to the 201810 namespace for Windows 10, version 1809, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. ```xml + ```xml -<AllAppsList> - <AllowedApps> - <App AppUserModelId="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> - <App AppUserModelId="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" /> - <App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" /> - <App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" /> - <App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> - <App DesktopAppPath="%windir%\system32\mspaint.exe" /> - <App DesktopAppPath="C:\Windows\System32\notepad.exe" rs5:AutoLaunch="true" rs5:AutoLaunchArguments="123.txt"/> - </AllowedApps> -</AllAppsList> + + + + + + + + + + + ``` ##### FileExplorerNamespaceRestrictions @@ -590,6 +591,7 @@ To create a multi-app kiosk that can run mixed reality apps, you must include th + ``` These are in addition to any mixed reality apps that you allow. diff --git a/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md b/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md index 5603c46bfa..4ea4c7f814 100644 --- a/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md +++ b/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md @@ -462,7 +462,7 @@ Quick action buttons are locked down in exactly the same way as Settings pages/g You can specify the quick actions as follows: -``` syntax +```xml diff --git a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md index bd8806ab06..b825b767ae 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md +++ b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md @@ -5,7 +5,7 @@ ms.assetid: 66D14E97-E116-4218-8924-E2A326C9367E ms.reviewer: manager: dansimp keywords: ["runtime provisioning", "provisioning package"] -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: dansimp diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md index a906cf7e68..cc40946bcb 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md @@ -2,7 +2,7 @@ title: Provision PCs with apps and certificates (Windows 10) description: Create a provisioning package to apply settings to a PC running Windows 10. keywords: ["runtime provisioning", "provisioning package"] -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: dansimp diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index b6d2e80dc0..cbcb56ed0d 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -2,7 +2,7 @@ title: Provision PCs with apps (Windows 10) description: Add apps to a Windows 10 provisioning package. keywords: ["runtime provisioning", "provisioning package"] -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: dansimp diff --git a/windows/configuration/provisioning-packages/provisioning-powershell.md b/windows/configuration/provisioning-packages/provisioning-powershell.md index ad7c341563..02c28c2b6d 100644 --- a/windows/configuration/provisioning-packages/provisioning-powershell.md +++ b/windows/configuration/provisioning-packages/provisioning-powershell.md @@ -26,7 +26,7 @@ Windows 10, version 1703, ships with Windows Provisioning PowerShell cmdlets. Th - + diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md index 61ab4d40ae..139dcce1bb 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/set-up-shared-or-guest-pc.md @@ -2,7 +2,7 @@ title: Set up a shared or guest PC with Windows 10 (Windows 10) description: Windows 10, version 1607, introduces *shared PC mode*, which optimizes Windows 10 for shared use scenarios. keywords: ["shared pc mode"] -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: dansimp diff --git a/windows/configuration/start-layout-troubleshoot.md b/windows/configuration/start-layout-troubleshoot.md index b7a9b2ca2d..2e002f5962 100644 --- a/windows/configuration/start-layout-troubleshoot.md +++ b/windows/configuration/start-layout-troubleshoot.md @@ -233,10 +233,10 @@ XML files can and should be tested locally on a Hyper-V or other virtual machine - User-initiated changes to the start layout are not roamed. Specifically, behaviors include - - Applications (apps or icons) pinned to the start menu are missing. - - Entire tile window disappears. - - The start button fails to respond. - - If a new roaming user is created, the first logon appears normal, but on subsequent logons, tiles are missing. +- Applications (apps or icons) pinned to the start menu are missing. +- Entire tile window disappears. +- The start button fails to respond. +- If a new roaming user is created, the first logon appears normal, but on subsequent logons, tiles are missing. ![Example of a working layout](images/start-ts-3.png) diff --git a/windows/configuration/start-layout-xml-desktop.md b/windows/configuration/start-layout-xml-desktop.md index 529e59e779..520de10950 100644 --- a/windows/configuration/start-layout-xml-desktop.md +++ b/windows/configuration/start-layout-xml-desktop.md @@ -53,6 +53,7 @@ The XML schema for `LayoutModification.xml` requires the following order for tag 1. TopMFUApps 1. CustomTaskbarLayoutCollection 1. InkWorkspaceTopApps +1. StartLayoutCollection Comments are not supported in the `LayoutModification.xml` file. @@ -66,6 +67,8 @@ Comments are not supported in the `LayoutModification.xml` file. >- Do not add multiple rows of comments. The following table lists the supported elements and attributes for the LayoutModification.xml file. +> [!NOTE] +> RequiredStartGroupsCollection and AppendGroup syntax only apply when the Import-StartLayout method is used for building and deploying Windows images. | Element | Attributes | Description | | --- | --- | --- | diff --git a/windows/configuration/start-secondary-tiles.md b/windows/configuration/start-secondary-tiles.md index fd49af9302..2064129dc1 100644 --- a/windows/configuration/start-secondary-tiles.md +++ b/windows/configuration/start-secondary-tiles.md @@ -9,7 +9,6 @@ ms.localizationpriority: medium author: dansimp ms.author: dansimp ms.topic: article -ms.date: 06/27/2018 ms.reviewer: manager: dansimp --- @@ -76,10 +75,7 @@ In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutE 3. If you’d like to change the image for a secondary tile to your own custom image, open the layout.xml file, and look for the images that the tile references. - For example, your layout.xml contains `Square150x150LogoUri="ms-appdata:///local/PinnedTiles/21581260870/hires.png" Wide310x150LogoUri="ms-appx:///"` - - Open `C:\Users\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\21581260870\` and replace those images with your customized images. - - >[!TIP] - >A quick method for getting appropriately sized images for each tile size is to upload your image at [BuildMyPinnedSite](http://www.buildmypinnedsite.com/) and then download the resized tile images. + - Open `C:\Users\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\21581260870\` and replace those images with your customized images. 4. In Windows PowerShell, enter the following command: @@ -112,12 +108,9 @@ In Microsoft Intune, you create a device restrictions policy to apply to device >[!NOTE] >The device restrictions in Microsoft Intune include [other Start settings](https://docs.microsoft.com/intune/device-restrictions-windows-10#start) that you can also configure in your profile. - - ### Using a provisioning package - -#### Prepare the Start layout and Edge assets XML files +#### Prepare the Start layout and Edge assets XML files The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce XML files. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout and Edge assets sections to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout and Edge assets sections to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. @@ -128,7 +121,7 @@ The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce 3. During the procedure to create a provisioning package, you will copy the text with the escape characters and paste it in the customizations.xml file for your project. -#### Create a provisioning package that contains a customized Start layout +#### Create a provisioning package that contains a customized Start layout Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md) diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index 643ebbc93e..15ac23506b 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -23,7 +23,7 @@ ms.date: 4/16/2018 - Windows 10 - Windows 10 Mobile ->For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). +>For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). IT pros can configure access to Microsoft Store for client computers in their organization. For some organizations, business policies require blocking access to Microsoft Store. diff --git a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md index 4f1ec82a51..e6a50b2114 100644 --- a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md +++ b/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: trudyha +ms.author: dansimp ms.topic: article --- diff --git a/windows/configuration/ue-v/uev-administering-uev.md b/windows/configuration/ue-v/uev-administering-uev.md index c06c6a0d85..16154765ea 100644 --- a/windows/configuration/ue-v/uev-administering-uev.md +++ b/windows/configuration/ue-v/uev-administering-uev.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: trudyha +ms.author: dansimp ms.topic: article --- diff --git a/windows/configuration/ue-v/uev-application-template-schema-reference.md b/windows/configuration/ue-v/uev-application-template-schema-reference.md index 299ba40be7..2a219ab6bc 100644 --- a/windows/configuration/ue-v/uev-application-template-schema-reference.md +++ b/windows/configuration/ue-v/uev-application-template-schema-reference.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: trudyha +ms.author: dansimp ms.topic: article --- @@ -241,7 +241,7 @@ Version identifies the version of the settings location template for administrat **Hint:** You can save notes about version changes using XML comment tags ``, for example: -``` syntax +```xml - - - - -By default in Windows 10 Enterprise and Education editions, Delivery Optimization allows peer-to-peer sharing on the organization's own network only (specifically, all of the devices must be behind the same NAT), but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune. - -For more details, see "Download mode" in [Delivery optimization reference](waas-delivery-optimization-reference.md#download-mode). - - -## Set up Delivery Optimization - -See [Set up Delivery Optimization](waas-delivery-optimization-setup.md) for suggested values for a number of common scenarios. - -You can use Group Policy or an MDM solution like Intune to configure Delivery Optimization. - -You will find the Delivery Optimization settings in Group Policy under **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization**. -In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimization/**. - -Starting with Microsoft Intune version 1902, you can set many Delivery Optimization policies as a profile which you can then apply to groups of devices. For more information, see [Delivery Optimization settings in Microsoft Intune](https://docs.microsoft.com/intune/delivery-optimization-windows)) - -**Starting with Windows 10, version 1903,** you can use the Azure Active Directory (AAD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. - -## Reference - -For complete list of every possible Delivery Optimization setting, see [Delivery Optimization reference](waas-delivery-optimization-reference.md). - - -## How Microsoft uses Delivery Optimization -At Microsoft, to help ensure that ongoing deployments weren’t affecting our network and taking away bandwidth for other services, Microsoft IT used a couple of different bandwidth management strategies. Delivery Optimization, peer-to-peer caching enabled through Group Policy, was piloted and then deployed to all managed devices using Group Policy. Based on recommendations from the Delivery Optimization team, we used the "group" configuration to limit sharing of content to only the devices that are members of the same Active Directory domain. The content is cached for 24 hours. More than 76 percent of content came from peer devices versus the Internet. - -For more details, check out the [Adopting Windows as a Service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) technical case study. - - - -## Frequently asked questions - -**Does Delivery Optimization work with WSUS?**: Yes. Devices will obtain the update payloads from the WSUS server, but must also have an internet connection as they communicate with the Delivery Optimization cloud service for coordination. - -**Which ports does Delivery Optimization use?**: For peer-to-peer traffic, it uses 7680 for TCP/IP or 3544 for NAT traversal (optionally Teredo). For client-service communication, it uses HTTP or HTTPS over port 80/443. - -**What are the requirements if I use a proxy?**: You must allow Byte Range requests. See [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update) for details. - -**What hostnames should I allow through my firewall to support Delivery Optimization?**: - -For communication between clients and the Delivery Optimization cloud service: **\*.do.dsp.mp.microsoft.com**. - -For Delivery Optimization metadata: - -- *.dl.delivery.mp.microsoft.com -- *.emdl.ws.microsoft.com - -For the payloads (optional): - -- *.download.windowsupdate.com -- *.windowsupdate.com - -**Does Delivery Optimization use multicast?**: No. It relies on the cloud service for peer discovery, resulting in a list of peers and their IP addresses. Client devices then connect to their peers to obtain download files over TCP/IP. - -**How does Delivery Optimization deal with congestion on the router from peer-to-peer activity on the LAN?**: Starting in Windows 10, version 1903, Delivery Optimizatio uses LEDBAT to relieve such congestion. For more details see this post on the [Networking Blog](https://techcommunity.microsoft.com/t5/Networking-Blog/Windows-Transport-converges-on-two-Congestion-Providers-Cubic/ba-p/339819). - - -## Troubleshooting - -This section summarizes common problems and some solutions to try. - -### If you don't see any bytes from peers - -If you don’t see any bytes coming from peers the cause might be one of the following issues: - -- Clients aren’t able to reach the Delivery Optimization cloud services. -- The cloud service doesn’t see other peers on the network. -- Clients aren’t able to connect to peers that are offered back from the cloud service. - - -### Clients aren't able to reach the Delivery Optimization cloud services. - -If you suspect this is the problem, try these steps: - -1. Start a download of an app that is larger than 50 MB from the Store (for example "Candy Crush Saga"). -2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and observe the DownloadMode setting. For peering to work, DownloadMode should be 1, 2, or 3. -3. If **DownloadMode** is 99 it could indicate your device is unable to reach the Delivery Optimization cloud services. Ensure that the Delivery Optimization hostnames are allowed access: most importantly **\*.do.dsp.mp.microsoft.com**. - - - -### The cloud service doesn't see other peers on the network. - -If you suspect this is the problem, try these steps: - -1. Download the same app on two different devices on the same network, waiting 10 – 15 minutes between downloads. -2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and ensure that **DownloadMode** is 1 or 2 on both devices. -3. Run `Get-DeliveryOptimizationPerfSnap` from an elevated Powershell window on the second device. The **NumberOfPeers** field should be non-zero. -4. If the number of peers is zero and you have **DownloadMode** = 1, ensure that both devices are using the same public IP address to reach the internet. To do this, open a browser Windows and search for “what is my IP”. You can **DownloadMode 2** (Group) and a custom GroupID (Guid) to fix this if the devices aren’t reporting the same public IP address. - - -### Clients aren't able to connect to peers offered by the cloud service - -If you suspect this is the problem, try a Telnet test between two devices on the network to ensure they can connect using port 7680. To do this, follow these steps: - -1. Install Telnet by running **dism /online /Enable-Feature /FeatureName:TelnetClient** from an elevated command prompt. -2. Run the test. For example, if you are on device with IP 192.168.8.12 and you are trying to test the connection to 192.168.9.17 run **telnet 192.168.9.17 7680** (the syntax is *telnet [destination IP] [port]*. You will either see a connection error or a blinking cursor like this /_. The blinking cursor means success. - - - - - -## Learn more - -[Windows 10, Delivery Optimization, and WSUS](https://blogs.technet.microsoft.com/mniehaus/2016/08/16/windows-10-delivery-optimization-and-wsus-take-2/) - - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Overview of Windows as a service](waas-overview.md) -- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) -- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) -- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) -- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) -- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) -- [Manage device restarts after updates](waas-restart.md) +--- +title: Configure Delivery Optimization for Windows 10 updates (Windows 10) +ms.reviewer: +manager: laurawi +description: Delivery Optimization is a peer-to-peer distribution method in Windows 10 +keywords: oms, operations management suite, wdav, updates, downloads, log analytics +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Delivery Optimization for Windows 10 updates + + +**Applies to** + +- Windows 10 + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +Windows updates, upgrades, and applications can contain packages with very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those packages from alternate sources (such as other peers on the network) in addition to the traditional Internet-based servers. You can use Delivery Optimization in conjunction with Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or System Center Configuration Manager (when installation of Express Updates is enabled). + +Delivery Optimization is a cloud-managed solution. Access to the Delivery Optimization cloud services is a requirement. This means that in order to use the peer-to-peer functionality of Delivery Optimization, devices must have access to the internet. + + +>[!NOTE] +>WSUS can also use [BranchCache](waas-branchcache.md) for content sharing and caching. If Delivery Optimization is enabled on devices that use BranchCache, Delivery Optimization will be used instead. + +## Requirements + +The following table lists the minimum Windows 10 version that supports Delivery Optimization: + +| Device type | Minimum Windows version | +|------------------|---------------| +| Computers running Windows 10 | 1511 | +| Computers running Server Core installations of Windows Server | 1709 | +| IoT devices | 1803 | +| HoloLens devices | 1803 | + +**Types of download packages supported by Delivery Optimization** + +| Download package | Minimum Windows version | +|------------------|---------------| +| Windows 10 updates (feature updates and quality updates) | 1511 | +| Windows 10 drivers | 1511 | +| Windows Store files | 1511 | +| Windows Store for Business files | 1511 | +| Windows Defender definition updates | 1511 | +| Office Click-to-Run updates | 1709 | +| Win32 apps for Intune | 1709 | +| SCCM Express Updates | 1709 + Configuration Manager version 1711 | + + + + + + +By default in Windows 10 Enterprise and Education editions, Delivery Optimization allows peer-to-peer sharing on the organization's own network only (specifically, all of the devices must be behind the same NAT), but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune. + +For more details, see "Download mode" in [Delivery optimization reference](waas-delivery-optimization-reference.md#download-mode). + + +## Set up Delivery Optimization + +See [Set up Delivery Optimization](waas-delivery-optimization-setup.md) for suggested values for a number of common scenarios. + +You can use Group Policy or an MDM solution like Intune to configure Delivery Optimization. + +You will find the Delivery Optimization settings in Group Policy under **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization**. +In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimization/**. + +Starting with Microsoft Intune version 1902, you can set many Delivery Optimization policies as a profile which you can then apply to groups of devices. For more information, see [Delivery Optimization settings in Microsoft Intune](https://docs.microsoft.com/intune/delivery-optimization-windows)) + +**Starting with Windows 10, version 1903,** you can use the Azure Active Directory (AAD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. + +## Reference + +For complete list of every possible Delivery Optimization setting, see [Delivery Optimization reference](waas-delivery-optimization-reference.md). + + +## How Microsoft uses Delivery Optimization +At Microsoft, to help ensure that ongoing deployments weren’t affecting our network and taking away bandwidth for other services, Microsoft IT used a couple of different bandwidth management strategies. Delivery Optimization, peer-to-peer caching enabled through Group Policy, was piloted and then deployed to all managed devices using Group Policy. Based on recommendations from the Delivery Optimization team, we used the "group" configuration to limit sharing of content to only the devices that are members of the same Active Directory domain. The content is cached for 24 hours. More than 76 percent of content came from peer devices versus the Internet. + +For more details, check out the [Adopting Windows as a Service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) technical case study. + + + +## Frequently asked questions + +**Does Delivery Optimization work with WSUS?**: Yes. Devices will obtain the update payloads from the WSUS server, but must also have an internet connection as they communicate with the Delivery Optimization cloud service for coordination. + +**Which ports does Delivery Optimization use?**: Delivery Optimization listens on port 7680 for requests from other peers by using TCP/IP. The service will register and open this port on the device, but you might need to set this port to accept inbound traffic through your firewall yourself. If you don't allow inbound traffic over port 7680, you can't use the peer-to-peer functionality of Delivery Optimization. However, devices can still successfully download by using HTTP or HTTPS traffic over port 80 (such as for default Windows Update data). + +If you set up Delivery Optimization to create peer groups that include devices across NATs (or any form of internal subnet that uses gateways or firewalls between subnets), it will use Teredo. For this to work, you must allow inbound TCP/IP traffic over port 3544. Look for a "NAT traversal" setting in your firewall to set this up. + +Delivery Optimization also communicates with its cloud service by using HTTP/HTTPS over port 80. + + +**What are the requirements if I use a proxy?**: You must allow Byte Range requests. See [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update) for details. + +**What hostnames should I allow through my firewall to support Delivery Optimization?**: + +For communication between clients and the Delivery Optimization cloud service: **\*.do.dsp.mp.microsoft.com**. + +For Delivery Optimization metadata: + +- *.dl.delivery.mp.microsoft.com +- *.emdl.ws.microsoft.com + +For the payloads (optional): + +- *.download.windowsupdate.com +- *.windowsupdate.com + +**Does Delivery Optimization use multicast?**: No. It relies on the cloud service for peer discovery, resulting in a list of peers and their IP addresses. Client devices then connect to their peers to obtain download files over TCP/IP. + +**How does Delivery Optimization deal with congestion on the router from peer-to-peer activity on the LAN?**: Starting in Windows 10, version 1903, Delivery Optimization uses LEDBAT to relieve such congestion. For more details see this post on the [Networking Blog](https://techcommunity.microsoft.com/t5/Networking-Blog/Windows-Transport-converges-on-two-Congestion-Providers-Cubic/ba-p/339819). + + +## Troubleshooting + +This section summarizes common problems and some solutions to try. + +### If you don't see any bytes from peers + +If you don’t see any bytes coming from peers the cause might be one of the following issues: + +- Clients aren’t able to reach the Delivery Optimization cloud services. +- The cloud service doesn’t see other peers on the network. +- Clients aren’t able to connect to peers that are offered back from the cloud service. + + +### Clients aren't able to reach the Delivery Optimization cloud services. + +If you suspect this is the problem, try these steps: + +1. Start a download of an app that is larger than 50 MB from the Store (for example "Candy Crush Saga"). +2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and observe the DownloadMode setting. For peering to work, DownloadMode should be 1, 2, or 3. +3. If **DownloadMode** is 99 it could indicate your device is unable to reach the Delivery Optimization cloud services. Ensure that the Delivery Optimization hostnames are allowed access: most importantly **\*.do.dsp.mp.microsoft.com**. + + + +### The cloud service doesn't see other peers on the network. + +If you suspect this is the problem, try these steps: + +1. Download the same app on two different devices on the same network, waiting 10 – 15 minutes between downloads. +2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and ensure that **DownloadMode** is 1 or 2 on both devices. +3. Run `Get-DeliveryOptimizationPerfSnap` from an elevated Powershell window on the second device. The **NumberOfPeers** field should be non-zero. +4. If the number of peers is zero and you have **DownloadMode** = 1, ensure that both devices are using the same public IP address to reach the internet. To do this, open a browser Windows and search for “what is my IP”. You can **DownloadMode 2** (Group) and a custom GroupID (Guid) to fix this if the devices aren’t reporting the same public IP address. + + +### Clients aren't able to connect to peers offered by the cloud service + +If you suspect this is the problem, try a Telnet test between two devices on the network to ensure they can connect using port 7680. To do this, follow these steps: + +1. Install Telnet by running **dism /online /Enable-Feature /FeatureName:TelnetClient** from an elevated command prompt. +2. Run the test. For example, if you are on device with IP 192.168.8.12 and you are trying to test the connection to 192.168.9.17 run **telnet 192.168.9.17 7680** (the syntax is *telnet [destination IP] [port]*. You will either see a connection error or a blinking cursor like this /_. The blinking cursor means success. + + + + + +## Learn more + +[Windows 10, Delivery Optimization, and WSUS](https://blogs.technet.microsoft.com/mniehaus/2016/08/16/windows-10-delivery-optimization-and-wsus-take-2/) + + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-deployment-rings-windows-10-updates.md b/windows/deployment/update/waas-deployment-rings-windows-10-updates.md index d9effb684b..30023d81bb 100644 --- a/windows/deployment/update/waas-deployment-rings-windows-10-updates.md +++ b/windows/deployment/update/waas-deployment-rings-windows-10-updates.md @@ -1,74 +1,74 @@ ---- -title: Build deployment rings for Windows 10 updates (Windows 10) -description: Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.author: greglin -ms.date: 07/11/2018 -ms.reviewer: -manager: laurawi -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Build deployment rings for Windows 10 updates - - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - -For Windows as a service, maintenance is ongoing and iterative. Deploying previous versions of Windows required organizations to build sets of users to roll out the changes in phases. Typically, these users ranged (in order) from the most adaptable and least risky to the least adaptable or riskiest. With Windows 10, a similar methodology exists, but construction of the groups is a little different. - -Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. They are simply a method by which to separate machines into a deployment timeline. With Windows 10, you construct deployment rings a bit differently in each servicing tool, but the concepts remain the same. Each deployment ring should reduce the risk of issues derived from the deployment of the feature updates by gradually deploying the update to entire departments. As previously mentioned, consider including a portion of each department’s employees in several deployment rings. - -Defining deployment rings is generally a one-time event (or at least infrequent), but IT should revisit these groups to ensure that the sequencing is still correct. Also, there are times in which client computers could move between different deployment rings when necessary. - -Table 1 provides an example of the deployment rings you might use. - -**Table 1** - -| Deployment ring | Servicing channel | Deferral for feature updates | Deferral for quality updates | Example | -| --- | --- | --- | --- | --- | -| Preview | Windows Insider Program | None | None | A few machines to evaluate early builds prior to their arrival to the semi-annual channel | -| Targeted | Semi-annual channel (Targeted) | None | None | Select devices across various teams used to evaluate the major release prior to broad deployment | -| Broad | Semi-annual channel | 120 days | 7-14 days | Broadly deployed to most of the organization and monitored for feedback
                        Pause updates if there are critical issues | -| Critical | Semi-annual channel | 180 days | 30 days | Devices that are critical and will only receive updates once they've been vetted for a period of time by the majority of the organization | - ->[!NOTE] ->In this example, there are no rings made up of the long-term servicing channel (LTSC). The LTSC does not receive feature updates. - - -As Table 1 shows, each combination of servicing channel and deployment group is tied to a specific deployment ring. As you can see, the associated groups of devices are combined with a servicing channel to specify which deployment ring those devices and their users fall into. The naming convention used to identify the rings is completely customizable as long as the name clearly identifies the sequence. Deployment rings represent a sequential deployment timeline, regardless of the servicing channel they contain. Deployment rings will likely rarely change for an organization, but they should be periodically assessed to ensure that the deployment cadence still makes sense. - - -## Steps to manage updates for Windows 10 - -| | | -| --- | --- | -| ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | -| ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | -| ![done](images/checklistdone.png) | Build deployment rings for Windows 10 updates (this topic) | -| ![to do](images/checklistbox.gif) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                        or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Manage software updates in Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) -- [Manage device restarts after updates](waas-restart.md) - +--- +title: Build deployment rings for Windows 10 updates (Windows 10) +description: Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Build deployment rings for Windows 10 updates + + +**Applies to** + +- Windows 10 + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +> [!NOTE] +> We're in the process of updating this topic with more definitive guidance. In the meantime, see [this post](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Tactical-considerations-for-creating-Windows-deployment-rings/ba-p/746979) on the Windows 10 IT Pro blog for some great suggestions for a deployment ring structure. + +For Windows as a service, maintenance is ongoing and iterative. Deploying previous versions of Windows required organizations to build sets of users to roll out the changes in phases. Typically, these users ranged (in order) from the most adaptable and least risky to the least adaptable or riskiest. With Windows 10, a similar methodology exists, but construction of the groups is a little different. + +Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. They are simply a method by which to separate machines into a deployment timeline. With Windows 10, you construct deployment rings a bit differently in each servicing tool, but the concepts remain the same. Each deployment ring should reduce the risk of issues derived from the deployment of the feature updates by gradually deploying the update to entire departments. As previously mentioned, consider including a portion of each department’s employees in several deployment rings. + +Defining deployment rings is generally a one-time event (or at least infrequent), but IT should revisit these groups to ensure that the sequencing is still correct. Also, there are times in which client computers could move between different deployment rings when necessary. + +Table 1 provides an example of the deployment rings you might use. + +**Table 1** + +| Deployment ring | Servicing channel | Deferral for feature updates | Deferral for quality updates | Example | +| --- | --- | --- | --- | --- | +| Preview | Windows Insider Program | None | None | A few machines to evaluate early builds prior to their arrival to the semi-annual channel | +| Broad | Semi-annual channel | 120 days | 7-14 days | Broadly deployed to most of the organization and monitored for feedback
                        Pause updates if there are critical issues | +| Critical | Semi-annual channel | 180 days | 30 days | Devices that are critical and will only receive updates once they've been vetted for a period of time by the majority of the organization | + +>[!NOTE] +>In this example, there are no rings made up of the long-term servicing channel (LTSC). The LTSC does not receive feature updates. + + +As Table 1 shows, each combination of servicing channel and deployment group is tied to a specific deployment ring. As you can see, the associated groups of devices are combined with a servicing channel to specify which deployment ring those devices and their users fall into. The naming convention used to identify the rings is completely customizable as long as the name clearly identifies the sequence. Deployment rings represent a sequential deployment timeline, regardless of the servicing channel they contain. Deployment rings will likely rarely change for an organization, but they should be periodically assessed to ensure that the deployment cadence still makes sense. + + +## Steps to manage updates for Windows 10 + +| | | +| --- | --- | +| ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | +| ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | +| ![done](images/checklistdone.png) | Build deployment rings for Windows 10 updates (this topic) | +| ![to do](images/checklistbox.gif) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | +| ![to do](images/checklistbox.gif) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | +| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                        or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Manage software updates in Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Manage device restarts after updates](waas-restart.md) + diff --git a/windows/deployment/update/waas-integrate-wufb.md b/windows/deployment/update/waas-integrate-wufb.md index 5cf9e1b52e..1bc196ce0e 100644 --- a/windows/deployment/update/waas-integrate-wufb.md +++ b/windows/deployment/update/waas-integrate-wufb.md @@ -1,116 +1,115 @@ ---- -title: Integrate Windows Update for Business with management solutions (Windows 10) -description: Use Windows Update for Business deployments with management tools such as Windows Server Update Services (WSUS) and System Center Configuration Manager. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.author: greglin -ms.date: 07/27/2017 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Integrate Windows Update for Business with management solutions - - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - -You can integrate Windows Update for Business deployments with existing management tools such as Windows Server Update Services (WSUS) and System Center Configuration Manager. - -## Integrate Windows Update for Business with Windows Server Update Services - - -For Windows 10, version 1607, devices can now be configured to receive updates from both Windows Update (or Microsoft Update) and Windows Server Update Services (WSUS). In a joint WSUS and Windows Update for Business setup: - -- Devices will receive their Windows content from Microsoft and defer these updates according to Windows Update for Business policy -- All other content synced from WSUS will be directly applied to the device; that is, updates to products other than Windows will not follow your Windows Update for Business deferral policies - -### Configuration example \#1: Deferring Windows Update updates with other update content hosted on WSUS - -**Configuration:** - -- Device is configured to defer Windows Quality Updates using Windows Update for Business -- Device is also configured to be managed by WSUS -- Device is not configured to enable Microsoft Update (**Update/AllowMUUpdateService** = not enabled) -- Admin has opted to put updates to Office and other products on WSUS -- Admin has also put 3rd party drivers on WSUS - -
                        CmdletUse this cmdlet toSyntax
                        Add-ProvisioningPackage Apply a provisioning packageAdd-ProvisioningPackage [-Path] <string> [-ForceInstall] [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                        Add-ProvisioningPackage Apply a provisioning packageAdd-ProvisioningPackage [-Path] <string> [-ForceInstall] [-LogsFolder <string>] [-QuietInstall] [-WprpFile <string>] [<CommonParameters>]
                        Remove-ProvisioningPackageRemove a provisioning package Remove-ProvisioningPackage -PackageId <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                        Remove-ProvisioningPackage -Path <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                        Remove-ProvisioningPackage -AllInstalledPackages [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                        Get-ProvisioningPackage Get information about an installed provisioning package Get-ProvisioningPackage -PackageId <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                        Get-ProvisioningPackage -Path <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                        Get-ProvisioningPackage -AllInstalledPackages [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                        Export-ProvisioningPackage Extract the contents of a provisioning package Export-ProvisioningPackage -PackageId <string> -OutputFolder <string> [-Overwrite] [-AnswerFileOnly] [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                        Export-ProvisioningPackage -Path <string> -OutputFolder <string> [-Overwrite] [-AnswerFileOnly] [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                        - - - -
                        ContentMetadata sourcePayload sourceDeferred?
                        Updates to WindowsWindows UpdateWindows UpdateYesdiagram of content flow
                        Updates to Office and other productsWSUSWSUSNo
                        Third-party driversWSUSWSUSNo
                        - -### Configuration example \#2: Excluding drivers from Windows Quality Updates using Windows Update for Business - -**Configuration:** - -- Device is configured to defer Windows Quality Updates and to exclude drivers from Windows Update Quality Updates (**ExcludeWUDriversInQualityUpdate** = enabled) -- Device is also configured to be managed by WSUS -- Admin has opted to put Windows Update drivers on WSUS - - - - - - - -
                        ContentMetadata sourcePayload sourceDeferred?
                        Updates to Windows (excluding drivers)Windows UpdateWindows UpdateYesdiagram of content flow
                        Updates to Office and other productsWSUSWSUSNo
                        DriversWSUSWSUSNo
                        - -### Configuration example \#3: Device configured to receive Microsoft updates - -**Configuration:** - -- Device is configured to defer Quality Updates using Windows Update for Business and to be managed by WSUS -- Device is configured to “receive updates for other Microsoft products” along with updates to Windows (**Update/AllowMUUpdateService** = enabled) -- Admin has also placed Microsoft Update, third-paprty, and locally-published update content on the WSUS server - -In this example, the deferral behavior for updates to Office and other non-Windows products is slightly different than if WSUS were not enabled. -- In a non-WSUS case, these updates would be deferred just as any update to Windows would be. -- However, with WSUS also configured, these updates are sourced from Microsoft but deferral policies are not applied. - - - - - - -
                        ContentMetadata sourcePayload sourceDeferred?
                        Updates to Windows (excluding drivers)Microsoft UpdateMicrosoft UpdateYesdiagram of content flow
                        Updates to Office and other productsMicrosoft UpdateMicrosoft UpdateNo
                        Drivers, third-party applicationsWSUSWSUSNo
                        - ->[!NOTE] -> Because the admin enabled **Update/AllowMUUpdateService**, placing the content on WSUS was not needed for the particular device, as the device will always receive Microsoft Update content from Microsoft when configured in this manner. - -## Integrate Windows Update for Business with System Center Configuration Manager - -For Windows 10, version 1607, organizations already managing their systems with a Configuration Manager solution can also have their devices configured for Windows Update for Business (i.e. setting deferral policies on those devices). Such devices will be visible in the Configuration Manager console, however they will appear with a detection state of **Unknown**. - -![Example of unknown devices](images/wufb-sccm.png) - -For more information, see [Integration with Windows Update for Business in Windows 10](https://docs.microsoft.com/sccm/sum/deploy-use/integrate-windows-update-for-business-windows-10). - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Overview of Windows as a service](waas-overview.md) -- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) -- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) -- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) -- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) -- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) -- [Manage device restarts after updates](waas-restart.md) - +--- +title: Integrate Windows Update for Business with management solutions (Windows 10) +description: Use Windows Update for Business deployments with management tools such as Windows Server Update Services (WSUS) and System Center Configuration Manager. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: greg-lindsay +ms.localizationpriority: medium +ms.author: greglin +ms.date: 07/27/2017 +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Integrate Windows Update for Business with management solutions + + +**Applies to** + +- Windows 10 + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +You can integrate Windows Update for Business deployments with existing management tools such as Windows Server Update Services (WSUS) and System Center Configuration Manager. + +## Integrate Windows Update for Business with Windows Server Update Services + + +For Windows 10, version 1607, devices can now be configured to receive updates from both Windows Update (or Microsoft Update) and Windows Server Update Services (WSUS). In a joint WSUS and Windows Update for Business setup: + +- Devices will receive their Windows content from Microsoft and defer these updates according to Windows Update for Business policy +- All other content synced from WSUS will be directly applied to the device; that is, updates to products other than Windows will not follow your Windows Update for Business deferral policies + +### Configuration example \#1: Deferring Windows Update updates with other update content hosted on WSUS + +**Configuration:** + +- Device is configured to defer Windows Quality Updates using Windows Update for Business +- Device is also configured to be managed by WSUS +- Device is not configured to enable Microsoft Update (**Update/AllowMUUpdateService** = not enabled) +- Admin has opted to put updates to Office and other products on WSUS +- Admin has also put 3rd party drivers on WSUS + + + + + +
                        ContentMetadata sourcePayload sourceDeferred?
                        Updates to WindowsWindows UpdateWindows UpdateYesdiagram of content flow
                        Updates to Office and other productsWSUSWSUSNo
                        Third-party driversWSUSWSUSNo
                        + +### Configuration example \#2: Excluding drivers from Windows Quality Updates using Windows Update for Business + +**Configuration:** + +- Device is configured to defer Windows Quality Updates and to exclude drivers from Windows Update Quality Updates (**ExcludeWUDriversInQualityUpdate** = enabled) +- Device is also configured to be managed by WSUS +- Admin has opted to put Windows Update drivers on WSUS + + + + + + + +
                        ContentMetadata sourcePayload sourceDeferred?
                        Updates to Windows (excluding drivers)Windows UpdateWindows UpdateYesdiagram of content flow
                        Updates to Office and other productsWSUSWSUSNo
                        DriversWSUSWSUSNo
                        + +### Configuration example \#3: Device configured to receive Microsoft updates + +**Configuration:** + +- Device is configured to defer Quality Updates using Windows Update for Business and to be managed by WSUS +- Device is configured to “receive updates for other Microsoft products” along with updates to Windows (**Update/AllowMUUpdateService** = enabled) +- Admin has also placed Microsoft Update, third-paprty, and locally-published update content on the WSUS server + +In this example, the deferral behavior for updates to Office and other non-Windows products is slightly different than if WSUS were not enabled. +- In a non-WSUS case, these updates would be deferred just as any update to Windows would be. +- However, with WSUS also configured, these updates are sourced from Microsoft but deferral policies are not applied. + + + + + + +
                        ContentMetadata sourcePayload sourceDeferred?
                        Updates to Windows (excluding drivers)Microsoft UpdateMicrosoft UpdateYesdiagram of content flow
                        Updates to Office and other productsMicrosoft UpdateMicrosoft UpdateNo
                        Drivers, third-party applicationsWSUSWSUSNo
                        + +>[!NOTE] +> Because the admin enabled **Update/AllowMUUpdateService**, placing the content on WSUS was not needed for the particular device, as the device will always receive Microsoft Update content from Microsoft when configured in this manner. + +## Integrate Windows Update for Business with System Center Configuration Manager + +For Windows 10, version 1607, organizations already managing their systems with a Configuration Manager solution can also have their devices configured for Windows Update for Business (i.e. setting deferral policies on those devices). Such devices will be visible in the Configuration Manager console, however they will appear with a detection state of **Unknown**. + +![Example of unknown devices](images/wufb-sccm.png) + +For more information, see [Integration with Windows Update for Business in Windows 10](https://docs.microsoft.com/sccm/sum/deploy-use/integrate-windows-update-for-business-windows-10). + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Manage device restarts after updates](waas-restart.md) + diff --git a/windows/deployment/update/waas-manage-updates-configuration-manager.md b/windows/deployment/update/waas-manage-updates-configuration-manager.md index 13b782b7e4..5ab254f79d 100644 --- a/windows/deployment/update/waas-manage-updates-configuration-manager.md +++ b/windows/deployment/update/waas-manage-updates-configuration-manager.md @@ -1,334 +1,332 @@ ---- -title: Deploy Windows 10 updates using System Center Configuration Manager (Windows 10) -description: System Center Configuration Manager provides maximum control over quality and feature updates for Windows 10. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.author: greglin -ms.date: 10/16/2017 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Deploy Windows 10 updates using System Center Configuration Manager - - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - ->[!IMPORTANT] ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products. -> ->In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. - -System Center Configuration Manager provides maximum control over quality and feature updates for Windows 10. Unlike other servicing tools, Configuration Manager has capabilities that extend beyond servicing, such as application deployment, antivirus management, software metering, and reporting, and provides a secondary deployment method for LTSB clients. Configuration Manager can effectively control bandwidth usage and content distribution through a combination of BranchCache and distribution points. Microsoft encourages organizations currently using Configuration Manager for Windows update management to continue doing so for Windows 10 client computers. - -You can use Configuration Manager to service Windows 10 devices in two ways. The first option is to use Windows 10 Servicing Plans to deploy Windows 10 feature updates automatically based on specific criteria, similar to an Automatic Deployment Rule for software updates. The second option is to use a task sequence to deploy feature updates, along with anything else in the installation. - ->[!NOTE] ->This topic focuses on updating and upgrading Windows 10 after it has already been deployed. To use Configuration Manager to upgrade your systems from the Windows 8.1, Windows 8, or Windows 7 operating system, see [Upgrade to Windows 10 with System Center Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager). - -## Windows 10 servicing dashboard - -The Windows 10 servicing dashboard gives you a quick-reference view of your active servicing plans, compliance for servicing plan deployment, and other key information about Windows 10 servicing. For details about what each tile on the servicing dashboard represents, see [Manage Windows as a service using System Center Configuration Manager](https://technet.microsoft.com/library/mt627931.aspx). - -For the Windows 10 servicing dashboard to display information, you must adhere to the following requirements: - -- **Heartbeat discovery**. Enable heartbeat discovery for the site receiving Windows 10 servicing information. Configuration for heartbeat discovery can be found in Administration\Overview\Hierarchy Configuration\Discovery Methods. -- **Windows Server Update Service (WSUS)**. System Center Configuration Manager must have the Software update point site system role added and configured to receive updates from a WSUS 4.0 server with the hotfix KB3095113 installed. -- **Service connection point**. Add the Service connection point site system role in Online, persistent connection mode. -- **Upgrade classification**. Select **Upgrade** from the list of synchronized software update classifications. - - **To configure Upgrade classification** - - 1. Go to Administration\Overview\Site Configuration\Sites, and then select your site from the list. - - 2. On the Ribbon, in the **Settings** section, click **Configure Site Components**, and then click **Software Update Point**. - - ![Example of UI](images/waas-sccm-fig1.png) - - 3. In the **Software Update Point Component Properties** dialog box, on the **Classifications** tab, click **Upgrades**. - -When you have met all these requirements and deployed a servicing plan to a collection, you’ll receive information on the Windows 10 servicing dashboard. - -## Create collections for deployment rings - -Regardless of the method by which you deploy Windows 10 feature updates to your environment, you must start the Windows 10 servicing process by creating collections of computers that represent your deployment rings. In this example, you create two collections: **Windows 10 – All Current Branch for Business** and **Ring 4 Broad business users**. You’ll use the **Windows 10 – All Current Branch for Business** collection for reporting and deployments that should go to all CBB clients. You’ll use the **Ring 4 Broad business users** collection as a deployment ring for the first CBB users. - ->[!NOTE] ->The following procedures use the groups from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) as examples. - -**To create collections for deployment rings** - -1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. - -2. On the Ribbon, in the **Create** group, click **Create Device Collection**. - -3. In the Create Device Collection Wizard, in the **name** box, type **Windows 10 – All Current Branch for Business**. - -4. Click **Browse** to select the limiting collection, and then click **All Systems**. - -5. In **Membership rules**, click **Add Rule**, and then click **Query Rule**. - -6. Name the rule **CBB Detection**, and then click **Edit Query Statement**. - -7. On the **Criteria** tab, click the **New** icon. - - ![Example of UI](images/waas-sccm-fig4.png) - -8. In the **Criterion Properties** dialog box, leave the type as **Simple Value**, and then click **Select**. - -9. In the **Select Attribute** dialog box, from the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **OSBranch**, and then click **OK**. - - ![Example of UI](images/waas-sccm-fig5.png) - - >[!NOTE] - >Configuration Manager discovers clients’ servicing branch and stores that value in the **OSBranch** attribute, which you will use to create collections based on servicing branch. The values in this attribute can be **0 (Current Branch)**, **1 (Current Branch for Business)**, or **2 (Long-Term Servicing Branch)**. - -10. Leave **Operator** set to **is equal to**; in the **Value** box, type **1**. Click **OK**. - - ![Example of UI](images/waas-sccm-fig6.png) - -11. Now that the **OSBranch** attribute is correct, verify the operating system version. - -12. On the **Criteria** tab, click the **New** icon again to add criteria. - -13. In the **Criterion Properties** dialog box, click **Select**. - -14. From the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **Operating System Name and Version**, and then click **OK**. - - ![Example of UI](images/waas-sccm-fig7.png) - -15. In the **Value** box, type **Microsoft Windows NT Workstation 10.0**, and then click **OK**. - - ![Example of UI](images/waas-sccm-fig8.png) - -16. In the **Query Statement Properties** dialog box, you see two values. Click **OK**, and then click **OK** again to continue to the Create Device Collection Wizard. - -17. Click **Summary**, and then click **Next**. - -18. Close the wizard. - ->[!IMPORTANT] ->Windows Insider PCs are discovered the same way as CB or CBB devices. If you have Windows Insider PCs that you use Configuration Manager to manage, then you should create a collection of those PCs and exclude them from this collection. You can create the membership for the Windows Insider collection either manually or by using a query where the operating system build doesn’t equal any of the current CB or CBB build numbers. You would have to update each periodically to include new devices or new operating system builds. - -After you have updated the membership, this new collection will contain all managed clients on the CBB servicing branch. You will use this collection as a limiting collection for future CBB-based collections and the **Ring 4 Broad broad business users** collection. Complete the following steps to create the **Ring 4 Broad business users** device collection, which you’ll use as a CBB deployment ring for servicing plans or task sequences. - -1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. - -2. On the Ribbon, in the **Create** group, click **Create Device Collection**. - -3. In the Create Device Collection Wizard, in the **name** box, type **Ring 4 Broad business users**. - -4. Click **Browse** to select the limiting collection, and then click **Windows 10 – All Current Branch for Business**. - -5. In **Membership rules**, click **Add Rule**, and then click **Direct Rule**. - -6. In the **Create Direct Membership Rule Wizard** dialog box, click **Next**. - -7. In the **Value** field, type all or part of the name of a device to add, and then click **Next**. - -8. Select the computer that will be part of the **Ring 4 Broad business users** deployment ring, and then click **Next**. - -9. Click **Next**, and then click **Close**. - -10. In the **Create Device Collection Wizard** dialog box, click **Summary**. - -11. Click **Next**, and then click **Close**. - - -## Use Windows 10 servicing plans to deploy Windows 10 feature updates - -There are two ways to deploy Windows 10 feature updates with System Center Configuration Manager. The first is to use servicing plans, which provide an automated method to update devices consistently in their respective deployment rings, similar to Automatic Deployment Rules for software updates. - -**To configure Windows feature updates for CBB clients in the Ring 4 Broad business users deployment ring using a servicing plan** - -1. In the Configuration Manager console, go to Software Library\Overview\Windows 10 Servicing, and then click **Servicing Plans**. - -2. On the Ribbon, in the **Create** group, click **Create Servicing Plan**. - -3. Name the plan **Ring 4 Broad business users Servicing Plan**, and then click **Next**. - -4. On the **Servicing Plan page**, click **Browse**. Select the **Ring 4 Broad business users** collection, which you created in the [Create collections for deployment rings](#create-collections-for-deployment-rings) section, click **OK**, and then click **Next**. - - >[!IMPORTANT] - >Microsoft added a new protection feature to Configuration Manager that prevents accidental installation of high-risk deployments such as operating system upgrades on site systems. If you select a collection (All Systems in this example) that has a site system in it, you may receive the following message. - > - >![This is a high-risk deployment](images/waas-sccm-fig9.png) - > - >For details about how to manage the settings for high-risk deployments in Configuration Manager, see [Settings to manage high-risk deployments for System Center Configuration Manager](https://technet.microsoft.com/library/mt621992.aspx). - -5. On the **Deployment Ring** page, select the **Business Ready (Current Branch for Business)** readiness state, leave the delay at **0 days**, and then click **Next**. - - Doing so deploys CBB feature updates to the broad business users deployment ring immediately after they are released to CBB. - - On the Upgrades page, you specify filters for the feature updates to which this servicing plan is applicable. For example, if you wanted this plan to be only for Windows 10 Enterprise, you could select **Title**, and then type **Enterprise**. - -6. For this example, on the **Upgrades** page, click **Next** to leave the criterion blank. - -7. On the **Deployment Schedule** page, click **Next** to keep the default values of making the content available immediately and requiring installation by the 7-day deadline. - -8. On the **User Experience** page, from the **Deadline behavior** list, select **Software Installation and System restart (if necessary)**. From the **Device restart behavior** list, select **Workstations**, and then click **Next**. - - Doing so allows installation and restarts after the 7-day deadline on workstations only. - -9. On the **Deployment Package** page, select **Create a new deployment package**. In **Name**, type **CBB Upgrades**, select a share for your package source location, and then click **Next**. - - In this example, \\contoso-cm01\Sources\Windows 10 Feature Upgrades is a share on the Configuration Manager server that contains all the Windows 10 feature updates. - - ![Example of UI](images/waas-sccm-fig10.png) - -10. On the **Distribution Points** page, from the **Add** list, select **Distribution Point**. - - ![Example of UI](images/waas-sccm-fig11.png) - - Select the distribution points that serve the clients to which you’re deploying this servicing plan, and then click **OK**. - -11. Click **Summary**, click **Next** to complete the servicing plan, and then click **Close**. - - -You have now created a servicing plan for the **Ring 4 Broad business users** deployment ring. By default, this rule is evaluated each time the software update point is synchronized, but you can modify this schedule by viewing the service plan’s properties on the **Evaluation Schedule** tab. - -![Example of UI](images/waas-sccm-fig12.png) - - -## Use a task sequence to deploy Windows 10 updates - -There are times when deploying a Windows 10 feature update requires the use of a task sequence—for example: - -- **LTSB feature updates**. With the LTSB servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade. -- **Additional required tasks**. When deploying a feature update requires additional steps (e.g., suspending disk encryption, updating applications), you must use task sequences to orchestrate the additional steps. Servicing plans do not have the ability to add steps to their deployments. - -Each time Microsoft releases a new Windows 10 build, it releases a new .iso file containing the latest build, as well. Regardless of the scenario that requires a task sequence to deploy the Windows 10 upgrade, the base process is the same. Start by creating an Operating System Upgrade Package in the Configuration Manager console: - -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages. - -2. On the Ribbon, in the **Create** group, click **Add Operating System Upgrade Package**. - -3. On the **Data Source** page, type the path of the extracted .iso file of the new version of Windows 10 you’re deploying, and then click **Next**. - - In this example, the Windows 10 Enterprise 1607 installation media is deployed to \\contoso-cm01\Sources\Operating Systems\Windows 10 Enterprise\Windows 10 Enterprise - Version 1607. - - >[!NOTE] - >System Center Configuration Manager version 1606 is required to manage machines running Windows 10, version 1607. - -4. On the **General** page, in the **Name** field, type the name of the folder (**Windows 10 Enterprise - Version 1607** in this example). Set the **Version** to **1607**, and then click **Next**. - -5. On the **Summary** page, click **Next** to create the package. - -6. On the **Completion** page, click **Close**. - -Now that the operating system upgrade package has been created, the content in that package must be distributed to the correct distribution points so that the clients can access the content. Complete the following steps to distribute the package content to distribution points: - -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages, and then select the **Windows 10 Enterprise – Version 1607** software upgrade package. - -2. On the Ribbon, in the **Deployment group**, click **Distribute Content**. - -3. In the Distribute Content Wizard, on the **General** page, click **Next**. - -4. On the **Content Destination** page, click **Add**, and then click **Distribution Point**. - -5. In the **Add Distribution Points** dialog box, select the distribution point that will serve the clients receiving this package, and then click **OK**. - -6. On the **Content Destination** page, click **Next**. - -7. On the **Summary** page, click **Next** to distribute the content to the selected distribution point. - -8. On the **Completion** page, click **Close**. - -Now that the upgrade package has been created and its contents distributed, create the task sequence that will use it. Complete the following steps to create the task sequence, using the previously created deployment package: - -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences. - -2. On the Ribbon, in the **Create** group, click **Create Task Sequence**. - -3. In the Create Task Sequence Wizard, on the **Create a new task sequence** page, select **Upgrade an operating system from upgrade package**, and then click **Next**. - -4. On the **Task Sequence Information** page, in **Task sequence name**, type **Upgrade Windows 10 Enterprise – Version 1607**, and then click **Next**. - -5. On the **Upgrade the Windows Operating system** page, click **Browse**, select the deployment package you created in the previous steps, and then click **OK**. - -6. Click **Next**. - -7. On the **Include Updates** page, select **Available for installation – All software updates**, and then click **Next**. - -8. On the **Install Applications** page, click **Next**. - -9. On the **Summary** page, click **Next** to create the task sequence. - -10. On the **Completion** page, click **Close**. - -With the task sequence created, you’re ready to deploy it. If you’re using this method to deploy most of your Windows 10 feature updates, you may want to create deployment rings to stage the deployment of this task sequence, with delays appropriate for the respective deployment ring. In this example, you deploy the task sequence to the **Ring 4 Broad business users collection**. - ->[!IMPORTANT] ->This process deploys a Windows 10 operating system feature update to the affected devices. If you’re testing, be sure to select the collection to which you deploy this task sequence carefully. - -**To deploy your task sequence** - -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences, and then select the **Upgrade Windows 10 Enterprise – Version 1607** task sequence. - -2. On the Ribbon, in the **Deployment** group, click **Deploy**. - -3. In the Deploy Software Wizard, on the **General** page, click **Browse**. Select the target collection, click **OK**, and then click **Next**. - -4. On the **Deployment Settings** page, for **purpose**, select **Required**, and then click **Next**. - -5. On the **Scheduling** page, select the **Schedule when this deployment will become available** check box (it sets the current time by default). For **Assignment schedule**, click **New**. - -6. In the **Assignment Schedule** dialog box, click **Schedule**. - -7. In the **Custom Schedule** dialog box, select the desired deadline, and then click **OK**. - -8. In the **Assignment Schedule** dialog box, click **OK**, and then click **Next**. - -9. On the **User Experience** page, in the **When the scheduled assignment time is reached, allow the following activities to be performed outside of the maintenance window** section, select **Software Installation** and **System restart** (if required to complete the installation), and then click **Next**. - -10. Use the defaults for the remaining settings. - -11. Click **Summary**, and then click **Next** to deploy the task sequence. - -12. Click **Close**. - - -## Steps to manage updates for Windows 10 - -| | | -| --- | --- | -| ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | -| ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                        or Deploy Windows 10 updates using System Center Configuration Manager (this topic) | - -## See also - -[Manage Windows as a service using System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/manage-windows-as-a-service) - - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Overview of Windows as a service](waas-overview.md) -- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) -- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) -- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) -- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) -- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Manage device restarts after updates](waas-restart.md) - +--- +title: Deploy Windows 10 updates using System Center Configuration Manager (Windows 10) +description: System Center Configuration Manager provides maximum control over quality and feature updates for Windows 10. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Deploy Windows 10 updates using System Center Configuration Manager + + +**Applies to** + +- Windows 10 + + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +>[!IMPORTANT] +>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel. + + +System Center Configuration Manager provides maximum control over quality and feature updates for Windows 10. Unlike other servicing tools, Configuration Manager has capabilities that extend beyond servicing, such as application deployment, antivirus management, software metering, and reporting, and provides a secondary deployment method for LTSB clients. Configuration Manager can effectively control bandwidth usage and content distribution through a combination of BranchCache and distribution points. Microsoft encourages organizations currently using Configuration Manager for Windows update management to continue doing so for Windows 10 client computers. + +You can use Configuration Manager to service Windows 10 devices in two ways. The first option is to use Windows 10 Servicing Plans to deploy Windows 10 feature updates automatically based on specific criteria, similar to an Automatic Deployment Rule for software updates. The second option is to use a task sequence to deploy feature updates, along with anything else in the installation. + +>[!NOTE] +>This topic focuses on updating and upgrading Windows 10 after it has already been deployed. To use Configuration Manager to upgrade your systems from the Windows 8.1, Windows 8, or Windows 7 operating system, see [Upgrade to Windows 10 with System Center Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager). + +## Windows 10 servicing dashboard + +The Windows 10 servicing dashboard gives you a quick-reference view of your active servicing plans, compliance for servicing plan deployment, and other key information about Windows 10 servicing. For details about what each tile on the servicing dashboard represents, see [Manage Windows as a service using System Center Configuration Manager](https://technet.microsoft.com/library/mt627931.aspx). + +For the Windows 10 servicing dashboard to display information, you must adhere to the following requirements: + +- **Heartbeat discovery**. Enable heartbeat discovery for the site receiving Windows 10 servicing information. Configuration for heartbeat discovery can be found in Administration\Overview\Hierarchy Configuration\Discovery Methods. +- **Windows Server Update Service (WSUS)**. System Center Configuration Manager must have the Software update point site system role added and configured to receive updates from a WSUS 4.0 server with the hotfix KB3095113 installed. +- **Service connection point**. Add the Service connection point site system role in Online, persistent connection mode. +- **Upgrade classification**. Select **Upgrade** from the list of synchronized software update classifications. + + **To configure Upgrade classification** + + 1. Go to Administration\Overview\Site Configuration\Sites, and then select your site from the list. + + 2. On the Ribbon, in the **Settings** section, click **Configure Site Components**, and then click **Software Update Point**. + + ![Example of UI](images/waas-sccm-fig1.png) + + 3. In the **Software Update Point Component Properties** dialog box, on the **Classifications** tab, click **Upgrades**. + +When you have met all these requirements and deployed a servicing plan to a collection, you’ll receive information on the Windows 10 servicing dashboard. + +## Create collections for deployment rings + +Regardless of the method by which you deploy Windows 10 feature updates to your environment, you must start the Windows 10 servicing process by creating collections of computers that represent your deployment rings. In this example, you create two collections: **Windows 10 – All Current Branch for Business** and **Ring 4 Broad business users**. You’ll use the **Windows 10 – All Current Branch for Business** collection for reporting and deployments that should go to all CBB clients. You’ll use the **Ring 4 Broad business users** collection as a deployment ring for the first CBB users. + +>[!NOTE] +>The following procedures use the groups from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) as examples. + +**To create collections for deployment rings** + +1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. + +2. On the Ribbon, in the **Create** group, click **Create Device Collection**. + +3. In the Create Device Collection Wizard, in the **name** box, type **Windows 10 – All Current Branch for Business**. + +4. Click **Browse** to select the limiting collection, and then click **All Systems**. + +5. In **Membership rules**, click **Add Rule**, and then click **Query Rule**. + +6. Name the rule **CBB Detection**, and then click **Edit Query Statement**. + +7. On the **Criteria** tab, click the **New** icon. + + ![Example of UI](images/waas-sccm-fig4.png) + +8. In the **Criterion Properties** dialog box, leave the type as **Simple Value**, and then click **Select**. + +9. In the **Select Attribute** dialog box, from the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **OSBranch**, and then click **OK**. + + ![Example of UI](images/waas-sccm-fig5.png) + + >[!NOTE] + >Configuration Manager discovers clients’ servicing branch and stores that value in the **OSBranch** attribute, which you will use to create collections based on servicing branch. The values in this attribute can be **0 (Current Branch)**, **1 (Current Branch for Business)**, or **2 (Long-Term Servicing Branch)**. + +10. Leave **Operator** set to **is equal to**; in the **Value** box, type **1**. Click **OK**. + + ![Example of UI](images/waas-sccm-fig6.png) + +11. Now that the **OSBranch** attribute is correct, verify the operating system version. + +12. On the **Criteria** tab, click the **New** icon again to add criteria. + +13. In the **Criterion Properties** dialog box, click **Select**. + +14. From the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **Operating System Name and Version**, and then click **OK**. + + ![Example of UI](images/waas-sccm-fig7.png) + +15. In the **Value** box, type **Microsoft Windows NT Workstation 10.0**, and then click **OK**. + + ![Example of UI](images/waas-sccm-fig8.png) + +16. In the **Query Statement Properties** dialog box, you see two values. Click **OK**, and then click **OK** again to continue to the Create Device Collection Wizard. + +17. Click **Summary**, and then click **Next**. + +18. Close the wizard. + +>[!IMPORTANT] +>Windows Insider PCs are discovered the same way as CB or CBB devices. If you have Windows Insider PCs that you use Configuration Manager to manage, then you should create a collection of those PCs and exclude them from this collection. You can create the membership for the Windows Insider collection either manually or by using a query where the operating system build doesn’t equal any of the current CB or CBB build numbers. You would have to update each periodically to include new devices or new operating system builds. + +After you have updated the membership, this new collection will contain all managed clients on the CBB servicing branch. You will use this collection as a limiting collection for future CBB-based collections and the **Ring 4 Broad broad business users** collection. Complete the following steps to create the **Ring 4 Broad business users** device collection, which you’ll use as a CBB deployment ring for servicing plans or task sequences. + +1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. + +2. On the Ribbon, in the **Create** group, click **Create Device Collection**. + +3. In the Create Device Collection Wizard, in the **name** box, type **Ring 4 Broad business users**. + +4. Click **Browse** to select the limiting collection, and then click **Windows 10 – All Current Branch for Business**. + +5. In **Membership rules**, click **Add Rule**, and then click **Direct Rule**. + +6. In the **Create Direct Membership Rule Wizard** dialog box, click **Next**. + +7. In the **Value** field, type all or part of the name of a device to add, and then click **Next**. + +8. Select the computer that will be part of the **Ring 4 Broad business users** deployment ring, and then click **Next**. + +9. Click **Next**, and then click **Close**. + +10. In the **Create Device Collection Wizard** dialog box, click **Summary**. + +11. Click **Next**, and then click **Close**. + + +## Use Windows 10 servicing plans to deploy Windows 10 feature updates + +There are two ways to deploy Windows 10 feature updates with System Center Configuration Manager. The first is to use servicing plans, which provide an automated method to update devices consistently in their respective deployment rings, similar to Automatic Deployment Rules for software updates. + +**To configure Windows feature updates for CBB clients in the Ring 4 Broad business users deployment ring using a servicing plan** + +1. In the Configuration Manager console, go to Software Library\Overview\Windows 10 Servicing, and then click **Servicing Plans**. + +2. On the Ribbon, in the **Create** group, click **Create Servicing Plan**. + +3. Name the plan **Ring 4 Broad business users Servicing Plan**, and then click **Next**. + +4. On the **Servicing Plan page**, click **Browse**. Select the **Ring 4 Broad business users** collection, which you created in the [Create collections for deployment rings](#create-collections-for-deployment-rings) section, click **OK**, and then click **Next**. + + >[!IMPORTANT] + >Microsoft added a new protection feature to Configuration Manager that prevents accidental installation of high-risk deployments such as operating system upgrades on site systems. If you select a collection (All Systems in this example) that has a site system in it, you may receive the following message. + > + >![This is a high-risk deployment](images/waas-sccm-fig9.png) + > + >For details about how to manage the settings for high-risk deployments in Configuration Manager, see [Settings to manage high-risk deployments for System Center Configuration Manager](https://technet.microsoft.com/library/mt621992.aspx). + +5. On the **Deployment Ring** page, select the **Business Ready (Current Branch for Business)** readiness state, leave the delay at **0 days**, and then click **Next**. + + Doing so deploys CBB feature updates to the broad business users deployment ring immediately after they are released to CBB. + + On the Upgrades page, you specify filters for the feature updates to which this servicing plan is applicable. For example, if you wanted this plan to be only for Windows 10 Enterprise, you could select **Title**, and then type **Enterprise**. + +6. For this example, on the **Upgrades** page, click **Next** to leave the criterion blank. + +7. On the **Deployment Schedule** page, click **Next** to keep the default values of making the content available immediately and requiring installation by the 7-day deadline. + +8. On the **User Experience** page, from the **Deadline behavior** list, select **Software Installation and System restart (if necessary)**. From the **Device restart behavior** list, select **Workstations**, and then click **Next**. + + Doing so allows installation and restarts after the 7-day deadline on workstations only. + +9. On the **Deployment Package** page, select **Create a new deployment package**. In **Name**, type **CBB Upgrades**, select a share for your package source location, and then click **Next**. + + In this example, \\contoso-cm01\Sources\Windows 10 Feature Upgrades is a share on the Configuration Manager server that contains all the Windows 10 feature updates. + + ![Example of UI](images/waas-sccm-fig10.png) + +10. On the **Distribution Points** page, from the **Add** list, select **Distribution Point**. + + ![Example of UI](images/waas-sccm-fig11.png) + + Select the distribution points that serve the clients to which you’re deploying this servicing plan, and then click **OK**. + +11. Click **Summary**, click **Next** to complete the servicing plan, and then click **Close**. + + +You have now created a servicing plan for the **Ring 4 Broad business users** deployment ring. By default, this rule is evaluated each time the software update point is synchronized, but you can modify this schedule by viewing the service plan’s properties on the **Evaluation Schedule** tab. + +![Example of UI](images/waas-sccm-fig12.png) + + +## Use a task sequence to deploy Windows 10 updates + +There are times when deploying a Windows 10 feature update requires the use of a task sequence—for example: + +- **LTSB feature updates**. With the LTSB servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade. +- **Additional required tasks**. When deploying a feature update requires additional steps (e.g., suspending disk encryption, updating applications), you must use task sequences to orchestrate the additional steps. Servicing plans do not have the ability to add steps to their deployments. + +Each time Microsoft releases a new Windows 10 build, it releases a new .iso file containing the latest build, as well. Regardless of the scenario that requires a task sequence to deploy the Windows 10 upgrade, the base process is the same. Start by creating an Operating System Upgrade Package in the Configuration Manager console: + +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages. + +2. On the Ribbon, in the **Create** group, click **Add Operating System Upgrade Package**. + +3. On the **Data Source** page, type the path of the extracted .iso file of the new version of Windows 10 you’re deploying, and then click **Next**. + + In this example, the Windows 10 Enterprise 1607 installation media is deployed to \\contoso-cm01\Sources\Operating Systems\Windows 10 Enterprise\Windows 10 Enterprise - Version 1607. + + >[!NOTE] + >System Center Configuration Manager version 1606 is required to manage machines running Windows 10, version 1607. + +4. On the **General** page, in the **Name** field, type the name of the folder (**Windows 10 Enterprise - Version 1607** in this example). Set the **Version** to **1607**, and then click **Next**. + +5. On the **Summary** page, click **Next** to create the package. + +6. On the **Completion** page, click **Close**. + +Now that the operating system upgrade package has been created, the content in that package must be distributed to the correct distribution points so that the clients can access the content. Complete the following steps to distribute the package content to distribution points: + +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages, and then select the **Windows 10 Enterprise – Version 1607** software upgrade package. + +2. On the Ribbon, in the **Deployment group**, click **Distribute Content**. + +3. In the Distribute Content Wizard, on the **General** page, click **Next**. + +4. On the **Content Destination** page, click **Add**, and then click **Distribution Point**. + +5. In the **Add Distribution Points** dialog box, select the distribution point that will serve the clients receiving this package, and then click **OK**. + +6. On the **Content Destination** page, click **Next**. + +7. On the **Summary** page, click **Next** to distribute the content to the selected distribution point. + +8. On the **Completion** page, click **Close**. + +Now that the upgrade package has been created and its contents distributed, create the task sequence that will use it. Complete the following steps to create the task sequence, using the previously created deployment package: + +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences. + +2. On the Ribbon, in the **Create** group, click **Create Task Sequence**. + +3. In the Create Task Sequence Wizard, on the **Create a new task sequence** page, select **Upgrade an operating system from upgrade package**, and then click **Next**. + +4. On the **Task Sequence Information** page, in **Task sequence name**, type **Upgrade Windows 10 Enterprise – Version 1607**, and then click **Next**. + +5. On the **Upgrade the Windows Operating system** page, click **Browse**, select the deployment package you created in the previous steps, and then click **OK**. + +6. Click **Next**. + +7. On the **Include Updates** page, select **Available for installation – All software updates**, and then click **Next**. + +8. On the **Install Applications** page, click **Next**. + +9. On the **Summary** page, click **Next** to create the task sequence. + +10. On the **Completion** page, click **Close**. + +With the task sequence created, you’re ready to deploy it. If you’re using this method to deploy most of your Windows 10 feature updates, you may want to create deployment rings to stage the deployment of this task sequence, with delays appropriate for the respective deployment ring. In this example, you deploy the task sequence to the **Ring 4 Broad business users collection**. + +>[!IMPORTANT] +>This process deploys a Windows 10 operating system feature update to the affected devices. If you’re testing, be sure to select the collection to which you deploy this task sequence carefully. + +**To deploy your task sequence** + +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences, and then select the **Upgrade Windows 10 Enterprise – Version 1607** task sequence. + +2. On the Ribbon, in the **Deployment** group, click **Deploy**. + +3. In the Deploy Software Wizard, on the **General** page, click **Browse**. Select the target collection, click **OK**, and then click **Next**. + +4. On the **Deployment Settings** page, for **purpose**, select **Required**, and then click **Next**. + +5. On the **Scheduling** page, select the **Schedule when this deployment will become available** check box (it sets the current time by default). For **Assignment schedule**, click **New**. + +6. In the **Assignment Schedule** dialog box, click **Schedule**. + +7. In the **Custom Schedule** dialog box, select the desired deadline, and then click **OK**. + +8. In the **Assignment Schedule** dialog box, click **OK**, and then click **Next**. + +9. On the **User Experience** page, in the **When the scheduled assignment time is reached, allow the following activities to be performed outside of the maintenance window** section, select **Software Installation** and **System restart** (if required to complete the installation), and then click **Next**. + +10. Use the defaults for the remaining settings. + +11. Click **Summary**, and then click **Next** to deploy the task sequence. + +12. Click **Close**. + + +## Steps to manage updates for Windows 10 + +| | | +| --- | --- | +| ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | +| ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | +| ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | +| ![done](images/checklistdone.png) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | +| ![done](images/checklistdone.png) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | +| ![done](images/checklistdone.png) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                        or Deploy Windows 10 updates using System Center Configuration Manager (this topic) | + +## See also + +[Manage Windows as a service using System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/manage-windows-as-a-service) + + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Manage device restarts after updates](waas-restart.md) + diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md index f9c378860b..cda79baf8e 100644 --- a/windows/deployment/update/waas-manage-updates-wsus.md +++ b/windows/deployment/update/waas-manage-updates-wsus.md @@ -1,360 +1,356 @@ ---- -title: Deploy Windows 10 updates using Windows Server Update Services (Windows 10) -description: WSUS allows companies to defer, selectively approve, choose when delivered, and determine which devices receive updates. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.author: greglin -ms.date: 10/16/2017 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Deploy Windows 10 updates using Windows Server Update Services (WSUS) - - -**Applies to** - -- Windows 10 - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - ->[!IMPORTANT] ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products. -> ->In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. - -WSUS is a Windows Server role available in the Windows Server operating systems. It provides a single hub for Windows updates within an organization. WSUS allows companies not only to defer updates but also to selectively approve them, choose when they’re delivered, and determine which individual devices or groups of devices receive them. WSUS provides additional control over Windows Update for Business but does not provide all the scheduling options and deployment flexibility that System Center Configuration Manager provides. - -When you choose WSUS as your source for Windows updates, you use Group Policy to point Windows 10 client devices to the WSUS server for their updates. From there, updates are periodically downloaded to the WSUS server and managed, approved, and deployed through the WSUS administration console or Group Policy, streamlining enterprise update management. If you’re currently using WSUS to manage Windows updates in your environment, you can continue to do so in Windows 10. - - - -## Requirements for Windows 10 servicing with WSUS - -To be able to use WSUS to manage and deploy Windows 10 feature updates, you must have WSUS 4.0, which is available in the Windows Server 2012 R2 and Windows Server 2012 operating systems. In addition to WSUS 4.0, you must install the [KB3095113](https://support.microsoft.com/kb/3095113) and [KB3159706](https://support.microsoft.com/kb/3159706) patches on the WSUS server. - -## WSUS scalability - -To use WSUS to manage all Windows updates, some organizations may need access to WSUS from a perimeter network, or they might have some other complex scenario. WSUS is highly scalable and configurable for organizations of any size or site layout. For specific information about scaling WSUS, including upstream and downstream server configuration, branch offices, WSUS load balancing, and other complex scenarios, see [Choose a Type of WSUS Deployment](https://technet.microsoft.com/library/cc720448%28v=ws.10%29.aspx). - - -## Express Installation Files - -With Windows 10, quality updates will be larger than traditional Windows Updates because they’re cumulative. To manage the bandwidth clients downloading large updates like these will need, WSUS has a feature called *Express Installation Files*. - - At a binary level, files associated with updates may not change a lot. In fact, with cumulative quality updates, most of the content will be from previous updates. Rather than downloading the entire update when only a small percentage of the payload is actually different, Express Installation Files analyze the differences between the new files associated with an update and the existing files on the client. This approach significantly reduces the amount of bandwidth used because only a fraction of the update content is actually delivered. - - **To configure WSUS to download Express Update Files** - -1. Open the WSUS Administration Console. - -2. In the navigation pane, go to *Your_Server*\\**Options**. - -3. In the **Options** section, click **Update Files and Languages**. - - ![Example of UI](images/waas-wsus-fig1.png) - -4. In the **Update Files and Languages** dialog box, select **Download express installation files**. - - ![Example of UI](images/waas-wsus-fig2.png) - - >[!NOTE] - >Because Windows 10 updates are cumulative, enabling Express Installation Files when WSUS is configured to download Windows 10 updates will significantly increase the amount of disk space that WSUS requires. Alternatively, when using Express Installation Files for previous versions of Windows, the feature’s positive effects aren’t noticeable because the updates aren’t cumulative. - -## Configure automatic updates and update service location - -When using WSUS to manage updates on Windows client devices, start by configuring the **Configure Automatic Updates** and **Intranet Microsoft Update Service Location** Group Policy settings for your environment. Doing so forces the affected clients to contact the WSUS server so that it can manage them. The following process describes how to specify these settings and deploy them to all devices in the domain. - -**To configure the Configure Automatic Updates and Intranet Microsoft Update Service Location Group Policy settings for your environment** - -1. Open GPMC. - -2. Expand Forest\Domains\\*Your_Domain*. - -3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. - - ![Example of UI](images/waas-wsus-fig3.png) - - >[!NOTE] - >In this example, the **Configure Automatic Updates** and **Intranet Microsoft Update Service Location** Group Policy settings are specified for the entire domain. This is not a requirement; you can target these settings to any security group by using Security Filtering or a specific OU. - -4. In the **New GPO** dialog box, name the new GPO **WSUS – Auto Updates and Intranet Update Service Location**. - -5. Right-click the **WSUS – Auto Updates and Intranet Update Service Location** GPO, and then click **Edit**. - -6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. - -7. Right-click the **Configure Automatic Updates** setting, and then click **Edit**. - - ![Example of UI](images/waas-wsus-fig4.png) - -8. In the **Configure Automatic Updates** dialog box, select **Enable**. - -9. Under **Options**, from the **Configure automatic updating** list, select **3 - Auto download and notify for install**, and then click **OK**. - - ![Example of UI](images/waas-wsus-fig5.png) - - > [!NOTE] - > ?There are three other settings for automatic update download and installation dates and times. This is simply the option this example uses. For more examples of how to control automatic updates and other related policies, see [Configure Automatic Updates by Using Group Policy](https://technet.microsoft.com/library/cc720539%28v=ws.10%29.aspx). - -10. Right-click the **Specify intranet Microsoft update service location** setting, and then click **Edit**. - -11. In the **Specify intranet Microsoft update service location** dialog box, select **Enable**. - -12. Under **Options**, in the **Set the intranet update service for detecting updates** and **Set the intranet statistics server** options, type http://Your_WSUS_Server_FQDN:PortNumber, and then click **OK**. - - >[!NOTE] - >The URL `http://CONTOSO-WSUS1.contoso.com:8530` in the following image is just an example. In your environment, be sure to use the server name and port number for your WSUS instance. - - ![Example of UI](images/waas-wsus-fig6.png) - - >[!NOTE] - >The default HTTP port for WSUS is 8530, and the default HTTP over Secure Sockets Layer (HTTPS) port is 8531. If you’re unsure which port WSUS is using for client communication, right-click the WSUS Administration site in IIS Manager, and then click **Edit Bindings**. - -As Windows clients refresh their computer policies (the default Group Policy refresh setting is 90 minutes and when a computer restarts), computers start to appear in WSUS. Now that clients are communicating with the WSUS server, create the computer groups that align with your deployment rings. - -## Create computer groups in the WSUS Administration Console - ->[!NOTE] ->The following procedures use the groups from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) as examples. - -You can use computer groups to target a subset of devices that have specific quality and feature updates. These groups represent your deployment rings, as controlled by WSUS. You can populate the groups either manually by using the WSUS Administration Console or automatically through Group Policy. Regardless of the method you choose, you must first create the groups in the WSUS Administration Console. - -**To create computer groups in the WSUS Administration Console** - -1. Open the WSUS Administration Console. - -2. Go to *Server_Name*\Computers\All Computers, and then click **Add Computer Group**. - - ![Example of UI](images/waas-wsus-fig7.png) - -3. Type **Ring 2 Pilot Business Users** for the name, and then click **Add**. - -4. Repeat these steps for the **Ring 3 Broad IT** and **Ring 4 Broad Business Users** groups. When you’re finished, there should be three deployment ring groups. - -Now that the groups have been created, add the computers to the computer groups that align with the desired deployment rings. You can do this through [Group Policy](#wsus-gp) or manually by using the [WSUS Administration Console](#wsus-admin). - - -## Use the WSUS Administration Console to populate deployment rings - -Adding computers to computer groups in the WSUS Administration Console is simple, but it could take much longer than managing membership through Group Policy, especially if you have many computers to add. Adding computers to computer groups in the WSUS Administration Console is called *server-side targeting*. - -In this example, you add computers to computer groups in two different ways: by manually assigning unassigned computers and by searching for multiple computers. - -### Manually assign unassigned computers to groups - -When new computers communicate with WSUS, they appear in the **Unassigned Computers** group. From there, you can use the following procedure to add computers to their correct groups. For these examples, you use two Windows 10 PCs (WIN10-PC1 and WIN10-PC2) to add to the computer groups. - -**To assign computers manually** - -1. In the WSUS Administration Console, go to *Server_Name*\Computers\All Computers\Unassigned Computers. - - Here, you see the new computers that have received the GPO you created in the previous section and started communicating with WSUS. This example has only two computers; depending on how broadly you deployed your policy, you will likely have many computers here. - -2. Select both computers, right-click the selection, and then click **Change Membership**. - - ![Example of UI](images/waas-wsus-fig8.png) - -3. In the **Set Computer Group Membership** dialog box, select the **Ring 2 Pilot Business Users** deployment ring, and then click **OK**. - - Because they were assigned to a group, the computers are no longer in the **Unassigned Computers** group. If you select the **Ring 2 Pilot Business Users** computer group, you will see both computers there. - -### Search for multiple computers to add to groups - -Another way to add multiple computers to a deployment ring in the WSUS Administration Console is to use the search feature. - -**To search for multiple computers** - -1. In the WSUS Administration Console, go to *Server_Name*\Computers\All Computers, right-click **All Computers**, and then click **Search**. - -2. In the search box, type **WIN10**. - -3. In the search results, select the computers, right-click the selection, and then click **Change Membership**. - - ![Example of UI](images/waas-wsus-fig9.png) - -4. Select the **Ring 3 Broad IT** deployment ring, and then click **OK**. - -You can now see these computers in the **Ring 3 Broad IT** computer group. - - - -## Use Group Policy to populate deployment rings - -The WSUS Administration Console provides a friendly interface from which you can manage Windows 10 quality and feature updates. When you need to add many computers to their correct WSUS deployment ring, however, it can be time-consuming to do so manually in the WSUS Administration Console. For these cases, consider using Group Policy to target the correct computers, automatically adding them to the correct WSUS deployment ring based on an Active Directory security group. This process is called *client-side targeting*. Before enabling client-side targeting in Group Policy, you must configure WSUS to accept Group Policy computer assignment. - -**To configure WSUS to allow client-side targeting from Group Policy** - -1. Open the WSUS Administration Console, and go to *Server_Name*\Options, and then click **Computers**. - - ![Example of UI](images/waas-wsus-fig10.png) - -2. In the **Computers** dialog box, select **Use Group Policy or registry settings on computers**, and then click **OK**. - - >[!NOTE] - >This option is exclusively either-or. When you enable WSUS to use Group Policy for group assignment, you can no longer manually add computers through the WSUS Administration Console until you change the option back. - -Now that WSUS is ready for client-side targeting, complete the following steps to use Group Policy to configure client-side targeting: - -**To configure client-side targeting** - ->[!TIP] ->When using client-side targeting, consider giving security groups the same names as your deployment rings. Doing so simplifies the policy-creation process and helps ensure that you don’t add computers to the incorrect rings. - -1. Open GPMC. - -2. Expand Forest\Domains\\*Your_Domain*. - -3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. - -4. In the **New GPO** dialog box, type **WSUS – Client Targeting – Ring 4 Broad Business Users** for the name of the new GPO. - -5. Right-click the **WSUS – Client Targeting – Ring 4 Broad Business Users** GPO, and then click **Edit**. - - ![Example of UI](images/waas-wsus-fig11.png) - -6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. - -7. Right-click **Enable client-side targeting**, and then click **Edit**. - -8. In the **Enable client-side targeting** dialog box, select **Enable**. - -9. In the **Target group name for this computer** box, type **Ring 4 Broad Business Users**. This is the name of the deployment ring in WSUS to which these computers will be added. - - ![Example of UI](images/waas-wsus-fig12.png) - -10. Close the Group Policy Management Editor. - -Now you’re ready to deploy this GPO to the correct computer security group for the **Ring 4 Broad Business Users** deployment ring. - -**To scope the GPO to a group** - -1. In GPMC, select the **WSUS – Client Targeting – Ring 4 Broad Business Users** policy. - -2. Click the **Scope** tab. - -3. Under **Security Filtering**, remove the default **AUTHENTICATED USERS** security group, and then add the **Ring 4 Broad Business Users** group. - - ![Example of UI](images/waas-wsus-fig13.png) - -The next time the clients in the **Ring 4 Broad Business Users** security group receive their computer policy and contact WSUS, they will be added to the **Ring 4 Broad Business Users** deployment ring. - -## Automatically approve and deploy feature updates - -For clients that should have their feature updates approved as soon as they’re available, you can configure Automatic Approval rules in WSUS. - ->[!NOTE] ->WSUS respects the client’s servicing branch. If you approve a feature update while it is still Current Branch (CB), WSUS will install the update only on PCs that are in the CB servicing branch. When Microsoft releases the build for Current Branch for Business (CBB), the PCs in the CBB servicing branch will install it. Windows Update for Business branch settings do not apply to feature updates through WSUS. - -**To configure an Automatic Approval rule for Windows 10 feature updates and approve them for the Ring 3 Broad IT deployment ring** - -1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Options, and then select **Automatic Approvals**. - -2. On the **Update Rules** tab, click **New Rule**. - -3. In the **Add Rule** dialog box, select the **When an update is in a specific classification**, **When an update is in a specific product**, and **Set a deadline for the approval** check boxes. - - ![Example of UI](images/waas-wsus-fig14.png) - -4. In the **Edit the properties** area, select **any classification**. Clear everything except **Upgrades**, and then click **OK**. - -5. In the **Edit the properties area**, click the **any product** link. Clear all check boxes except **Windows 10**, and then click **OK**. - - Windows 10 is under All Products\Microsoft\Windows. - -6. In the **Edit the properties** area, click the **all computers** link. Clear all the computer group check boxes except **Ring 3 Broad IT**, and then click **OK**. - -7. Leave the deadline set for **7 days after the approval at 3:00 AM**. - -8. In the **Step 3: Specify a name** box, type **Windows 10 Upgrade Auto-approval for Ring 3 Broad IT**, and then click **OK**. - - ![Example of UI](images/waas-wsus-fig15.png) - -9. In the **Automatic Approvals** dialog box, click **OK**. - - >[!NOTE] - >WSUS does not honor any existing month/week/day deferral settings for CB or CBB. That said, if you’re using Windows Update for Business for a computer for which WSUS is also managing updates, when WSUS approves the update, it will be installed on the computer regardless of whether you configured Group Policy to wait. - -Now, whenever Windows 10 feature updates are published to WSUS, they will automatically be approved for the **Ring 3 Broad IT** deployment ring with an installation deadline of 1 week. - -## Manually approve and deploy feature updates - -You can manually approve updates and set deadlines for installation within the WSUS Administration Console, as well. To simplify the manual approval process, start by creating a software update view that contains only Windows 10 updates. - -**To approve and deploy feature updates manually** - -1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates. In the **Action** pane, click **New Update View**. - -2. In the **Add Update View** dialog box, select **Updates are in a specific classification** and **Updates are for a specific product**. - -3. Under **Step 2: Edit the properties**, click **any classification**. Clear all check boxes except **Upgrades**, and then click **OK**. - -4. Under **Step 2: Edit the properties**, click **any product**. Clear all check boxes except **Windows 10**, and then click **OK**. - - Windows 10 is under All Products\Microsoft\Windows. - -5. In the **Step 3: Specify a name** box, type **All Windows 10 Upgrades**, and then click **OK**. - - ![Example of UI](images/waas-wsus-fig16.png) - -Now that you have the All Windows 10 Upgrades view, complete the following steps to manually approve an update for the **Ring 4 Broad Business Users** deployment ring: - -1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates\All Windows 10 Upgrades. - -2. Right-click the feature update you want to deploy, and then click **Approve**. - - ![Example of UI](images/waas-wsus-fig17.png) - -3. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, select **Approved for Install**. - - ![Example of UI](images/waas-wsus-fig18.png) - -4. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, click **Deadline**, click **One Week**, and then click **OK**. - - ![Example of UI](images/waas-wsus-fig19.png) - -5. If the **Microsoft Software License Terms** dialog box opens, click **Accept**. - - If the deployment is successful, you should receive a successful progress report. - - ![Example of UI](images/waas-wsus-fig20.png) - -6. In the **Approval Progress** dialog box, click **Close**. - -
                        - -## Steps to manage updates for Windows 10 - -| | | -| --- | --- | -| ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | -| ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or Deploy Windows 10 updates using Windows Server Update Services (this topic)
                        or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | - - - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Overview of Windows as a service](waas-overview.md) -- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) -- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) -- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) -- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) -- [Manage device restarts after updates](waas-restart.md) +--- +title: Deploy Windows 10 updates using Windows Server Update Services (Windows 10) +description: WSUS allows companies to defer, selectively approve, choose when delivered, and determine which devices receive updates. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Deploy Windows 10 updates using Windows Server Update Services (WSUS) + + +**Applies to** + +- Windows 10 + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +>[!IMPORTANT] +>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy or the registry. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel. + + +WSUS is a Windows Server role available in the Windows Server operating systems. It provides a single hub for Windows updates within an organization. WSUS allows companies not only to defer updates but also to selectively approve them, choose when they’re delivered, and determine which individual devices or groups of devices receive them. WSUS provides additional control over Windows Update for Business but does not provide all the scheduling options and deployment flexibility that System Center Configuration Manager provides. + +When you choose WSUS as your source for Windows updates, you use Group Policy to point Windows 10 client devices to the WSUS server for their updates. From there, updates are periodically downloaded to the WSUS server and managed, approved, and deployed through the WSUS administration console or Group Policy, streamlining enterprise update management. If you’re currently using WSUS to manage Windows updates in your environment, you can continue to do so in Windows 10. + + + +## Requirements for Windows 10 servicing with WSUS + +To be able to use WSUS to manage and deploy Windows 10 feature updates, you must use a supported WSUS version: +- WSUS 10.0.14393 (role in Windows Server 2016) +- WSUS 10.0.17763 (role in Windows Server 2019) +- WSUS 6.2 and 6.3 (role in Windows Server 2012 and Windows Server 2012 R2) +- KB 3095113 and KB 3159706 (or an equivalent update) must be installed on WSUS 6.2 and 6.3. + +> [!IMPORTANT] +> Both [KB 3095113](https://support.microsoft.com/kb/3095113) and [KB 3159706](https://support.microsoft.com/kb/3159706) are included in the **Security Monthly Quality Rollup** starting in July 2017. This means you might not see KB 3095113 and KB 3159706 as installed updates since they might have been installed with a rollup. However, if you need either of these updates, we recommend installing a **Security Monthly Quality Rollup** released after **October 2017** since they contain an additional WSUS update to decrease memory utilization on WSUS's clientwebservice. +>If you have synced either of these updates prior to the security monthly quality rollup, you can experience problems. To recover from this, see [How to Delete Upgrades in WSUS](https://blogs.technet.microsoft.com/wsus/2016/01/29/how-to-delete-upgrades-in-wsus/). + + +## WSUS scalability + +To use WSUS to manage all Windows updates, some organizations may need access to WSUS from a perimeter network, or they might have some other complex scenario. WSUS is highly scalable and configurable for organizations of any size or site layout. For specific information about scaling WSUS, including upstream and downstream server configuration, branch offices, WSUS load balancing, and other complex scenarios, see [Choose a Type of WSUS Deployment](https://technet.microsoft.com/library/cc720448%28v=ws.10%29.aspx). + + + + +## Configure automatic updates and update service location + +When using WSUS to manage updates on Windows client devices, start by configuring the **Configure Automatic Updates** and **Intranet Microsoft Update Service Location** Group Policy settings for your environment. Doing so forces the affected clients to contact the WSUS server so that it can manage them. The following process describes how to specify these settings and deploy them to all devices in the domain. + +**To configure the Configure Automatic Updates and Intranet Microsoft Update Service Location Group Policy settings for your environment** + +1. Open Group Policy Management Console (gpmc.msc). + +2. Expand *Forest\Domains\\*Your_Domain**. + +3. Right-click **Your_Domain**, and then select **Create a GPO in this domain, and Link it here**. + + ![Example of UI](images/waas-wsus-fig3.png) + + >[!NOTE] + >In this example, the **Configure Automatic Updates** and **Intranet Microsoft Update Service Location** Group Policy settings are specified for the entire domain. This is not a requirement; you can target these settings to any security group by using Security Filtering or a specific OU. + +4. In the **New GPO** dialog box, name the new GPO **WSUS – Auto Updates and Intranet Update Service Location**. + +5. Right-click the **WSUS – Auto Updates and Intranet Update Service Location** GPO, and then click **Edit**. + +6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. + +7. Right-click the **Configure Automatic Updates** setting, and then click **Edit**. + + ![Example of UI](images/waas-wsus-fig4.png) + +8. In the **Configure Automatic Updates** dialog box, select **Enable**. + +9. Under **Options**, from the **Configure automatic updating** list, select **3 - Auto download and notify for install**, and then click **OK**. + + ![Example of UI](images/waas-wsus-fig5.png) + + > [!NOTE] + > There are three other settings for automatic update download and installation dates and times. This is simply the option this example uses. For more examples of how to control automatic updates and other related policies, see [Configure Automatic Updates by Using Group Policy](https://technet.microsoft.com/library/cc720539%28v=ws.10%29.aspx). + +10. Right-click the **Specify intranet Microsoft update service location** setting, and then select **Edit**. + +11. In the **Specify intranet Microsoft update service location** dialog box, select **Enable**. + +12. Under **Options**, in the **Set the intranet update service for detecting updates** and **Set the intranet statistics server** options, type http://Your_WSUS_Server_FQDN:PortNumber, and then select **OK**. + + >[!NOTE] + >The URL `http://CONTOSO-WSUS1.contoso.com:8530` in the following image is just an example. In your environment, be sure to use the server name and port number for your WSUS instance. + + ![Example of UI](images/waas-wsus-fig6.png) + + >[!NOTE] + >The default HTTP port for WSUS is 8530, and the default HTTP over Secure Sockets Layer (HTTPS) port is 8531. (The other options are 80 and 443; no other ports are supported.) + +As Windows clients refresh their computer policies (the default Group Policy refresh setting is 90 minutes and when a computer restarts), computers start to appear in WSUS. Now that clients are communicating with the WSUS server, create the computer groups that align with your deployment rings. + +## Create computer groups in the WSUS Administration Console + +>[!NOTE] +>The following procedures use the groups from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) as examples. + +You can use computer groups to target a subset of devices that have specific quality and feature updates. These groups represent your deployment rings, as controlled by WSUS. You can populate the groups either manually by using the WSUS Administration Console or automatically through Group Policy. Regardless of the method you choose, you must first create the groups in the WSUS Administration Console. + +**To create computer groups in the WSUS Administration Console** + +1. Open the WSUS Administration Console. + +2. Go to *Server_Name*\Computers\All Computers, and then click **Add Computer Group**. + + ![Example of UI](images/waas-wsus-fig7.png) + +3. Type **Ring 2 Pilot Business Users** for the name, and then click **Add**. + +4. Repeat these steps for the **Ring 3 Broad IT** and **Ring 4 Broad Business Users** groups. When you’re finished, there should be three deployment ring groups. + +Now that the groups have been created, add the computers to the computer groups that align with the desired deployment rings. You can do this through [Group Policy](#wsus-gp) or manually by using the [WSUS Administration Console](#wsus-admin). + + + +## Use the WSUS Administration Console to populate deployment rings + +Adding computers to computer groups in the WSUS Administration Console is simple, but it could take much longer than managing membership through Group Policy, especially if you have many computers to add. Adding computers to computer groups in the WSUS Administration Console is called *server-side targeting*. + +In this example, you add computers to computer groups in two different ways: by manually assigning unassigned computers and by searching for multiple computers. + +### Manually assign unassigned computers to groups + +When new computers communicate with WSUS, they appear in the **Unassigned Computers** group. From there, you can use the following procedure to add computers to their correct groups. For these examples, you use two Windows 10 PCs (WIN10-PC1 and WIN10-PC2) to add to the computer groups. + +**To assign computers manually** + +1. In the WSUS Administration Console, go to *Server_Name*\Computers\All Computers\Unassigned Computers. + + Here, you see the new computers that have received the GPO you created in the previous section and started communicating with WSUS. This example has only two computers; depending on how broadly you deployed your policy, you will likely have many computers here. + +2. Select both computers, right-click the selection, and then click **Change Membership**. + + ![Example of UI](images/waas-wsus-fig8.png) + +3. In the **Set Computer Group Membership** dialog box, select the **Ring 2 Pilot Business Users** deployment ring, and then click **OK**. + + Because they were assigned to a group, the computers are no longer in the **Unassigned Computers** group. If you select the **Ring 2 Pilot Business Users** computer group, you will see both computers there. + +### Search for multiple computers to add to groups + +Another way to add multiple computers to a deployment ring in the WSUS Administration Console is to use the search feature. + +**To search for multiple computers** + +1. In the WSUS Administration Console, go to *Server_Name*\Computers\All Computers, right-click **All Computers**, and then click **Search**. + +2. In the search box, type **WIN10**. + +3. In the search results, select the computers, right-click the selection, and then click **Change Membership**. + + ![Example of UI](images/waas-wsus-fig9.png) + +4. Select the **Ring 3 Broad IT** deployment ring, and then click **OK**. + +You can now see these computers in the **Ring 3 Broad IT** computer group. + + + +## Use Group Policy to populate deployment rings + +The WSUS Administration Console provides a friendly interface from which you can manage Windows 10 quality and feature updates. When you need to add many computers to their correct WSUS deployment ring, however, it can be time-consuming to do so manually in the WSUS Administration Console. For these cases, consider using Group Policy to target the correct computers, automatically adding them to the correct WSUS deployment ring based on an Active Directory security group. This process is called *client-side targeting*. Before enabling client-side targeting in Group Policy, you must configure WSUS to accept Group Policy computer assignment. + +**To configure WSUS to allow client-side targeting from Group Policy** + +1. Open the WSUS Administration Console, and go to *Server_Name*\Options, and then click **Computers**. + + ![Example of UI](images/waas-wsus-fig10.png) + +2. In the **Computers** dialog box, select **Use Group Policy or registry settings on computers**, and then click **OK**. + + >[!NOTE] + >This option is exclusively either-or. When you enable WSUS to use Group Policy for group assignment, you can no longer manually add computers through the WSUS Administration Console until you change the option back. + +Now that WSUS is ready for client-side targeting, complete the following steps to use Group Policy to configure client-side targeting: + +**To configure client-side targeting** + +>[!TIP] +>When using client-side targeting, consider giving security groups the same names as your deployment rings. Doing so simplifies the policy-creation process and helps ensure that you don’t add computers to the incorrect rings. + +1. Open Group Policy Management Console (gpmc.msc). + +2. Expand Forest\Domains\\*Your_Domain*. + +3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. + +4. In the **New GPO** dialog box, type **WSUS – Client Targeting – Ring 4 Broad Business Users** for the name of the new GPO. + +5. Right-click the **WSUS – Client Targeting – Ring 4 Broad Business Users** GPO, and then click **Edit**. + + ![Example of UI](images/waas-wsus-fig11.png) + +6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. + +7. Right-click **Enable client-side targeting**, and then click **Edit**. + +8. In the **Enable client-side targeting** dialog box, select **Enable**. + +9. In the **Target group name for this computer** box, type *Ring 4 Broad Business Users*. This is the name of the deployment ring in WSUS to which these computers will be added. + + ![Example of UI](images/waas-wsus-fig12.png) + +> [!WARNING] +> The target group name must match the computer group name. + +10. Close the Group Policy Management Editor. + +Now you’re ready to deploy this GPO to the correct computer security group for the **Ring 4 Broad Business Users** deployment ring. + +**To scope the GPO to a group** + +1. In GPMC, select the **WSUS – Client Targeting – Ring 4 Broad Business Users** policy. + +2. Click the **Scope** tab. + +3. Under **Security Filtering**, remove the default **AUTHENTICATED USERS** security group, and then add the **Ring 4 Broad Business Users** group. + + ![Example of UI](images/waas-wsus-fig13.png) + +The next time the clients in the **Ring 4 Broad Business Users** security group receive their computer policy and contact WSUS, they will be added to the **Ring 4 Broad Business Users** deployment ring. + +## Automatically approve and deploy feature updates + +For clients that should have their feature updates approved as soon as they’re available, you can configure Automatic Approval rules in WSUS. + +>[!NOTE] +>WSUS respects the client device's servicing branch. If you approve a feature update while it is still in one branch, such as Insider Preview, WSUS will install the update only on devices that are in that servicing branch. When Microsoft releases the build for Semi-Annual Channel, the devices in the Semi-Annual Channel will install it. Windows Update for Business branch settings do not apply to feature updates through WSUS. + + +**To configure an Automatic Approval rule for Windows 10 feature updates and approve them for the Ring 3 Broad IT deployment ring** + +1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Options, and then select **Automatic Approvals**. + +2. On the **Update Rules** tab, click **New Rule**. + +3. In the **Add Rule** dialog box, select the **When an update is in a specific classification**, **When an update is in a specific product**, and **Set a deadline for the approval** check boxes. + + ![Example of UI](images/waas-wsus-fig14.png) + +4. In the **Edit the properties** area, select **any classification**. Clear everything except **Upgrades**, and then click **OK**. + +5. In the **Edit the properties area**, click the **any product** link. Clear all check boxes except **Windows 10**, and then click **OK**. + + Windows 10 is under All Products\Microsoft\Windows. + +6. In the **Edit the properties** area, click the **all computers** link. Clear all the computer group check boxes except **Ring 3 Broad IT**, and then click **OK**. + +7. Leave the deadline set for **7 days after the approval at 3:00 AM**. + +8. In the **Step 3: Specify a name** box, type **Windows 10 Upgrade Auto-approval for Ring 3 Broad IT**, and then click **OK**. + + ![Example of UI](images/waas-wsus-fig15.png) + +9. In the **Automatic Approvals** dialog box, click **OK**. + + >[!NOTE] + >WSUS does not honor any existing month/week/day [deferral settings](waas-configure-wufb.md#configure-when-devices-receive-feature-updates). That said, if you’re using Windows Update for Business for a computer for which WSUS is also managing updates, when WSUS approves the update, it will be installed on the computer regardless of whether you configured Group Policy to wait. + +Now, whenever Windows 10 feature updates are published to WSUS, they will automatically be approved for the **Ring 3 Broad IT** deployment ring with an installation deadline of 1 week. + +> [!WARNING] +> The auto approval rule runs after synchronization occurs. This means that the *next* upgrade for each Windows 10 version will be approved. If you select **Run Rule**, all possible updates that meet the criteria will be approved, potentially including older updates that you don't actualy want--which can be a problem when the download sizes are very large. + +## Manually approve and deploy feature updates + +You can manually approve updates and set deadlines for installation within the WSUS Administration Console, as well. It might be best to approve update rules manually after your pilot deployment has been updated. + +To simplify the manual approval process, start by creating a software update view that contains only Windows 10 updates. + +**To approve and deploy feature updates manually** + +1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates. In the **Action** pane, click **New Update View**. + +2. In the **Add Update View** dialog box, select **Updates are in a specific classification** and **Updates are for a specific product**. + +3. Under **Step 2: Edit the properties**, click **any classification**. Clear all check boxes except **Upgrades**, and then click **OK**. + +4. Under **Step 2: Edit the properties**, click **any product**. Clear all check boxes except **Windows 10**, and then click **OK**. + + Windows 10 is under All Products\Microsoft\Windows. + +5. In the **Step 3: Specify a name** box, type **All Windows 10 Upgrades**, and then click **OK**. + + ![Example of UI](images/waas-wsus-fig16.png) + +Now that you have the **All Windows 10 Upgrades** view, complete the following steps to manually approve an update for the **Ring 4 Broad Business Users** deployment ring: + +1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates\All Windows 10 Upgrades. + +2. Right-click the feature update you want to deploy, and then click **Approve**. + + ![Example of UI](images/waas-wsus-fig17.png) + +3. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, select **Approved for Install**. + + ![Example of UI](images/waas-wsus-fig18.png) + +4. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, click **Deadline**, click **One Week**, and then click **OK**. + + ![Example of UI](images/waas-wsus-fig19.png) + +5. If the **Microsoft Software License Terms** dialog box opens, click **Accept**. + + If the deployment is successful, you should receive a successful progress report. + + ![Example of UI](images/waas-wsus-fig20.png) + +6. In the **Approval Progress** dialog box, click **Close**. + +
                        + +## Steps to manage updates for Windows 10 + +| | | +| --- | --- | +| ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | +| ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | +| ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | +| ![done](images/checklistdone.png) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | +| ![done](images/checklistdone.png) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | +| ![done](images/checklistdone.png) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or Deploy Windows 10 updates using Windows Server Update Services (this topic)
                        or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | + + + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index 60a512e49c..b80b9132c8 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -126,7 +126,7 @@ For more information about Update Compliance, see [Monitor Windows Updates using - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) - [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-mobile-updates.md b/windows/deployment/update/waas-mobile-updates.md index a968d2c48c..73652f10a9 100644 --- a/windows/deployment/update/waas-mobile-updates.md +++ b/windows/deployment/update/waas-mobile-updates.md @@ -1,94 +1,78 @@ ---- -title: Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile (Windows 10) -description: tbd -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.author: greglin -ms.date: 07/27/2017 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile - - -**Applies to** - -- Windows 10 Mobile -- [Windows 10 IoT Mobile](https://www.microsoft.com/en-us/WindowsForBusiness/windows-iot) - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - ->[!TIP] ->If you're not familiar with the Windows 10 servicing or release channels, read [Servicing channels](waas-overview.md#servicing-channels) first. - -Devices running Windows 10 Mobile and Windows 10 IoT Mobile receive updates from the Semi-annual channel unless you [enroll the device in the Windows Insider Program](waas-servicing-channels-windows-10-updates.md#enroll-devices-in-the-windows-insider-program) or assign the device to Current Branch for Business (CBB). Only devices running Windows 10 Mobile Enterprise or Windows 10 IoT Mobile can be assigned to CBB. - -[Learn how to upgrade Windows 10 Mobile to Windows 10 Mobile Enterprise](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades) - -
                        - ->[!IMPORTANT] ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products. -> ->In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. - -| Windows 10 edition | CB | CBB | Insider Program | -| --- | --- | --- | --- | --- | -| Mobile | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Mobile Enterprise | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | -| IoT Mobile | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | - -
                        - -Configuration of Windows 10 Mobile and Windows 10 IoT Mobile devices is limited to the feature set pertaining to Quality Updates only. That is, Windows Mobile Feature Updates are categorized the same as Quality Updates, and can only be deferred by setting the Quality Update deferral period, for a maximum period of 30 days. You can use mobile device management (MDM) to manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile. Updates cannot be managed for Windows 10 Mobile. - -## Windows 10, version 1511 - -Only the following Windows Update for Business policies are supported for Windows 10 Mobile and Windows 10 IoT Mobile: - -- ../Vendor/MSFT/Policy/Config/Update/RequireDeferredUpgrade -- ../Vendor/MSFT/Policy/Config/Update/DeferUpdatePeriod -- ../Vendor/MSFT/Policy/Config/Update/PauseDeferrals - -To defer the update period or pause deferrals, the device must be configured for CBB servicing branch by applying the **RequireDeferredUpgrade** policy. - -## Windows 10, version 1607 - -Only the following Windows Update for Business policies are supported for Windows 10 Mobile and Windows 10 IoT Mobile: - -- ../Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel -- ../Vendor/MSFT/Policy/Config/Update/DeferQualityUpdatesInDays -- ../Vendor/MSFT/Policy/Config/Update/PauseQualityUpdates - -In version 1607, you can defer and pause updates for devices on both the CB and CBB servicing branches. - -If a device running Windows 10 Mobile Enterprise or Windows 10 IoT Mobile, version 1511, has Windows Update for Business policies applied and is then updated to version 1607, version 1511 policies continue to apply until version 1607 policies are applied. - - - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Overview of Windows as a service](waas-overview.md) -- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) -- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) -- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) -- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) -- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) -- [Manage device restarts after updates](waas-restart.md) - - - +--- +title: Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile (Windows 10) +description: tbd +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile + + +**Applies to** + +- Windows 10 Mobile +- [Windows 10 IoT Mobile](https://www.microsoft.com/WindowsForBusiness/windows-iot) + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +>[!TIP] +>If you're not familiar with the Windows 10 servicing or release channels, read [Servicing channels](waas-overview.md#servicing-channels) first. + +Devices running Windows 10 Mobile and Windows 10 IoT Mobile receive updates from the Semi-annual Channel unless you [enroll the device in the Windows Insider Program](waas-servicing-channels-windows-10-updates.md#enroll-devices-in-the-windows-insider-program). + +[Learn how to upgrade Windows 10 Mobile to Windows 10 Mobile Enterprise](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades) + + + +| Windows 10 edition | Semi-annual Channel | Insider Program | +| --- | --- | --- | --- | +| Mobile | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Mobile Enterprise | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | +| IoT Mobile | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | + + + +Configuration of Windows 10 Mobile and Windows 10 IoT Mobile devices is limited to the feature set pertaining to quality updates only. That is, Windows Mobile feature updates are categorized the same as quality updates, and can only be deferred by setting the quality update deferral period, for a maximum period of 30 days. You can use mobile device management (MDM) to manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile. Updates cannot be managed for Windows 10 Mobile. + + +## Windows 10, version 1607 + +Only the following Windows Update for Business policies are supported for Windows 10 Mobile and Windows 10 IoT Mobile: + +- ../Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel +- ../Vendor/MSFT/Policy/Config/Update/DeferQualityUpdatesInDays +- ../Vendor/MSFT/Policy/Config/Update/PauseQualityUpdates + + + + + + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Manage device restarts after updates](waas-restart.md) + + + diff --git a/windows/deployment/update/waas-morenews.md b/windows/deployment/update/waas-morenews.md index b1122abef6..bf740f50c0 100644 --- a/windows/deployment/update/waas-morenews.md +++ b/windows/deployment/update/waas-morenews.md @@ -37,7 +37,7 @@ Here's more news about [Windows as a service](windows-as-a-service.md):

                      • How to get the Windows 10 October 2018 Update - October 2, 2018
                      • Reducing Windows 10 Package Size Downloads for x64 Systems - September 26, 2018
                      • Windows 7 Servicing Stack Updates: Managing Change and Appreciating Cumulative Updates - September 21, 2018
                        • -
                      • Helping customers shift to a modern desktop - September 6, 2018
                        • +
                      • Helping customers shift to a modern desktop - September 6, 2018
                      • Windows Update for Business & Windows Analytics: a real-world experience - September 5, 2018
                      • What's next for Windows 10 and Windows Server quality updates - August 16, 2018
                      • Windows 10 monthly updates - August 1, 2018 (video)
                        • diff --git a/windows/deployment/update/waas-optimize-windows-10-updates.md b/windows/deployment/update/waas-optimize-windows-10-updates.md index b620db134e..993d1f887d 100644 --- a/windows/deployment/update/waas-optimize-windows-10-updates.md +++ b/windows/deployment/update/waas-optimize-windows-10-updates.md @@ -1,111 +1,111 @@ ---- -title: Optimize update delivery for Windows 10 updates (Windows 10) -description: Two methods of peer-to-peer content distribution are available in Windows 10, Delivery Optimization and BranchCache. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Optimize Windows 10 update delivery - - -**Applies to** - -- Windows 10 - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - -When considering your content distribution strategy for Windows 10, think about enabling a form of peer-to-peer content sharing to reduce bandwidth issues during updates. Windows 10 offers two peer-to-peer options for update content distribution: Delivery Optimization and BranchCache. These technologies can be used with several of the servicing tools for Windows 10. - -Two methods of peer-to-peer content distribution are available in Windows 10. - -- [Delivery Optimization](waas-delivery-optimization.md) is a new peer-to-peer distribution method in Windows 10. Windows 10 clients can source content from other devices on their local network that have already downloaded the updates or from peers over the internet. Using the settings available for Delivery Optimization, clients can be configured into groups, allowing organizations to identify devices that are possibly the best candidates to fulfil peer-to-peer requests. - - Windows Update, Windows Update for Business, and Windows Server Update Services (WSUS) can use Delivery Optimization. Delivery Optimization can significantly reduce the amount of network traffic to external Windows Update sources as well as the time it takes for clients to retrieve the updates. - -- [BranchCache](waas-branchcache.md) is a bandwidth optimization technology that is included in some editions of Windows Server 2016 and Windows 10 operating systems, as well as in some editions of Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, and Windows 7. - - >[!NOTE] - >Full BranchCache functionality is supported in Windows 10 Enterprise and Education; Windows 10 Pro supports some BranchCache functionality, including BITS transfers used for servicing operations. - - Windows Server Update Services (WSUS) and System Center Configuration Manager can use BranchCache to allow peers to source content from each other versus always having to contact a server. Using BranchCache, files are cached on each individual client, and other clients can retrieve them as needed. This approach distributes the cache rather than having a single point of retrieval, saving a significant amount of bandwidth while drastically reducing the time that it takes for clients to receive the requested content. - -

                        - -| Method | Windows Update | Windows Update for Business | WSUS | Configuration Manager | -| --- | --- | --- | --- | --- | -| Delivery Optimization | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | -| BranchCache | ![no](images/crossmark.png) | ![no](images/crossmark.png) |![yes](images/checkmark.png) | ![yes](images/checkmark.png) | - ->[!NOTE] ->System Center Configuration Manager has an additional feature called Client Peer Cache that allows peer-to-peer content sharing between clients you use System Center Configuration Manager to manage, in the same Configuration Manager boundary Group. For more information, see [Client Peer Cache](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/client-peer-cache). -> ->In addition to Client Peer Cache, similar functionality is available in the Windows Preinstallation Environment (Windows PE) for imaging-related content. Using this technology, clients imaging with System Center Configuration Manager task sequences can source operating system images, driver packages, boot images, packages, and programs from peers instead of distribution points. For detailed information about how Windows PE Peer Cache works and how to configure it, see [Prepare Windows PE peer cache to reduce WAN traffic in System Center Configuration Manager](https://technet.microsoft.com/library/mt613173.aspx). - -## Express update delivery - -Windows 10 quality update downloads can be large because every package contains all previously released fixes to ensure consistency and simplicity. Windows has been able to reduce the size of Windows Update downloads with a feature called Express. - ->[!NOTE] ->Express update delivery applies to quality update downloads. Starting with Windows 10, version 1709, Express update delivery also applies to feature update downloads for clients connected to Windows Update and Windows Update for Business. - -### How Microsoft supports Express -- **Express on System Center Configuration Manager** starting with version 1702 of Configuration Manager and Windows 10, version 1703 or later, or Windows 10, version 1607 with the April 2017 cumulative update. -- **Express on WSUS Standalone** - - Express update delivery is available on [all support versions of WSUS](https://technet.microsoft.com/library/cc708456(v=ws.10).aspx). -- **Express on devices directly connected to Windows Update** -- **Enterprise devices managed using [Windows Update for Business](waas-manage-updates-wufb.md)** also get the benefit of Express update delivery support without any change in configuration. - -### How Express download works - -For OS updates that support Express, there are two versions of the file payload stored on the service: -1. **Full-file version** - essentially replacing the local versions of the update binaries. -2. **Express version** - containing the deltas needed to patch the existing binaries on the device. - -Both the full-file version and the Express version are referenced in the update's metadata, which has been downloaded to the client as part of the scan phase. - -**Express download works as follows:** - -The Windows Update client will try to download Express first, and under certain situations fall back to full-file if needed (for example, if going through a proxy that doesn't support byte range requests). - -1. When the Windows Update client initiates an Express download, **Windows Update first downloads a stub**, which is part of the Express package. -2. **The Windows Update client passes this stub to the Windows installer**, which uses the stub to do a local inventory, comparing the deltas of the file on the device with what is needed to get to the latest version of the file being offered. -3. **The Windows installer then requests the Windows Update client to download the ranges**, which have been determined to be required. -4. **The client downloads these ranges and passes them to the Windows Installer**, which applies the ranges and then determines if additional ranges are needed. This repeats until the Windows installer tells the Windows Update client that all necessary ranges have been downloaded. - -At this point, the download is complete and the update is ready to be installed. - ->[!TIP] ->Express will **always** be leveraged if your machines are updated regularly with the latest cumulative updates. - -## Steps to manage updates for Windows 10 - -| | | -| --- | --- | -| ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | -| ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | -| ![done](images/checklistdone.png) | Optimize update delivery for Windows 10 updates (this topic) | -| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                        or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | - - -## Related topics - - -- [Update Windows 10 in the enterprise](index.md) -- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) -- [Manage device restarts after updates](waas-restart.md) +--- +title: Optimize update delivery for Windows 10 updates (Windows 10) +description: Two methods of peer-to-peer content distribution are available in Windows 10, Delivery Optimization and BranchCache. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Optimize Windows 10 update delivery + + +**Applies to** + +- Windows 10 + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +When considering your content distribution strategy for Windows 10, think about enabling a form of peer-to-peer content sharing to reduce bandwidth issues during updates. Windows 10 offers two peer-to-peer options for update content distribution: Delivery Optimization and BranchCache. These technologies can be used with several of the servicing tools for Windows 10. + +Two methods of peer-to-peer content distribution are available in Windows 10. + +- [Delivery Optimization](waas-delivery-optimization.md) is a new peer-to-peer distribution method in Windows 10. Windows 10 clients can source content from other devices on their local network that have already downloaded the updates or from peers over the internet. Using the settings available for Delivery Optimization, clients can be configured into groups, allowing organizations to identify devices that are possibly the best candidates to fulfil peer-to-peer requests. + + Windows Update, Windows Update for Business, and Windows Server Update Services (WSUS) can use Delivery Optimization. Delivery Optimization can significantly reduce the amount of network traffic to external Windows Update sources as well as the time it takes for clients to retrieve the updates. + +- [BranchCache](waas-branchcache.md) is a bandwidth optimization technology that is included in some editions of Windows Server 2016 and Windows 10 operating systems, as well as in some editions of Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, and Windows 7. + + >[!NOTE] + >Full BranchCache functionality is supported in Windows 10 Enterprise and Education; Windows 10 Pro supports some BranchCache functionality, including BITS transfers used for servicing operations. + + Windows Server Update Services (WSUS) and System Center Configuration Manager can use BranchCache to allow peers to source content from each other versus always having to contact a server. Using BranchCache, files are cached on each individual client, and other clients can retrieve them as needed. This approach distributes the cache rather than having a single point of retrieval, saving a significant amount of bandwidth while drastically reducing the time that it takes for clients to receive the requested content. + +

                        + +| Method | Windows Update | Windows Update for Business | WSUS | Configuration Manager | +| --- | --- | --- | --- | --- | +| Delivery Optimization | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | +| BranchCache | ![no](images/crossmark.png) | ![no](images/crossmark.png) |![yes](images/checkmark.png) | ![yes](images/checkmark.png) | + +>[!NOTE] +>System Center Configuration Manager has an additional feature called Client Peer Cache that allows peer-to-peer content sharing between clients you use System Center Configuration Manager to manage, in the same Configuration Manager boundary Group. For more information, see [Client Peer Cache](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/client-peer-cache). +> +>In addition to Client Peer Cache, similar functionality is available in the Windows Preinstallation Environment (Windows PE) for imaging-related content. Using this technology, clients imaging with System Center Configuration Manager task sequences can source operating system images, driver packages, boot images, packages, and programs from peers instead of distribution points. For detailed information about how Windows PE Peer Cache works and how to configure it, see [Prepare Windows PE peer cache to reduce WAN traffic in System Center Configuration Manager](https://technet.microsoft.com/library/mt613173.aspx). + +## Express update delivery + +Windows 10 quality update downloads can be large because every package contains all previously released fixes to ensure consistency and simplicity. Windows has been able to reduce the size of Windows Update downloads with a feature called Express. + +>[!NOTE] +>Express update delivery applies to quality update downloads. Starting with Windows 10, version 1709, Express update delivery also applies to feature update downloads for clients connected to Windows Update and Windows Update for Business. + +### How Microsoft supports Express +- **Express on System Center Configuration Manager** starting with version 1702 of Configuration Manager and Windows 10, version 1703 or later, or Windows 10, version 1607 with the April 2017 cumulative update. +- **Express on WSUS Standalone** + + Express update delivery is available on [all support versions of WSUS](https://technet.microsoft.com/library/cc708456(v=ws.10).aspx). +- **Express on devices directly connected to Windows Update** +- **Enterprise devices managed using [Windows Update for Business](waas-manage-updates-wufb.md)** also get the benefit of Express update delivery support without any change in configuration. + +### How Express download works + +For OS updates that support Express, there are two versions of the file payload stored on the service: +1. **Full-file version** - essentially replacing the local versions of the update binaries. +2. **Express version** - containing the deltas needed to patch the existing binaries on the device. + +Both the full-file version and the Express version are referenced in the update's metadata, which has been downloaded to the client as part of the scan phase. + +**Express download works as follows:** + +The Windows Update client will try to download Express first, and under certain situations fall back to full-file if needed (for example, if going through a proxy that doesn't support byte range requests). + +1. When the Windows Update client initiates an Express download, **Windows Update first downloads a stub**, which is part of the Express package. +2. **The Windows Update client passes this stub to the Windows installer**, which uses the stub to do a local inventory, comparing the deltas of the file on the device with what is needed to get to the latest version of the file being offered. +3. **The Windows installer then requests the Windows Update client to download the ranges**, which have been determined to be required. +4. **The client downloads these ranges and passes them to the Windows Installer**, which applies the ranges and then determines if additional ranges are needed. This repeats until the Windows installer tells the Windows Update client that all necessary ranges have been downloaded. + +At this point, the download is complete and the update is ready to be installed. + +>[!TIP] +>Express will **always** be leveraged if your machines are updated regularly with the latest cumulative updates. + +## Steps to manage updates for Windows 10 + +| | | +| --- | --- | +| ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | +| ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | +| ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | +| ![done](images/checklistdone.png) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | +| ![done](images/checklistdone.png) | Optimize update delivery for Windows 10 updates (this topic) | +| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                        or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | + + +## Related topics + + +- [Update Windows 10 in the enterprise](index.md) +- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-overview.md b/windows/deployment/update/waas-overview.md index d5142a89da..02b95b42a5 100644 --- a/windows/deployment/update/waas-overview.md +++ b/windows/deployment/update/waas-overview.md @@ -1,218 +1,210 @@ ---- -title: Overview of Windows as a service (Windows 10) -description: In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy. -keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 09/24/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Overview of Windows as a service - - -**Applies to** - -- Windows 10 -- Windows 10 Mobile -- Windows 10 IoT Mobile - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - -The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. - -Click the following Microsoft Mechanics video for an overview of the release model, particularly the Semi-Annual Channel. - - -[![YouTube video of Michael Niehouse explaining how the Semi-Annual Channel works](images/SAC_vid_crop.jpg)](https://youtu.be/qSAsiM01GOU) - -## Building - -Prior to Windows 10, Microsoft released new versions of Windows every few years. This traditional deployment schedule imposed a training burden on users because the feature revisions were often significant. That schedule also meant waiting long periods without new features — a scenario that doesn’t work in today’s rapidly changing world, a world in which new security, management, and deployment capabilities are necessary to address challenges. Windows as a service will deliver smaller feature updates two times per year, around March and September, to help address these issues. - -In the past, when Microsoft developed new versions of Windows, it typically released technical previews near the end of the process, when Windows was nearly ready to ship. With Windows 10, new features will be delivered to the [Windows Insider community](https://insider.windows.com/) as soon as possible — during the development cycle, through a process called *flighting* — so that organizations can see exactly what Microsoft is developing and start their testing as soon as possible. - -Microsoft also depends on receiving feedback from organizations throughout the development process so that it can make adjustments as quickly as possible rather than waiting until after release. For more information about the Windows Insider Program and how to sign up, see the section [Windows Insider](#windows-insider). - -Of course Microsoft also performs extensive internal testing, with engineering teams installing new builds daily, and larger groups of employees installing builds frequently, all before those builds are ever released to the Windows Insider Program. - -## Deploying - -Deploying Windows 10 is simpler than with previous versions of Windows. When migrating from earlier versions of Windows, an easy in-place upgrade process can be used to automatically preserve all apps, settings, and data. And once running Windows 10, deployment of Windows 10 feature updates will be equally simple. - -One of the biggest challenges for organizations when it comes to deploying a new version of Windows is compatibility testing. Whereas compatibility was previously a concern for organizations upgrading to a new version of Windows, Windows 10 is compatible with most hardware and software capable of running on Windows 7 or later. Because of this high level of compatibility, the app compatibility testing process can be greatly simplified. - -### Application compatibility - -Application compatibility testing has historically been a burden when approaching a Windows deployment or upgrade. With Windows 10, application compatibility from the perspective of desktop applications, websites, and apps built on the Universal Windows Platform (UWP) has improved tremendously. Microsoft understands the challenges organizations experienced when they migrated from the Windows XP operating system to Windows 7 and has been working to make Windows 10 upgrades a much better experience. - -Most Windows 7–compatible desktop applications will be compatible with Windows 10 straight out of the box. Windows 10 achieved such high compatibility because the changes in the existing Win32 application programming interfaces were minimal. Combined with valuable feedback via the Windows Insider Program and diagnostic data, this level of compatibility can be maintained through each feature update. As for websites, Windows 10 includes Internet Explorer 11 and its backward-compatibility modes for legacy websites. Finally, UWP apps follow a compatibility story similar to desktop applications, so most of them will be compatible with Windows 10. - -For the most important business-critical applications, organizations should still perform testing on a regular basis to validate compatibility with new builds. For remaining applications, consider validating them as part of a pilot deployment process to reduce the time spent on compatibility testing. If it’s unclear whether an application is compatible with Windows 10, IT pros can either consult with the ISV or check the supported software directory at [http://www.readyforwindows.com](http://www.readyforwindows.com). - -### Device compatibility - -Device compatibility in Windows 10 is also very strong; new hardware is not needed for Windows 10 as any device capable of running Windows 7 or later can run Windows 10. In fact, the minimum hardware requirements to run Windows 10 are the same as those required for Windows 7. Most hardware drivers that functioned in Windows 8.1, Windows 8, or Windows 7 will continue to function in Windows 10. - -## Servicing - -Traditional Windows servicing has included several release types: major revisions (e.g., the Windows 8.1, Windows 8, and Windows 7 operating systems), service packs, and monthly updates. With Windows 10, there are two release types: feature updates that add new functionality twice per year, and quality updates that provide security and reliability fixes at least once a month. - -With Windows 10, organizations will need to change the way they approach deploying updates. Servicing channels are the first way to separate users into deployment groups for feature and quality updates. With the introduction of servicing channels comes the concept of a [deployment ring](waas-deployment-rings-windows-10-updates.md), which is simply a way to categorize the combination of a deployment group and a servicing channel to group devices for successive waves of deployment. For more information about developing a deployment strategy that leverages servicing channels and deployment rings, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md). - -For information about each servicing tool available for Windows 10, see [Servicing tools](#servicing-tools). - -To align with this new update delivery model, Windows 10 has three servicing channels, each of which provides different levels of flexibility over when these updates are delivered to client computers. For information about the servicing channels available in Windows 10, see [Servicing channels](#servicing-channels). - -### Naming changes - -As part of the alignment with Windows 10 and Office 365 ProPlus, we are adopting common terminology to make it as easy as possible to understand the servicing process. Going forward, these are the new terms we will be using: -* Semi-Annual Channel - We will be referring to Current Branch (CB) as "Semi-Annual Channel (Targeted)", while Current Branch for Business (CBB) will simply be referred to as "Semi-Annual Channel". -* Long-Term Servicing Channel -  The Long-Term Servicing Branch (LTSB) will be referred to as Long-Term Servicing Channel (LTSC). - ->[!IMPORTANT] ->With each Semi-Annual Channel release, we recommend beginning deployment right away to devices selected for early adoption (targeted validation) and ramp up to full deployment at your discretion, regardless of the "Targeted" designation. This will enable you to gain access to new features, experiences, and integrated security as soon as possible. For more information, see the blog post [Windows 10 and the "disappearing" SAC-T](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-and-the-disappearing-SAC-T/ba-p/199747). - ->[!NOTE] ->For additional information, see the section about [Servicing Channels](#servicing-channels). -> ->You can also read the blog post [Waas simplified and aligned](https://blogs.technet.microsoft.com/windowsitpro/2017/07/27/waas-simplified-and-aligned/), with details on this change. - ->[!IMPORTANT] ->Devices on the Semi-Annual Channel (formerly called Current Branch for Business) must have their diagnostic data set to **1 (Basic)** or higher, in order to ensure that the service is performing at the expected quality. If diagnostic data is set to **0**, the device will be treated as if it were in the Semi-Annual Channel (Targeted)(formerly called Current Branch or CB) branch. For instructions to set the diagnostic data level, see [Configure the operating system diagnostic data level](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#diagnostic-data-levels). - -### Feature updates - -With Windows 10, Microsoft will package new features into feature updates that can be deployed using existing management tools. Because feature updates are delivered more frequently than with previous Windows releases — twice per year, around March and September, rather than every 3–5 years — changes will be in bite-sized chunks rather than all at once and end user readiness time much shorter. - ->[!TIP] -> The feature update cadence has been aligned with Office 365 ProPlus updates. Starting with this falls' update, both Windows and Office will deliver their major updates semi-annually, around March and September. See [upcoming changes to Office 365 ProPlus update management](https://support.office.com/article/Overview-of-the-upcoming-changes-to-Office-365-ProPlus-update-management-78b33779-9356-4cdf-9d2c-08350ef05cca) for more information about changes to Office update management. - -### Quality updates - -Monthly updates in previous Windows versions were often overwhelming because of the sheer number of updates available each month. Many organizations selectively chose which updates they wanted to install and which they didn’t, and this created countless scenarios in which organizations deployed essential security updates but picked only a subset of non-security fixes. - -In Windows 10, rather than receiving several updates each month and trying to figure out which the organization needs, which ultimately causes platform fragmentation, administrators will see one cumulative monthly update that supersedes the previous month’s update, containing both security and non-security fixes. This approach makes patching simpler and ensures that customers’ devices are more closely aligned with the testing done at Microsoft, reducing unexpected issues resulting from patching. The left side of Figure 1 provides an example of Windows 7 devices in an enterprise and what their current patch level might look like. On the right is what Microsoft’s test environment PCs contain. This drastic difference is the basis for many compatibility issues and system anomalies related to Windows updates. - -**Figure 1** - -![Comparison of patch environment in enterprise compared to test](images/waas-overview-patch.png) - - - -## Servicing channels - -To align with the new method of delivering feature updates and quality updates in Windows 10, Microsoft introduced the concept of servicing channels to allow customers to designate how frequently their individual devices are updated. For example, an organization may have test devices that the IT department can update with new features as soon as possible, and then specialized devices that require a longer feature update cycle to ensure continuity. - -With that in mind, Windows 10 offers 3 servicing channels. The [Windows Insider Program](#windows-insider) provides organizations with the opportunity to test and provide feedback on features that will be shipped in the next feature update. The [Semi-Annual Channel](#semi-annual-channel) provides new functionality with twice-per-year feature update releases. Organizations can choose when to deploy updates from the Semi-Annual Channel. The [Long Term Servicing Channel](#long-term-servicing-channel), which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years. For details about the versions in each servicing channel, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). - -The concept of servicing channels is new, but organizations can use the same management tools they used to manage updates and upgrades in previous versions of Windows. For more information about the servicing tool options for Windows 10 and their capabilities, see [Servicing tools](#servicing-tools). - ->[!NOTE] ->Servicing channels are not the only way to separate groups of devices when consuming updates. Each channel can contain subsets of devices, which staggers servicing even further. For information about the servicing strategy and ongoing deployment process for Windows 10, including the role of servicing channels, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md). - -### Semi-Annual Channel - -In the Semi-Annual servicing channel, feature updates are available as soon as Microsoft releases them. Windows 10, version 1511, had few servicing tool options to delay feature updates, limiting the use of the Semi-Annual servicing channel. Windows 10, version 1607 and onward, includes more servicing tools that can delay feature updates for up to 365 days. This servicing model is ideal for pilot deployments and testing of Windows 10 feature updates and for users such as developers who need to work with the latest features immediately. Once the latest release has gone through pilot deployment and testing, you will be able to choose the timing at which it goes into broad deployment. - -When Microsoft officially releases a feature update for Windows 10, it is made available to any PC not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft System Center Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the Semi-Annual Channel will be available but not necessarily immediately mandatory, depending on the policy of the management system. For more details about Windows 10 servicing tools, see [Servicing tools](#servicing-tools). - - -Organizations are expected to initiate targeted deployment on Semi-Annual Channel releases. All customers, independent software vendors (ISVs), and partners should use this time for testing and piloting within their environments. After 2-4 months, we will transition to broad deployment and encourage customers and partners to expand and accelerate the deployment of the release. For customers using Windows Update for Business, the Semi-Annual Channel provides three months of additional total deployment time before being required to update to the next release. - -> [!NOTE] -> All releases of Windows 10 have 18 months of servicing for all editions--these updates provide security and feature updates for the release. Customers running Enterprise and Education editions have an additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release. These versions include Enterprise and Education editions for Windows 10, versions 1607, 1703, 1709 and 1803. Starting in October 2018, all Semi-Annual Channel releases in the September/October timeframe will also have the additional 12 months of servicing for a total of 30 months from the initial release. The Semi-Annual Channel versions released in March/April timeframe will continue to have an 18 month lifecycle. -> -> -> [!NOTE] -> Organizations can electively delay feature updates into as many phases as they wish by using one of the servicing tools mentioned in the section Servicing tools. - -### Long-term Servicing Channel - -Specialized systems—such as PCs that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. It’s more important that these devices be kept as stable and secure as possible than up to date with user interface changes. The LTSC servicing model prevents Windows 10 Enterprise LTSB devices from receiving the usual feature updates and provides only quality updates to ensure that device security stays up to date. With this in mind, quality updates are still immediately available to Windows 10 Enterprise LTSB clients, but customers can choose to defer them by using one of the servicing tools mentioned in the section Servicing tools. - ->[!NOTE] ->Windows 10 Enterprise LTSB is a separate Long Term Servicing Channel version. -> ->Long-term Servicing channel is not intended for deployment on most or all the PCs in an organization; it should be used only for special-purpose devices. As a general guideline, a PC with Microsoft Office installed is a general-purpose device, typically used by an information worker, and therefore it is better suited for the Semi-Annual servicing channel. - -Microsoft never publishes feature updates through Windows Update on devices that run Windows 10 Enterprise LTSB. Instead, it typically offers new LTSC releases every 2–3 years, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle. - ->[!NOTE] ->Windows 10 LTSB will support the currently released processors and chipsets at the time of release of the LTSB. As future CPU generations are released, support will be created through future Windows 10 LTSB releases that customers can deploy for those systems. For more information, see **Supporting the latest processor and chipsets on Windows** in [Lifecycle support policy FAQ - Windows Products](https://support.microsoft.com/help/18581/lifecycle-support-policy-faq-windows-products). - -The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSB edition. This edition of Windows doesn’t include a number of applications, such as Microsoft Edge, Microsoft Store, Cortana (though limited search capabilities remain available), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. These apps are not supported in Windows 10 Enterprise LTSB edition, even if you install by using sideloading. - ->[!NOTE] ->If an organization has devices currently running Windows 10 Enterprise LTSB that it would like to change to the Semi-Annual Channel, it can make the change without losing user data. Because LTSB is its own SKU, however, an upgrade is required from Windows 10 Enterprise LTSB to Windows 10 Enterprise, which supports the Semi-Annual Channel. - -### Windows Insider - -For many IT pros, gaining visibility into feature updates early—before they’re available to the Semi-Annual Channel — can be both intriguing and valuable for future end user communications as well as provide the means to test for any issues on the next Semi-Annual Channel release. With Windows 10, feature flighting enables Windows Insiders to consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds of Windows 10 helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. - -Microsoft recommends that all organizations have at least a few PCs enrolled in the Windows Insider Program and provide feedback on any issues they encounter. For information about the Windows Insider Program for Business, go to [Windows Insider Program for Business](waas-windows-insider-for-business.md). - ->[!NOTE] ->Microsoft recommends that all organizations have at least a few PCs enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub app. -> ->The Windows Insider Program isn’t intended to replace Semi-Annual Channel deployments in an organization. Rather, it provides IT pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft. - - - -## Servicing tools - -There are many tools with which IT pros can service Windows as a service. Each option has its pros and cons, ranging from capabilities and control to simplicity and low administrative requirements. The following are examples of the servicing tools available to manage Windows as a service updates: - -- **Windows Update (stand-alone)** provides limited control over feature updates, with IT pros manually configuring the device to be in the Semi-Annual Channel. Organizations can target which devices defer updates by selecting the Defer upgrades check box in Start\Settings\Update & Security\Advanced Options on a Windows 10 client. -- **Windows Update for Business** is the second option for servicing Windows as a service. This servicing tool includes control over update deferment and provides centralized management using Group Policy. Windows Update for Business can be used to defer updates by up to 365 days, depending on the version. These deployment options are available to clients in the Semi-Annual Channel. In addition to being able to use Group Policy to manage Windows Update for Business, either option can be configured without requiring any on-premises infrastructure by using Intune. -- **Windows Server Update Services (WSUS)** provides extensive control over Windows 10 updates and is natively available in the Windows Server operating system. In addition to the ability to defer updates, organizations can add an approval layer for updates and choose to deploy them to specific computers or groups of computers whenever ready. -- **System Center Configuration Manager** provides the greatest control over servicing Windows as a service. IT pros can defer updates, approve them, and have multiple options for targeting deployments and managing bandwidth usage and deployment times. - -With all these options, which an organization chooses depends on the resources, staff, and expertise its IT organization already has. For example, if IT already uses System Center Configuration Manager to manage Windows updates, it can continue to use it. Similarly, if IT is using WSUS, it can continue to use that. For a consolidated look at the benefits of each tool, see Table 1. - -**Table 1** - -| Servicing tool | Can updates be deferred? | Ability to approve updates | Peer-to-peer option | Additional features | -| --- | --- | --- | --- | --- | -| Windows Update | Yes (manual) | No | Delivery Optimization | None| -| Windows Update for Business | Yes | No | Delivery Optimization | Other Group Policy objects | -| WSUS | Yes | Yes | BranchCache or Delivery Optimization | Upstream/downstream server scalability | -| Configuration Manager | Yes | Yes | BranchCache, Client Peer Cache | Distribution points, multiple deployment options | - ->[!NOTE] ->Due to [naming changes](#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products. - -
                        - -## Steps to manage updates for Windows 10 - -| | | -| --- | --- | -| ![done](images/checklistdone.png) | Learn about updates and servicing channels (this topic) | -| ![to do](images/checklistbox.gif) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                        or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | - - - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Quick guide to Windows as a service](waas-quick-start.md) -- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) -- [Manage device restarts after updates](waas-restart.md) - +--- +title: Overview of Windows as a service (Windows 10) +description: In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy. +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Overview of Windows as a service + + +**Applies to** + +- Windows 10 +- Windows 10 IoT Mobile + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. + +## Building + +Prior to Windows 10, Microsoft released new versions of Windows every few years. This traditional deployment schedule imposed a training burden on users because the feature revisions were often significant. That schedule also meant waiting long periods without new features — a scenario that doesn’t work in today’s rapidly changing world, a world in which new security, management, and deployment capabilities are necessary to address challenges. Windows as a service will deliver smaller feature updates two times per year, around March and September, to help address these issues. + +In the past, when Microsoft developed new versions of Windows, it typically released technical previews near the end of the process, when Windows was nearly ready to ship. With Windows 10, new features will be delivered to the [Windows Insider community](https://insider.windows.com/) as soon as possible — during the development cycle, through a process called *flighting* — so that organizations can see exactly what Microsoft is developing and start their testing as soon as possible. + +Microsoft also depends on receiving feedback from organizations throughout the development process so that it can make adjustments as quickly as possible rather than waiting until after release. For more information about the Windows Insider Program and how to sign up, see the section [Windows Insider](#windows-insider). + +Of course Microsoft also performs extensive internal testing, with engineering teams installing new builds daily, and larger groups of employees installing builds frequently, all before those builds are ever released to the Windows Insider Program. + +## Deploying + +Deploying Windows 10 is simpler than with previous versions of Windows. When migrating from earlier versions of Windows, an easy in-place upgrade process can be used to automatically preserve all apps, settings, and data. And once running Windows 10, deployment of Windows 10 feature updates will be equally simple. + +One of the biggest challenges for organizations when it comes to deploying a new version of Windows is compatibility testing. Whereas compatibility was previously a concern for organizations upgrading to a new version of Windows, Windows 10 is compatible with most hardware and software capable of running on Windows 7 or later. Because of this high level of compatibility, the app compatibility testing process can be greatly simplified. + +### Application compatibility + +Application compatibility testing has historically been a burden when approaching a Windows deployment or upgrade. With Windows 10, application compatibility from the perspective of desktop applications, websites, and apps built on the Universal Windows Platform (UWP) has improved tremendously. Microsoft understands the challenges organizations experienced when they migrated from the Windows XP operating system to Windows 7 and has been working to make Windows 10 upgrades a much better experience. + +Most Windows 7–compatible desktop applications will be compatible with Windows 10 straight out of the box. Windows 10 achieved such high compatibility because the changes in the existing Win32 application programming interfaces were minimal. Combined with valuable feedback via the Windows Insider Program and diagnostic data, this level of compatibility can be maintained through each feature update. As for websites, Windows 10 includes Internet Explorer 11 and its backward-compatibility modes for legacy websites. Finally, UWP apps follow a compatibility story similar to desktop applications, so most of them will be compatible with Windows 10. + +For the most important business-critical applications, organizations should still perform testing on a regular basis to validate compatibility with new builds. For remaining applications, consider validating them as part of a pilot deployment process to reduce the time spent on compatibility testing. If it’s unclear whether an application is compatible with Windows 10, IT pros can either consult with the ISV or check the supported software directory at [http://www.readyforwindows.com](http://www.readyforwindows.com). + +### Device compatibility + +Device compatibility in Windows 10 is also very strong; new hardware is not needed for Windows 10 as any device capable of running Windows 7 or later can run Windows 10. In fact, the minimum hardware requirements to run Windows 10 are the same as those required for Windows 7. Most hardware drivers that functioned in Windows 8.1, Windows 8, or Windows 7 will continue to function in Windows 10. + +## Servicing + +Traditional Windows servicing has included several release types: major revisions (e.g., the Windows 8.1, Windows 8, and Windows 7 operating systems), service packs, and monthly updates. With Windows 10, there are two release types: feature updates that add new functionality twice per year, and quality updates that provide security and reliability fixes at least once a month. + +With Windows 10, organizations will need to change the way they approach deploying updates. Servicing channels are the first way to separate users into deployment groups for feature and quality updates. With the introduction of servicing channels comes the concept of a [deployment ring](waas-deployment-rings-windows-10-updates.md), which is simply a way to categorize the combination of a deployment group and a servicing channel to group devices for successive waves of deployment. For more information about developing a deployment strategy that leverages servicing channels and deployment rings, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md). + +For information about each servicing tool available for Windows 10, see [Servicing tools](#servicing-tools). + +To align with this new update delivery model, Windows 10 has three servicing channels, each of which provides different levels of flexibility over when these updates are delivered to client computers. For information about the servicing channels available in Windows 10, see [Servicing channels](#servicing-channels). + +### Naming changes + +There are currently two release channels for Windows 10: + +- The **Semi-Annual Channel** receives feature updates twice per year. +- The **Long Term Servicing Channel**, which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years. + +>[!IMPORTANT] +>With each Semi-Annual Channel release, we recommend beginning deployment right away to devices selected for early adoption (targeted validation) and ramp up to full deployment at your discretion. This will enable you to gain access to new features, experiences, and integrated security as soon as possible. The "Semi-Annual Channel (Targeted)" designation is no longer used. For more information, see the blog post [Windows 10 and the "disappearing" SAC-T](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-and-the-disappearing-SAC-T/ba-p/199747). + +> [!NOTE] +>For additional information, see the section about [Servicing Channels](#servicing-channels). +> +>You can also read the blog post [Waas simplified and aligned](https://blogs.technet.microsoft.com/windowsitpro/2017/07/27/waas-simplified-and-aligned/), with details on this change. + +>[!IMPORTANT] +>Devices on the Semi-Annual Channel must have their diagnostic data set to **1 (Basic)** or higher, in order to ensure that the service is performing at the expected quality. For instructions to set the diagnostic data level, see [Configure the operating system diagnostic data level](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#diagnostic-data-levels). + +### Feature updates + +With Windows 10, Microsoft will package new features into feature updates that can be deployed using existing management tools. Because feature updates are delivered more frequently than with previous Windows releases — twice per year, around March and September, rather than every 3–5 years — changes will be in bite-sized chunks rather than all at once and end user readiness time much shorter. + + +### Quality updates + +Monthly updates in previous Windows versions were often overwhelming because of the sheer number of updates available each month. Many organizations selectively chose which updates they wanted to install and which they didn’t, and this created countless scenarios in which organizations deployed essential security updates but picked only a subset of non-security fixes. + +In Windows 10, rather than receiving several updates each month and trying to figure out which the organization needs, which ultimately causes platform fragmentation, administrators will see one cumulative monthly update that supersedes the previous month’s update, containing both security and non-security fixes. This approach makes patching simpler and ensures that customers’ devices are more closely aligned with the testing done at Microsoft, reducing unexpected issues resulting from patching. The left side of Figure 1 provides an example of Windows 7 devices in an enterprise and what their current patch level might look like. On the right is what Microsoft’s test environment devices contain. This drastic difference is the basis for many compatibility issues and system anomalies related to Windows updates. + +**Figure 1** + +![Comparison of patch environment in enterprise compared to test](images/waas-overview-patch.png) + + + +## Servicing channels + +To align with the new method of delivering feature updates and quality updates in Windows 10, Microsoft introduced the concept of servicing channels to allow customers to designate how frequently their individual devices are updated. For example, an organization may have test devices that the IT department can update with new features as soon as possible, and then specialized devices that require a longer feature update cycle to ensure continuity. + +With that in mind, Windows 10 offers three servicing channels. The [Windows Insider Program](#windows-insider) provides organizations with the opportunity to test and provide feedback on features that will be shipped in the next feature update. The [Semi-Annual Channel](#semi-annual-channel) provides new functionality with twice-per-year feature update releases. Organizations can choose when to deploy updates from the Semi-Annual Channel. The [Long Term Servicing Channel](#long-term-servicing-channel), which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years. For details about the versions in each servicing channel, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). + +The concept of servicing channels is new, but organizations can use the same management tools they used to manage updates and upgrades in previous versions of Windows. For more information about the servicing tool options for Windows 10 and their capabilities, see [Servicing tools](#servicing-tools). + +> [!NOTE] +> Servicing channels are not the only way to separate groups of devices when consuming updates. Each channel can contain subsets of devices, which staggers servicing even further. For information about the servicing strategy and ongoing deployment process for Windows 10, including the role of servicing channels, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md). + +### Semi-Annual Channel + +In the Semi-Annual servicing channel, feature updates are available as soon as Microsoft releases them. Windows 10, version 1511, had few servicing tool options to delay feature updates, limiting the use of the Semi-Annual servicing channel. Starting with Windows 10, version 1607, more servicing tools that can delay feature updates for up to 365 days are available. This servicing model is ideal for pilot deployments and testing of Windows 10 feature updates and for users such as developers who need to work with the latest features immediately. Once the latest release has gone through pilot deployment and testing, you will be able to choose the timing at which it goes into broad deployment. + +When Microsoft officially releases a feature update for Windows 10, it is made available to any device not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft System Center Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the Semi-Annual Channel will be available but not necessarily immediately mandatory, depending on the policy of the management system. For more details about Windows 10 servicing tools, see [Servicing tools](#servicing-tools). + + +Organizations are expected to initiate targeted deployment on Semi-Annual Channel releases. All customers, independent software vendors (ISVs), and partners should use this time for testing and piloting within their environments. After 2-4 months, we will transition to broad deployment and encourage customers and partners to expand and accelerate the deployment of the release. For customers using Windows Update for Business, the Semi-Annual Channel provides three months of additional total deployment time before being required to update to the next release. + +> [!NOTE] +> All releases of Windows 10 have 18 months of servicing for all editions--these updates provide security and feature updates for the release. Customers running Enterprise and Education editions have an additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release. These versions include Enterprise and Education editions for Windows 10, versions 1607 and later. Starting in October 2018, all Semi-Annual Channel releases in the September/October timeframe will also have the additional 12 months of servicing for a total of 30 months from the initial release. The Semi-Annual Channel versions released in March/April timeframe will continue to have an 18-month lifecycle. +> +> +> [!NOTE] +> Organizations can electively delay feature updates into as many phases as they wish by using one of the servicing tools mentioned in the section Servicing tools. + +### Long-term Servicing Channel + +Specialized systems—such as devices that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. It’s more important that these devices be kept as stable and secure as possible than up to date with user interface changes. The LTSC servicing model prevents Windows 10 Enterprise LTSB devices from receiving the usual feature updates and provides only quality updates to ensure that device security stays up to date. With this in mind, quality updates are still immediately available to Windows 10 Enterprise LTSB clients, but customers can choose to defer them by using one of the servicing tools mentioned in the section Servicing tools. + +> [!NOTE] +> Windows 10 Enterprise LTSB is a separate Long Term Servicing Channel version. +> +> Long-term Servicing channel is not intended for deployment on most or all the devices in an organization; it should be used only for special-purpose devices. As a general guideline, a device with Microsoft Office installed is a general-purpose device, typically used by an information worker, and therefore it is better suited for the Semi-Annual servicing channel. + +Microsoft never publishes feature updates through Windows Update on devices that run Windows 10 Enterprise LTSB. Instead, it typically offers new LTSC releases every 2–3 years, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle. + +> [!NOTE] +> Windows 10 LTSB will support the currently released processors and chipsets at the time of release of the LTSB. As future CPU generations are released, support will be created through future Windows 10 LTSB releases that customers can deploy for those systems. For more information, see **Supporting the latest processor and chipsets on Windows** in [Lifecycle support policy FAQ - Windows Products](https://support.microsoft.com/help/18581/lifecycle-support-policy-faq-windows-products). + +The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSB edition. This edition of Windows doesn’t include a number of applications, such as Microsoft Edge, Microsoft Store, Cortana (though limited search capabilities remain available), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. These apps are not supported in Windows 10 Enterprise LTSB edition, even if you install by using sideloading. + +> [!NOTE] +> If an organization has devices currently running Windows 10 Enterprise LTSB that it would like to change to the Semi-Annual Channel, it can make the change without losing user data. Because LTSB is its own SKU, however, an upgrade is required from Windows 10 Enterprise LTSB to Windows 10 Enterprise, which supports the Semi-Annual Channel. + +### Windows Insider + +For many IT pros, gaining visibility into feature updates early—before they’re available to the Semi-Annual Channel — can be both intriguing and valuable for future end user communications as well as provide the means to test for any issues on the next Semi-Annual Channel release. With Windows 10, feature flighting enables Windows Insiders to consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds of Windows 10 helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. + +Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program and provide feedback on any issues they encounter. For information about the Windows Insider Program for Business, go to [Windows Insider Program for Business](waas-windows-insider-for-business.md). + +>[!NOTE] +>Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub app. +> +> The Windows Insider Program isn’t intended to replace Semi-Annual Channel deployments in an organization. Rather, it provides IT pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft. + + + +## Servicing tools + +There are many tools with which IT pros can service Windows as a service. Each option has its pros and cons, ranging from capabilities and control to simplicity and low administrative requirements. The following are examples of the servicing tools available to manage Windows as a service updates: + +- **Windows Update (stand-alone)** provides limited control over feature updates, with IT pros manually configuring the device to be in the Semi-Annual Channel. Organizations can target which devices defer updates by selecting the Defer upgrades check box in Start\Settings\Update & Security\Advanced Options on a Windows 10 device. +- **Windows Update for Business** is the second option for servicing Windows as a service. This servicing tool includes control over update deferment and provides centralized management using Group Policy. Windows Update for Business can be used to defer updates by up to 365 days, depending on the version. These deployment options are available to clients in the Semi-Annual Channel. In addition to being able to use Group Policy to manage Windows Update for Business, either option can be configured without requiring any on-premises infrastructure by using Intune. +- **Windows Server Update Services (WSUS)** provides extensive control over Windows 10 updates and is natively available in the Windows Server operating system. In addition to the ability to defer updates, organizations can add an approval layer for updates and choose to deploy them to specific computers or groups of computers whenever ready. +- **System Center Configuration Manager** provides the greatest control over servicing Windows as a service. IT pros can defer updates, approve them, and have multiple options for targeting deployments and managing bandwidth usage and deployment times. + +With all these options, which an organization chooses depends on the resources, staff, and expertise its IT organization already has. For example, if IT already uses System Center Configuration Manager to manage Windows updates, it can continue to use it. Similarly, if IT is using WSUS, it can continue to use that. For a consolidated look at the benefits of each tool, see Table 1. + +**Table 1** + +| Servicing tool | Can updates be deferred? | Ability to approve updates | Peer-to-peer option | Additional features | +| --- | --- | --- | --- | --- | +| Windows Update | Yes (manual) | No | Delivery Optimization | None| +| Windows Update for Business | Yes | No | Delivery Optimization | Other Group Policy objects | +| WSUS | Yes | Yes | BranchCache or Delivery Optimization | Upstream/downstream server scalability | +| Configuration Manager | Yes | Yes | BranchCache, Client Peer Cache | Distribution points, multiple deployment options | + +>[!NOTE] +>Due to [naming changes](#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel. + +
                        + +## Steps to manage updates for Windows 10 + +| | | +| --- | --- | +| ![done](images/checklistdone.png) | Learn about updates and servicing channels (this topic) | +| ![to do](images/checklistbox.gif) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | +| ![to do](images/checklistbox.gif) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | +| ![to do](images/checklistbox.gif) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | +| ![to do](images/checklistbox.gif) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | +| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                        or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | + + + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Quick guide to Windows as a service](waas-quick-start.md) +- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Manage device restarts after updates](waas-restart.md) + diff --git a/windows/deployment/update/waas-quick-start.md b/windows/deployment/update/waas-quick-start.md index 8a2e544771..74c05a0abe 100644 --- a/windows/deployment/update/waas-quick-start.md +++ b/windows/deployment/update/waas-quick-start.md @@ -1,95 +1,88 @@ ---- -title: Quick guide to Windows as a service (Windows 10) -description: In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy. -keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 10/17/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Quick guide to Windows as a service - - -**Applies to** - -- Windows 10 -- Windows 10 Mobile -- Windows 10 IoT Mobile - -Windows as a service is a new concept, introduced with the release of Windows 10. While [an extensive set of documentation](index.md) is available explaining all the specifics and nuances, here is a quick guide to the most important concepts. - -## Definitions - -Some new terms have been introduced as part of Windows as a service, so you should know what these terms mean. -- **Feature updates** will be released twice per year, around March and September. As the name suggests, these will add new features to Windows 10, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years. -- **Quality updates** deliver both security and non-security fixes. They are typically released on the second Tuesday of each month ("Patch Tuesday"), though they can be released at any time. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update. The "servicing stack" is the code that installs other updates, so they are important to keep current. For more information, see [Servicing stack updates](servicing-stack-updates.md). -- **Insider Preview** builds are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features as well as compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. -- **Servicing channels** allow organizations to choose when to deploy new features. - - The **Semi-Annual Channel** receives feature updates twice per year. - - The **Long Term Servicing Channel**, which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years. -- **Deployment rings** are groups of devices used to initially pilot, and then to broadly deploy, each feature update in an organization. - -See [Overview of Windows as a service](waas-overview.md) for more information. - -For some interesting in-depth information about how cumulative updates work, see [Windows Updates using forward and reverse differentials](PSFxWhitepaper.md). - -## Key Concepts - -Windows 10 gains new functionality with twice-per-year feature update releases. Initially, organizations will use these feature update releases for pilot deployments to ensure compatibility with existing apps and infrastructure. After a period of time, typically about four months after the feature update release, broad deployment throughout the organization can begin. The exact timeframe is determined by feedback from customers, ISVs, OEMs, and others, with an explicit "ready for broad deployment" declaration signaling this to customers. - -Each Windows 10 feature update will be serviced with quality updates for 18 months from the date of the feature update release. - -Windows 10 Enterprise LTSB is a separate **Long Term Servicing Channel** version. Each release is supported for a total of 10 years (five years standard support, five years extended support). New releases are expected about every three years. - -See [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) for more information. - -## Staying up to date - -The process for keeping Windows 10 up to date involves deploying a feature update, at an appropriate time after its release. A variety of tools management and patching tools such as Windows Update, Windows Update for Business, Windows Server Update Services, System Center Configuration Manager, and third-party products) can be used to help with this process. [Windows Analytics Upgrade Readiness](https://www.microsoft.com/en-us/WindowsForBusiness/windows-analytics), a free tool to streamline Windows upgrade projects, is another important tool to help. - -Because app compatibility, both for desktop apps and web apps, is outstanding with Windows 10, extensive advanced testing isn’t required. Instead, only business-critical apps need to be tested, with the remaining apps validated through a series of pilot deployment rings. Once these pilot deployments have validated most apps, broad deployment can begin. - -This process repeats with each new feature update, twice per year. These are small deployment projects, compared to the big projects that were necessary with the old three-to-five-year Windows release cycles. - -Additional technologies such as BranchCache and Delivery Optimization, both peer-to-peer distribution tools, can help with the distribution of the feature update installation files. - -See [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) and [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) for more information. - -## Video: An overview of Windows as a service - -Click the following Microsoft Mechanics video for an overview of the updated release model, particularly the Semi-Annual Channel. - - -[![YouTube video of Michael Niehouse explaining how the Semi-Annual Channel works](images/SAC_vid_crop.jpg)](https://youtu.be/qSAsiM01GOU) - -## Learn more - -- [Adopting Windows as a service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) -- [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) -- [Manage device restarts after updates](waas-restart.md) - - - - - - - - +--- +title: Quick guide to Windows as a service (Windows 10) +description: In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy. +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Quick guide to Windows as a service + + +**Applies to** + +- Windows 10 +- Windows 10 IoT Mobile + +Windows as a service is a new concept, introduced with the release of Windows 10. While [an extensive set of documentation](index.md) is available explaining all the specifics and nuances, here is a quick guide to the most important concepts. + +## Definitions + +Some new terms have been introduced as part of Windows as a service, so you should know what these terms mean. +- **Feature updates** will be released twice per year, around March and September. As the name suggests, these will add new features to Windows 10, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years. +- **Quality updates** deliver both security and non-security fixes. They are typically released on the second Tuesday of each month ("Patch Tuesday"), though they can be released at any time. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update. The "servicing stack" is the code that installs other updates, so they are important to keep current. For more information, see [Servicing stack updates](servicing-stack-updates.md). +- **Insider Preview** builds are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features as well as compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. +- **Servicing channels** allow organizations to choose when to deploy new features. + - The **Semi-Annual Channel** receives feature updates twice per year. + - The **Long Term Servicing Channel**, which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years. +- **Deployment rings** are groups of devices used to initially pilot, and then to broadly deploy, each feature update in an organization. + +See [Overview of Windows as a service](waas-overview.md) for more information. + +For some interesting in-depth information about how cumulative updates work, see [Windows Updates using forward and reverse differentials](PSFxWhitepaper.md). + +## Key Concepts + +Windows 10 gains new functionality with twice-per-year feature update releases. Initially, organizations will use these feature update releases for pilot deployments to ensure compatibility with existing apps and infrastructure. After a period of time, typically about four months after the feature update release, broad deployment throughout the organization can begin. The exact timeframe is determined by feedback from customers, ISVs, OEMs, and others, with an explicit "ready for broad deployment" declaration signaling this to customers. + +Each Windows 10 feature update will be serviced with quality updates for 18 months from the date of the feature update release. + +Windows 10 Enterprise LTSB is a separate **Long Term Servicing Channel** version. Each release is supported for a total of 10 years (five years standard support, five years extended support). New releases are expected about every three years. + +See [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) for more information. + +## Staying up to date + +The process for keeping Windows 10 up to date involves deploying a feature update, at an appropriate time after its release. A variety of tools management and patching tools such as Windows Update, Windows Update for Business, Windows Server Update Services, System Center Configuration Manager, and third-party products) can be used to help with this process. [Windows Analytics Upgrade Readiness](https://www.microsoft.com/WindowsForBusiness/windows-analytics), a free tool to streamline Windows upgrade projects, is another important tool to help. + +Because app compatibility, both for desktop apps and web apps, is outstanding with Windows 10, extensive advanced testing isn’t required. Instead, only business-critical apps need to be tested, with the remaining apps validated through a series of pilot deployment rings. Once these pilot deployments have validated most apps, broad deployment can begin. + +This process repeats with each new feature update, twice per year. These are small deployment projects, compared to the big projects that were necessary with the old three-to-five-year Windows release cycles. + +Additional technologies such as BranchCache and Delivery Optimization, both peer-to-peer distribution tools, can help with the distribution of the feature update installation files. + +See [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) and [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) for more information. + + + +## Learn more + +- [Adopting Windows as a service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) +- [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Manage device restarts after updates](waas-restart.md) + + + + + + + + diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md index bf291e370f..0ea4468377 100644 --- a/windows/deployment/update/waas-restart.md +++ b/windows/deployment/update/waas-restart.md @@ -1,208 +1,207 @@ ---- -title: Manage device restarts after updates (Windows 10) -description: tbd -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 07/27/2017 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Manage device restarts after updates - - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - -You can use Group Policy settings, mobile device management (MDM) or Registry (not recommended) to configure when devices will restart after a Windows 10 update is installed. You can schedule update installation and set policies for restart, configure active hours for when restarts will not occur, or you can do both. - -## Schedule update installation - -In Group Policy, within **Configure Automatic Updates**, you can configure a forced restart after a specified installation time. - -To set the time, you need to go to **Configure Automatic Updates**, select option **4 - Auto download and schedule the install**, and then enter a time in the **Scheduled install time** dropdown. Alternatively, you can specify that installation will occur during the automatic maintenance time (configured using **Computer Configuration\Administrative Templates\Windows Components\Maintenance Scheduler**). - -**Always automatically restart at the scheduled time** forces a restart after the specified installation time and lets you configure a timer to warn a signed-in user that a restart is going to occur. - -While not recommended, the same result can be achieved through Registry. Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU**, set **AuOptions** to **4**, set the install time with **ScheduledInstallTime**, enable **AlwaysAutoRebootAtScheduledTime** and specify the delay in minutes through **AlwaysAutoRebootAtScheduledTimeMinutes**. Similar to Group Policy, **AlwaysAutoRebootAtScheduledTimeMinutes** sets the timer to warn a signed-in user that a restart is going to occur. - -For a detailed description of these registry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart). - -## Delay automatic reboot - -When **Configure Automatic Updates** is enabled in Group Policy, you can enable one of the following additional policies to delay an automatic reboot after update installation: - -- **Turn off auto-restart for updates during active hours** prevents automatic restart during active hours. -- **No auto-restart with logged on users for scheduled automatic updates installations** prevents automatic restart when a user is signed in. If a user schedules the restart in the update notification, the device will restart at the time the user specifies even if a user is signed in at the time. This policy only applies when **Configure Automatic Updates** is set to option **4-Auto download and schedule the install**. - -> [!NOTE] -> When using Remote Desktop Protocol connections, only active RDP sessions are considered as logged on users. Devices that do not have locally logged on users, or active RDP sessions, will be restarted. - -You can also use Registry, to prevent automatic restarts when a user is signed in. Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU**, set **AuOptions** to **4** and enable **NoAutoRebootWithLoggedOnUsers**. As with Group Policy, if a user schedules the restart in the update notification, it will override this setting. - -For a detailed description of these registry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart). - -## Configure active hours - -*Active hours* identify the period of time when you expect the device to be in use. Automatic restarts after an update will occur outside of the active hours. - -By default, active hours are from 8 AM to 5 PM on PCs and from 5 AM to 11 PM on phones. Users can change the active hours manually. - -Starting with Windows 10, version 1703, you can also specify the max active hours range. The specified range will be counted from the active hours start time. - -Administrators can use multiple ways to set active hours for managed devices: - -- You can use Group Policy, as described in the procedure that follows. -- You can use MDM, as described in [Configuring active hours with MDM](#configuring-active-hours-with-mdm). -- While not recommended, you can also configure active hours, as described in [Configuring active hours through Registry](#configuring-active-hours-through-registry). - -### Configuring active hours with Group Policy - -To configure active hours using Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and open the **Turn off auto-restart for updates during active hours** policy setting. When the policy is enabled, you can set the start and end times for active hours. - -![Use Group Policy to configure active hours](images/waas-active-hours-policy.png) - -### Configuring active hours with MDM - -MDM uses the [Update/ActiveHoursStart and Update/ActiveHoursEnd](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_ActiveHoursEnd) and [Update/ActiveHoursMaxRange](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-activehoursmaxrange) settings in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to configure active hours. - -### Configuring active hours through Registry - -This method is not recommended, and should only be used when neither Group Policy or MDM are available. -Any settings configured through Registry may conflict with any existing configuration that uses any of the methods mentioned above. - -You should set a combination of the following registry values, in order to configure active hours. -Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate** use **SetActiveHours** to enable or disable active hours and **ActiveHoursStart**,**ActiveHoursEnd** to specify the range of active hours. - -For a detailed description of these registry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart). - ->[!NOTE] ->To configure active hours manually on a single device, go to **Settings** > **Update & security** > **Windows Update** and select **Change active hours**. -> ->![Change active hours](images/waas-active-hours.png) - -### Configuring active hours max range - -With Windows 10, version 1703, administrators can specify the max active hours range users can set. This option gives you additional flexibility to leave some of the decision for active hours on the user's side, while making sure you allow enough time for updating. The max range is calculated from active hours start time. - -To configure active hours max range through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and open the **Specify active hours range for auto-restarts**. - -To configure active hours max range through MDM, use [**Update/ActiveHoursMaxRange**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-activehoursmaxrange). - -## Limit restart delays - -After an update is installed, Windows 10 attempts automatic restart outside of active hours. If the restart does not succeed after 7 days (by default), the user will see a notification that restart is required. You can use the **Specify deadline before auto-restart for update installation** policy to change the delay from 7 days to a number of days between 2 and 14. - -## Control restart notifications - -In Windows 10, version 1703, we have added settings to control restart notifications for users. - -### Auto-restart notifications - -Administrators can override the default behavior for the auto-restart required notification. By default, this notification will dismiss automatically. - -To configure this behavior through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and select **Configure auto-restart required notification for updates**. When configured to **2 - User Action**, a user that gets this notification must manually dismiss it. - -To configure this behavior through MDM, use [**Update/AutoRestartRequiredNotificationDismissal**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-AutoRestartRequiredNotificationDismissal) - -You can also configure the period prior to an update that this notification will show up on. The default value is 15 minutes. - -To change it through Group Policy, select **Configure auto-restart-reminder notifications for updates** under **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and select the period in minutes. - -To change it through MDM, use [**Update/AutoRestartNotificationSchedule**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-AutoRestartNotificationSchedule). - - -In some cases, you don't need a notification to show up. - -To do so through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and select **Turn off auto-restart notifications for update installations**. - -To do so through MDM, use [**Update/SetAutoRestartNotificationDisable**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-setautorestartnotificationdisable). - -### Scheduled auto-restart warnings - -Since users are not able to postpone a scheduled restart once the deadline has been reached, you can configure a warning reminder prior to the scheduled restart. You can also configure a warning prior to the restart, to notify users once the restart is imminent and allow them to save their work. - -To configure both through Group Policy, find **Configure auto-restart warning notifications schedule for updates** under **Computer Configuration\Administrative Templates\Windows Components\Windows Update**. The warning reminder can be configured by **Reminder (hours)** and the warning prior to an imminent auto-restart can be configured by **Warning (mins)**. - -In MDM, the warning reminder is configured using [**Update/ScheduleRestartWarning**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-ScheduleRestartWarning) and the auto-restart imminent warning is configured using [**Update/ScheduleImminentRestartWarning**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-ScheduleImminentRestartWarning). - -### Engaged restart - -Engaged restart is the period of time when users are required to schedule a restart. Initially, Windows will auto-restart outside of working hours. Once the set period ends (7 days by default), Windows transitions to user scheduled restarts. - -The following settings can be adjusted for engaged restart: -* Period of time before auto-restart transitions to engaged restart. -* The number of days that users can snooze engaged restart reminder notifications. -* The number of days before a pending restart automatically executes outside of working hours. - -In Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and pick **Specify Engaged restart transition and notification schedule for updates**. - -In MDM, use [**Update/EngagedRestartTransitionSchedule**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-EngagedRestartTransitionSchedule), [**Update/EngagedRestartSnoozeSchedule**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-EngagedRestartSnoozeSchedule) and [**Update/EngagedRestartDeadline**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-EngagedRestartDeadline) respectively. - -## Group Policy settings for restart - -In the Group Policy editor, you will see a number of policy settings that pertain to restart behavior in **Computer Configuration\Administrative Templates\Windows Components\Windows Update**. The following table shows which policies apply to Windows 10. - -| Policy | Applies to Windows 10 | Notes | -| --- | --- | --- | -| Turn off auto-restart for updates during active hours | ![yes](images/checkmark.png) | Use this policy to configure active hours, during which the device will not be restarted. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. | -| Always automatically restart at the scheduled time | ![yes](images/checkmark.png) | Use this policy to configure a restart timer (between 15 and 180 minutes) that will start immediately after Windows Update installs important updates. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** policy is enabled. | -| Specify deadline before auto-restart for update installation | ![yes](images/checkmark.png) | Use this policy to specify how many days (between 2 and 14) an automatic restart can be delayed. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. | -| No auto-restart with logged on users for scheduled automatic updates installations | ![yes](images/checkmark.png) | Use this policy to prevent automatic restart when a user is logged on. This policy applies only when the **Configure Automatic Updates** policy is configured to perform scheduled installations of updates.
                        There is no equivalent MDM policy setting for Windows 10 Mobile. | -| Re-prompt for restart with scheduled installations | ![no](images/crossmark.png) | | -| Delay Restart for scheduled installations | ![no](images/crossmark.png) | | -| Reschedule Automatic Updates scheduled installations | ![no](images/crossmark.png) | | - ->[!NOTE] ->You can only choose one path for restart behavior. ->If you set conflicting restart policies, the actual restart behavior may not be what you expected. ->When using RDP, only active RDP sessions are considered as logged on users. - - -## Registry keys used to manage restart -The following tables list registry values that correspond to the Group Policy settings for controlling restarts after updates in Windows 10. - -**HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate** - -| Registry key | Key type | Value | -| --- | --- | --- | -| ActiveHoursEnd | REG_DWORD | 0-23: set active hours to end at a specific hour
                        starts with 12 AM (0) and ends with 11 PM (23) | -| ActiveHoursStart | REG_DWORD | 0-23: set active hours to start at a specific hour
                        starts with 12 AM (0) and ends with 11 PM (23) | -| SetActiveHours | REG_DWORD | 0: disable automatic restart after updates outside of active hours
                        1: enable automatic restart after updates outside of active hours | - -**HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU** - -| Registry key | Key type | Value | -| --- | --- | --- | -| AlwaysAutoRebootAtScheduledTime | REG_DWORD | 0: disable automatic reboot after update installation at scheduled time
                        1: enable automatic reboot after update installation at ascheduled time | -| AlwaysAutoRebootAtScheduledTimeMinutes | REG_DWORD | 15-180: set automatic reboot to occur after given minutes | -| AUOptions | REG_DWORD | 2: notify for download and notify for installation of updates
                        3: automatically download and notify for installation of updates
                        4: Automatically download and schedule installation of updates
                        5: allow the local admin to configure these settings
                        **Note:** To configure restart behavior, set this value to **4** | -| NoAutoRebootWithLoggedOnUsers | REG_DWORD | 0: disable do not reboot if users are logged on
                        1: do not reboot after an update installation if a user is logged on
                        **Note:** If disabled : Automatic Updates will notify the user that the computer will automatically restart in 5 minutes to complete the installation | -| ScheduledInstallTime | REG_DWORD | 0-23: schedule update installation time to a specific hour
                        starts with 12 AM (0) and ends with 11 PM (23) | - -There are 3 different registry combinations for controlling restart behavior: - -- To set active hours, **SetActiveHours** should be **1**, while **ActiveHoursStart** and **ActiveHoursEnd** should define the time range. -- To schedule a specific installation and reboot time, **AUOptions** should be **4**, **ScheduledInstallTime** should specify the installation time, **AlwaysAutoRebootAtScheduledTime** set to **1** and **AlwaysAutoRebootAtScheduledTimeMinutes** should specify number of minutes to wait before rebooting. -- To delay rebooting if a user is logged on, **AUOptions** should be **4**, while **NoAutoRebootWithLoggedOnUsers** is set to **1**. - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Overview of Windows as a service](waas-overview.md) -- [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +--- +title: Manage device restarts after updates (Windows 10) +description: tbd +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Manage device restarts after updates + + +**Applies to** + +- Windows 10 + + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +You can use Group Policy settings, mobile device management (MDM) or Registry (not recommended) to configure when devices will restart after a Windows 10 update is installed. You can schedule update installation and set policies for restart, configure active hours for when restarts will not occur, or you can do both. + +## Schedule update installation + +In Group Policy, within **Configure Automatic Updates**, you can configure a forced restart after a specified installation time. + +To set the time, you need to go to **Configure Automatic Updates**, select option **4 - Auto download and schedule the install**, and then enter a time in the **Scheduled install time** dropdown. Alternatively, you can specify that installation will occur during the automatic maintenance time (configured using **Computer Configuration\Administrative Templates\Windows Components\Maintenance Scheduler**). + +**Always automatically restart at the scheduled time** forces a restart after the specified installation time and lets you configure a timer to warn a signed-in user that a restart is going to occur. + +While not recommended, the same result can be achieved through Registry. Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU**, set **AuOptions** to **4**, set the install time with **ScheduledInstallTime**, enable **AlwaysAutoRebootAtScheduledTime** and specify the delay in minutes through **AlwaysAutoRebootAtScheduledTimeMinutes**. Similar to Group Policy, **AlwaysAutoRebootAtScheduledTimeMinutes** sets the timer to warn a signed-in user that a restart is going to occur. + +For a detailed description of these registry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart). + +## Delay automatic reboot + +When **Configure Automatic Updates** is enabled in Group Policy, you can enable one of the following additional policies to delay an automatic reboot after update installation: + +- **Turn off auto-restart for updates during active hours** prevents automatic restart during active hours. +- **No auto-restart with logged on users for scheduled automatic updates installations** prevents automatic restart when a user is signed in. If a user schedules the restart in the update notification, the device will restart at the time the user specifies even if a user is signed in at the time. This policy only applies when **Configure Automatic Updates** is set to option **4-Auto download and schedule the install**. + +> [!NOTE] +> When using Remote Desktop Protocol connections, only active RDP sessions are considered as logged on users. Devices that do not have locally logged on users, or active RDP sessions, will be restarted. + +You can also use Registry, to prevent automatic restarts when a user is signed in. Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU**, set **AuOptions** to **4** and enable **NoAutoRebootWithLoggedOnUsers**. As with Group Policy, if a user schedules the restart in the update notification, it will override this setting. + +For a detailed description of these registry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart). + +## Configure active hours + +*Active hours* identify the period of time when you expect the device to be in use. Automatic restarts after an update will occur outside of the active hours. + +By default, active hours are from 8 AM to 5 PM on PCs and from 5 AM to 11 PM on phones. Users can change the active hours manually. + +Starting with Windows 10, version 1703, you can also specify the max active hours range. The specified range will be counted from the active hours start time. + +Administrators can use multiple ways to set active hours for managed devices: + +- You can use Group Policy, as described in the procedure that follows. +- You can use MDM, as described in [Configuring active hours with MDM](#configuring-active-hours-with-mdm). +- While not recommended, you can also configure active hours, as described in [Configuring active hours through Registry](#configuring-active-hours-through-registry). + +### Configuring active hours with Group Policy + +To configure active hours using Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and open the **Turn off auto-restart for updates during active hours** policy setting. When the policy is enabled, you can set the start and end times for active hours. + +![Use Group Policy to configure active hours](images/waas-active-hours-policy.png) + +### Configuring active hours with MDM + +MDM uses the [Update/ActiveHoursStart and Update/ActiveHoursEnd](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_ActiveHoursEnd) and [Update/ActiveHoursMaxRange](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-activehoursmaxrange) settings in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to configure active hours. + +### Configuring active hours through Registry + +This method is not recommended, and should only be used when neither Group Policy or MDM are available. +Any settings configured through Registry may conflict with any existing configuration that uses any of the methods mentioned above. + +You should set a combination of the following registry values, in order to configure active hours. +Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate** use **SetActiveHours** to enable or disable active hours and **ActiveHoursStart**,**ActiveHoursEnd** to specify the range of active hours. + +For a detailed description of these registry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart). + +>[!NOTE] +>To configure active hours manually on a single device, go to **Settings** > **Update & security** > **Windows Update** and select **Change active hours**. +> +>![Change active hours](images/waas-active-hours.png) + +### Configuring active hours max range + +With Windows 10, version 1703, administrators can specify the max active hours range users can set. This option gives you additional flexibility to leave some of the decision for active hours on the user's side, while making sure you allow enough time for updating. The max range is calculated from active hours start time. + +To configure active hours max range through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and open the **Specify active hours range for auto-restarts**. + +To configure active hours max range through MDM, use [**Update/ActiveHoursMaxRange**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-activehoursmaxrange). + +## Limit restart delays + +After an update is installed, Windows 10 attempts automatic restart outside of active hours. If the restart does not succeed after 7 days (by default), the user will see a notification that restart is required. You can use the **Specify deadline before auto-restart for update installation** policy to change the delay from 7 days to a number of days between 2 and 14. + +## Control restart notifications + +In Windows 10, version 1703, we have added settings to control restart notifications for users. + +### Auto-restart notifications + +Administrators can override the default behavior for the auto-restart required notification. By default, this notification will dismiss automatically. + +To configure this behavior through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and select **Configure auto-restart required notification for updates**. When configured to **2 - User Action**, a user that gets this notification must manually dismiss it. + +To configure this behavior through MDM, use [**Update/AutoRestartRequiredNotificationDismissal**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-AutoRestartRequiredNotificationDismissal) + +You can also configure the period prior to an update that this notification will show up on. The default value is 15 minutes. + +To change it through Group Policy, select **Configure auto-restart-reminder notifications for updates** under **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and select the period in minutes. + +To change it through MDM, use [**Update/AutoRestartNotificationSchedule**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-AutoRestartNotificationSchedule). + + +In some cases, you don't need a notification to show up. + +To do so through Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and select **Turn off auto-restart notifications for update installations**. + +To do so through MDM, use [**Update/SetAutoRestartNotificationDisable**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-setautorestartnotificationdisable). + +### Scheduled auto-restart warnings + +Since users are not able to postpone a scheduled restart once the deadline has been reached, you can configure a warning reminder prior to the scheduled restart. You can also configure a warning prior to the restart, to notify users once the restart is imminent and allow them to save their work. + +To configure both through Group Policy, find **Configure auto-restart warning notifications schedule for updates** under **Computer Configuration\Administrative Templates\Windows Components\Windows Update**. The warning reminder can be configured by **Reminder (hours)** and the warning prior to an imminent auto-restart can be configured by **Warning (mins)**. + +In MDM, the warning reminder is configured using [**Update/ScheduleRestartWarning**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-ScheduleRestartWarning) and the auto-restart imminent warning is configured using [**Update/ScheduleImminentRestartWarning**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-ScheduleImminentRestartWarning). + +### Engaged restart + +Engaged restart is the period of time when users are required to schedule a restart. Initially, Windows will auto-restart outside of working hours. Once the set period ends (7 days by default), Windows transitions to user scheduled restarts. + +The following settings can be adjusted for engaged restart: +* Period of time before auto-restart transitions to engaged restart. +* The number of days that users can snooze engaged restart reminder notifications. +* The number of days before a pending restart automatically executes outside of working hours. + +In Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update** and pick **Specify Engaged restart transition and notification schedule for updates**. + +In MDM, use [**Update/EngagedRestartTransitionSchedule**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-EngagedRestartTransitionSchedule), [**Update/EngagedRestartSnoozeSchedule**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-EngagedRestartSnoozeSchedule) and [**Update/EngagedRestartDeadline**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider?UpdatePolicies#update-EngagedRestartDeadline) respectively. + +## Group Policy settings for restart + +In the Group Policy editor, you will see a number of policy settings that pertain to restart behavior in **Computer Configuration\Administrative Templates\Windows Components\Windows Update**. The following table shows which policies apply to Windows 10. + +| Policy | Applies to Windows 10 | Notes | +| --- | --- | --- | +| Turn off auto-restart for updates during active hours | ![yes](images/checkmark.png) | Use this policy to configure active hours, during which the device will not be restarted. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. | +| Always automatically restart at the scheduled time | ![yes](images/checkmark.png) | Use this policy to configure a restart timer (between 15 and 180 minutes) that will start immediately after Windows Update installs important updates. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** policy is enabled. | +| Specify deadline before auto-restart for update installation | ![yes](images/checkmark.png) | Use this policy to specify how many days (between 2 and 14) an automatic restart can be delayed. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. | +| No auto-restart with logged on users for scheduled automatic updates installations | ![yes](images/checkmark.png) | Use this policy to prevent automatic restart when a user is logged on. This policy applies only when the **Configure Automatic Updates** policy is configured to perform scheduled installations of updates.
                        There is no equivalent MDM policy setting for Windows 10 Mobile. | +| Re-prompt for restart with scheduled installations | ![no](images/crossmark.png) | | +| Delay Restart for scheduled installations | ![no](images/crossmark.png) | | +| Reschedule Automatic Updates scheduled installations | ![no](images/crossmark.png) | | + +>[!NOTE] +>You can only choose one path for restart behavior. +>If you set conflicting restart policies, the actual restart behavior may not be what you expected. +>When using RDP, only active RDP sessions are considered as logged on users. + + +## Registry keys used to manage restart +The following tables list registry values that correspond to the Group Policy settings for controlling restarts after updates in Windows 10. + +**HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate** + +| Registry key | Key type | Value | +| --- | --- | --- | +| ActiveHoursEnd | REG_DWORD | 0-23: set active hours to end at a specific hour
                        starts with 12 AM (0) and ends with 11 PM (23) | +| ActiveHoursStart | REG_DWORD | 0-23: set active hours to start at a specific hour
                        starts with 12 AM (0) and ends with 11 PM (23) | +| SetActiveHours | REG_DWORD | 0: disable automatic restart after updates outside of active hours
                        1: enable automatic restart after updates outside of active hours | + +**HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU** + +| Registry key | Key type | Value | +| --- | --- | --- | +| AlwaysAutoRebootAtScheduledTime | REG_DWORD | 0: disable automatic reboot after update installation at scheduled time
                        1: enable automatic reboot after update installation at ascheduled time | +| AlwaysAutoRebootAtScheduledTimeMinutes | REG_DWORD | 15-180: set automatic reboot to occur after given minutes | +| AUOptions | REG_DWORD | 2: notify for download and notify for installation of updates
                        3: automatically download and notify for installation of updates
                        4: Automatically download and schedule installation of updates
                        5: allow the local admin to configure these settings
                        **Note:** To configure restart behavior, set this value to **4** | +| NoAutoRebootWithLoggedOnUsers | REG_DWORD | 0: disable do not reboot if users are logged on
                        1: do not reboot after an update installation if a user is logged on
                        **Note:** If disabled : Automatic Updates will notify the user that the computer will automatically restart in 5 minutes to complete the installation | +| ScheduledInstallTime | REG_DWORD | 0-23: schedule update installation time to a specific hour
                        starts with 12 AM (0) and ends with 11 PM (23) | + +There are 3 different registry combinations for controlling restart behavior: + +- To set active hours, **SetActiveHours** should be **1**, while **ActiveHoursStart** and **ActiveHoursEnd** should define the time range. +- To schedule a specific installation and reboot time, **AUOptions** should be **4**, **ScheduledInstallTime** should specify the installation time, **AlwaysAutoRebootAtScheduledTime** set to **1** and **AlwaysAutoRebootAtScheduledTimeMinutes** should specify number of minutes to wait before rebooting. +- To delay rebooting if a user is logged on, **AUOptions** should be **4**, while **NoAutoRebootWithLoggedOnUsers** is set to **1**. + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Overview of Windows as a service](waas-overview.md) +- [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) diff --git a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md index d58eb30284..2375cfd6b8 100644 --- a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md +++ b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md @@ -1,228 +1,193 @@ ---- -title: Assign devices to servicing channels for Windows 10 updates (Windows 10) -description: tbd -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 10/13/2017 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Assign devices to servicing channels for Windows 10 updates - - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - ->[!TIP] ->If you're not familiar with the Windows 10 servicing or release channels, read [Servicing Channels](waas-overview.md#servicing-channels) first. -> ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB, CBB and LTSB may still be displayed in some of our products. - -Semi-Annual Channel is the default servicing channel for all Windows 10 devices except those with the LTSB edition installed. The following table shows the servicing channels available to each Windows 10 edition. - -| Windows 10 edition | Semi-Annual Channel (Targeted) | Semi-Annual Channel | Long-Term Servicing Channel | Insider Program | -| --- | --- | --- | --- | --- | -| Home | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Pro | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Enterprise | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Enterprise LTSB | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | -| Pro Education | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Education | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Mobile | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Mobile Enterprise | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | - - - ->[!NOTE] ->The LTSB edition of Windows 10 is only available through the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). - ->[!NOTE] ->Semi-Annual Channel (Targeted) should be used only by the customers that are using [Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb). For those who don't use Windows Update for Business, Semi-Annual Channel (Targeted) would be the same as Semi-Annual Channel. - -## Assign devices to Semi-Annual Channel - ->[!IMPORTANT] ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB, CBB and LTSB may still be displayed in some of our products. -> ->In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. - -**To assign a single PC locally to CBB** - -1. Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options**. -2. Select **Defer feature updates**. - -**To assign PCs to CBB using Group Policy** - -- In Windows 10, version 1511: - - Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** - -- In Windows 10, version 1607: - - Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** - enable policy and set branch readiness level to CBB - -**To assign PCs to CBB using MDM** - -- In Windows 10, version 1511: - - ../Vendor/MSFT/Policy/Config/Update/**RequireDeferUpgrade** - -- In Windows 10, version 1607: - - ../Vendor/MSFT/Policy/Config/Update/**BranchReadinessLevel** - -**To assign Windows 10 Mobile Enterprise to CBB using MDM** - -- In Windows 10 Mobile Enterprise, version 1511: - - ../Vendor/MSFT/Policy/Config/Update/RequireDeferUpgrade - -- In Windows 10 Mobile Enterprise, version 1607: - - ../Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel - -## Enroll devices in the Windows Insider Program - -To get started with the Windows Insider Program for Business, you will need to follow a few simple steps: - -1. On the [Windows Insider](https://insider.windows.com) website, go to **For Business > Getting Started** to [register your organizational Azure AD account](https://insider.windows.com/en-us/insidersigninaad/). -2. **Register your domain**. Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/en-us/for-business-organization-admin/) and control settings centrally.
                        **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. -3. Make sure the **Allow Telemetry** setting is set to **2** or higher. -4. Starting with Windows 10, version 1709, set policies to manage preview builds and their delivery: - -The **Manage preview builds** setting gives administrators control over enabling or disabling preview build installation on a device. You can also decide to stop preview builds once the release is public. -* Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business** - *Manage preview builds* -* MDM: **Update/ManagePreviewBuilds** - -The **Branch Readiness Level** settings allows you to choose between preview flight rings, and allows you to defer or pause the delivery of updates. -* Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/ Windows Update for Business** - *Select when Preview Builds and Feature Updates are received* -* MDM: **Update/BranchReadinessLevel** - -For more information, see [Windows Insider Program for Business](waas-windows-insider-for-business.md) - -## Block access to Windows Insider Program - -To prevent devices in your enterprise from being enrolled in the Insider Program for early releases of Windows 10: - -- Group Policy: Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\\**Toggle user control over Insider builds** -- MDM: Policy CSP - [System/AllowBuildPreview](https://msdn.microsoft.com/library/windows/hardware/dn904962%28v=vs.85%29.aspx#System_AllowBuildPreview) - ->[!IMPORTANT] ->Starting with Windows 10, version 1709, this policy is replaced by **Manage preview builds** policy. -> * Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business** - *Manage preview builds* -> * MDM: **Update/ManagePreviewBuilds** - - -## Switching channels - -During the life of a device, it may be necessary or desirable to switch between the available channels. Depending on the channel you are using, the exact mechanism for doing this can be different; some will be simple, others more involved. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        From this channelTo this channelYou need to
                        Windows Insider ProgramSemi-Annual Channel (Targeted)Wait for the final Semi-Annual Channel release.
                        Semi-Annual ChannelNot directly possible, because Windows Insider Program devices are automatically upgraded to the Semi-Annual Channel (Targeted) release at the end of the development cycle.
                        Long-Term Servicing ChannelNot directly possible (requires wipe-and-load).
                        Semi-Annual Channel (Targeted)InsiderUse the Settings app to enroll the device in the Windows Insider Program.
                        Semi-Annual ChannelSelect the Defer upgrade setting, or move the PC to a target group or flight that will not receive the next upgrade until it is business ready. Note that this change will not have any immediate impact; it only prevents the installation of the next Semi-Annual Channel release.
                        Long-Term Servicing ChannelNot directly possible (requires wipe-and-load).
                        Semi-Annual ChannelInsiderUse the Settings app to enroll the device in the Windows Insider Program.
                        Semi-Annual Channel (Targeted)Disable the Defer upgrade setting, or move the device to a target group or flight that will receive the latest Current Semi-Annual Channel release.
                        Long-Term Servicing ChannelNot directly possible (requires wipe-and-load).
                        Long-Term Servicing ChannelInsiderUse media to upgrade to the latest Windows Insider Program build.
                        Semi-Annual Channel (Targeted)Use media to upgrade. Note that the Semi-Annual Channel build must be a later build.
                        Semi-Annual ChannelUse media to upgrade. Note that the Semi-Annual Channel build must be a later build.
                        - -## Block user access to Windows Update settings - -In Windows 10, administrators can control user access to Windows Update. -By enabling the Group Policy setting under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features**, administrators can disable the "Check for updates" option for users. Any background update scans, downloads and installations will continue to work as configured. - ->[!NOTE] -> In Windows 10, any Group Policy user configuration settings for Windows Update were deprecated and are no longer supported on this platform. - -## Steps to manage updates for Windows 10 - -| | | -| --- | --- | -| ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | -| ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | -| ![done](images/checklistdone.png) | Assign devices to servicing channels for Windows 10 updates (this topic) | -| ![to do](images/checklistbox.gif) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                        or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) -- [Manage device restarts after updates](waas-restart.md) +--- +title: Assign devices to servicing channels for Windows 10 updates (Windows 10) +description: tbd +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Assign devices to servicing channels for Windows 10 updates + + +**Applies to** + +- Windows 10 + + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +>[!TIP] +>If you're not familiar with the Windows 10 servicing or release channels, read [Servicing Channels](waas-overview.md#servicing-channels) first. +> +>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel. + +The Semi-Annual Channel is the default servicing channel for all Windows 10 devices except those with the LTSB edition installed. The following table shows the servicing channels available to each Windows 10 edition. + +| Windows 10 edition | Semi-Annual Channel | Long-Term Servicing Channel | Insider Program | +| --- | --- | --- | --- | +| Home | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Pro | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Enterprise | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Enterprise LTSB | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | +| Pro Education | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Education | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Mobile | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Mobile Enterprise | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | + + + +>[!NOTE] +>The LTSB edition of Windows 10 is only available through the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). + + + +## Assign devices to Semi-Annual Channel + +>[!IMPORTANT] +>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel. + +**To assign a single devices locally to the Semi-Annual Channel** + +1. Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options**. +2. Select **Defer feature updates**. + +**To assign devicess to the Semi-Annual Channel by using Group Policy** + + +- In Windows 10, version 1607 and later releases: + + Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** - enable policy and set branch readiness level to the Semi-Annual Channel + +**To assign devicess to to the Semi-Annual Channel by using MDM** + + +- In Windows 10, version 1607 and later releases: + + ../Vendor/MSFT/Policy/Config/Update/**BranchReadinessLevel** + +**To assign Windows 10 Mobile Enterprise devices to the Semi-Annual Channel by using MDM** + + +- In Windows 10 Mobile Enterprise, version 1607 and later releases: + + ../Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel + +## Enroll devices in the Windows Insider Program + +To get started with the Windows Insider Program for Business, you will need to follow a few simple steps: + +1. On the [Windows Insider](https://insider.windows.com) website, go to **For Business > Getting Started** to [register your organizational Azure AD account](https://insider.windows.com/en-us/insidersigninaad/). +2. **Register your domain**. Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/en-us/for-business-organization-admin/) and control settings centrally.
                        **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. +3. Make sure the **Allow Telemetry** setting is set to **2** or higher. +4. Starting with Windows 10, version 1709, set policies to manage preview builds and their delivery: + +The **Manage preview builds** setting gives administrators control over enabling or disabling preview build installation on a device. You can also decide to stop preview builds once the release is public. +* Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business** - *Manage preview builds* +* MDM: **Update/ManagePreviewBuilds** + +The **Branch Readiness Level** settings allows you to choose between preview flight rings, and allows you to defer or pause the delivery of updates. +* Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/ Windows Update for Business** - *Select when Preview Builds and Feature Updates are received* +* MDM: **Update/BranchReadinessLevel** + +For more information, see [Windows Insider Program for Business](waas-windows-insider-for-business.md) + +## Block access to Windows Insider Program + +To prevent devices in your enterprise from being enrolled in the Insider Program for early releases of Windows 10: + +- Group Policy: Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\\**Toggle user control over Insider builds** +- MDM: Policy CSP - [System/AllowBuildPreview](https://msdn.microsoft.com/library/windows/hardware/dn904962%28v=vs.85%29.aspx#System_AllowBuildPreview) + +>[!IMPORTANT] +>Starting with Windows 10, version 1709, this policy is replaced by **Manage preview builds** policy. +> * Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business** - *Manage preview builds* +> * MDM: **Update/ManagePreviewBuilds** + + +## Switching channels + +During the life of a device, it might be necessary or desirable to switch between the available channels. Depending on the channel you are using, the exact mechanism for doing this can be different; some will be simple, others more involved. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        From this channelTo this channelYou need to
                        Windows Insider Program
                        Semi-Annual ChannelNot directly possible
                        Long-Term Servicing ChannelNot directly possible (requires wipe-and-load).
                        Semi-Annual ChannelInsiderUse the Settings app to enroll the device in the Windows Insider Program.
                        Long-Term Servicing ChannelNot directly possible (requires wipe-and-load).
                        Long-Term Servicing ChannelInsiderUse media to upgrade to the latest Windows Insider Program build.
                        Semi-Annual ChannelUse media to upgrade. Note that the Semi-Annual Channel build must be a later build.
                        + +## Block user access to Windows Update settings + +In Windows 10, administrators can control user access to Windows Update. +By enabling the Group Policy setting under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features**, administrators can disable the "Check for updates" option for users. Any background update scans, downloads and installations will continue to work as configured. + +>[!NOTE] +> In Windows 10, any Group Policy user configuration settings for Windows Update were deprecated and are no longer supported on this platform. + +## Steps to manage updates for Windows 10 + +| | | +| --- | --- | +| ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | +| ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | +| ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | +| ![done](images/checklistdone.png) | Assign devices to servicing channels for Windows 10 updates (this topic) | +| ![to do](images/checklistbox.gif) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | +| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                        or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-servicing-differences.md b/windows/deployment/update/waas-servicing-differences.md index 4e7773bbf9..1b5f466c3f 100644 --- a/windows/deployment/update/waas-servicing-differences.md +++ b/windows/deployment/update/waas-servicing-differences.md @@ -1,119 +1,127 @@ ---- -title: Servicing differences between Windows 10 and older operating systems -ms.reviewer: -manager: laurawi -description: Learn the differences between servicing Windows 10 and servicing older operating systems. -keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.topic: article -ms.collection: M365-modern-desktop ---- -# Understanding the differences between servicing Windows 10-era and legacy Windows operating systems - -> Applies to: Windows 10 -> -> **February 15, 2019: This document has been corrected and edited to reflect that security-only updates for legacy OS versions are not cumulative. They were previously identified as cumulative similar to monthly rollups, which is inaccurate.** - -Today, many enterprise customers have a mix of modern and legacy client and server operating systems. Managing the servicing and updating differences between those legacy operating systems and Windows 10 versions adds a level of complexity that is not well understood. This can be confusing. With the end of support for legacy [Windows 7 SP1](https://support.microsoft.com/help/4057281/windows-7-support-will-end-on-january-14-2020) and Windows Server 2008 R2 variants on January 14, 2020, System Administrators have a critical need critical to understand how best to leverage a modern workplace to support system updates. - -The following provides an initial overview of how updating client and server differs between the Windows 10-era Operating Systems (such as, Windows 10 version 1709, Windows Server 2016) and legacy operating systems (such as Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2). - ->[!NOTE] ->A note on naming convention in this article: For brevity, "Windows 10" refers to all operating systems across client, server and IoT released since July 2015, while "legacy" refers to all operating systems prior to that period for client and server, including Windows 7, Window 8.1, Windows Server 2008 R2, Windows Server 2012 R2, etc. - -## Infinite fragmentation -Prior to Windows 10, all updates to operating system (OS) components were published individually. On "Update Tuesday," customers would pick and choose individual updates they wanted to apply. Most chose to update security fixes, while far fewer selected non-security fixes, updated drivers, or installed .NET Framework updates. - -As a result, each environment within the global Windows ecosystem that had only a subset of security and non-security fixes installed had a different set of binaries and behaviors than those that consistently installed every available update as tested by Microsoft. - -This resulted in a fragmented ecosystem that created diverse challenges in predictively testing interoperability, resulting in high update failure rates - which were subsequently mitigated by customers removing individual updates that were causing issues. Each customer that selectively removed individual updates amplified this fragmentation by creating more diverse environment permutations across the ecosystem. As an IT Administrator once quipped, "If you’ve seen one Windows 7 PC, you have seen one Windows 7 PC," suggesting no consistency or predictability across more than 250M commercial devices at the time. - -## Windows 10 – Next generation -Windows 10 provided an opportunity to end the era of infinite fragmentation. With Windows 10 and the Windows as a service model, updates came rolled together in the "latest cumulative update" (LCU) packages for both client and server. Every new update published includes all changes from previous updates, as well as new fixes. Since Windows client and server share the same code base, these LCUs allow the same update to be installed on the same client and server OS family, further reducing fragmentation. - -This helps simplify servicing. Devices with the original Release to Market (RTM) version of a feature release installed could get up to date by installing the most recent LCU. - -Windows publishes the new LCU packages for each Windows 10 version (1607, 1709, etc.) on the second Tuesday of each month. This package is classified as a required security update and contains contents from the previous LCU as well as new security, non-security and Internet Explorer 11 (IE11) fixes. The security classification, by definition, requires a reboot of the device to complete installation of the update. - - -![High level cumulative update model](images/servicing-cadence.png) -*Figure 1.0 - High level cumulative update model* - -Another benefit of the LCU model is fewer steps. Devices that have the original Release to Market (RTM) version of a release can install the most recent LCU to get up to date in one step, rather than having to install multiple updates with reboots after each. - -This cumulative update model for Windows 10 has helped provide the Windows ecosystem with consistent update experiences that can be predicted by baseline testing before release. Even with highly complex updates with hundreds of fixes, the number of incidents with monthly security updates for Windows 10 have fallen month over month since the initial release of Windows 10. - -### Points to consider - -- Windows 10 does not have the concept of a Security-Only or Monthly Rollup for updates. All updates are an LCU package, which includes the last release plus anything new. -- Windows 10 no longer has the concept of a "hotfix" since all individual updates must be rolled into the cumulative packages. (Note: Any private fix is offered for customer validation only, and then rolled into an LCU.) -- [Updates for the .NET Framework](https://blogs.msdn.microsoft.com/dotnet/2016/10/11/net-framework-monthly-rollups-explained/) are NOT included in the Windows 10 LCU. They are separate packages with different behaviors depending on the version of .NET Framework being updated, and on which OS. As of October 2018, .NET Framework updates for Windows 10 will be separate and have their own cumulative update model. -- For Windows 10, available update types vary by publishing channel: - - For customers using Windows Server Update Services (WSUS) and for the Update Catalog, several different updates types for Windows 10 are rolled together for the core OS in a single LCU package, with exception of Servicing Stack Updates. - - Servicing Stack Updates (SSU) are available for download from the Update Catalog and can be imported through WSUS. Servicing Stack Updates (SSU) will be synced automatically (See this example for Windows 10, version 1709). Learn more about [Servicing Stack Updates](https://docs.microsoft.com/windows/deployment/update/servicing-stack-updates). - - For customers connecting to Windows Update, the new cloud update architecture uses a database of updates which break out all the different update types, including Servicing Stack Updates (SSU) and Dynamic Updates (DU). The update scanning in the Windows 10 servicing stack on the client automatically takes only the updates that are needed by the device to be completely up to date. -- Windows 7 and other legacy operating systems have cumulative updates that operate differently than in Windows 10 (see next section). - -## Windows 7 and legacy OS versions -While Windows 10 updates could have been controlled as cumulative from "Day 1," the legacy OS ecosystem for both client and server was highly fragmented. Recognizing the challenges of update quality in a fragmented environment, we moved Windows 7 to a cumulative update model in October 2016. - -Customers saw the LCU model used for Windows 10 as having packages that were too large and represented too much of a change for legacy operating systems, so a different model was implemented. Windows instead offered one cumulative package (Monthly Rollup) and one individual package (Security Only) for all legacy operating systems. - -The Monthly Rollup includes new non-security (if appropriate), security updates, Internet Explorer (IE) updates, and all updates from the previous month similar to the Windows 10 model. The Security-only package includes only new security updates for the month. This means that any security updates from any previous month are not included in current month’s Security-Only Package. If a Security-Only update is missed, it is missed. Those updates will not appear in a future Security-Only update. Additionally, a cumulative package is offered for IE, which can be tested and installed separately, reducing the total update package size. The IE cumulative update includes both security and non-security fixes following the same model as Windows 10. - -![Legacy OS security-only update model](images/security-only-update.png) -*Figure 2.0 - Legacy OS security-only update model* - -Moving to the cumulative model for legacy OS versions continues to improve predictability of update quality. The Windows legacy environments which have fully updated machines with Monthly Rollups are running the same baseline against which all legacy OS version updates are tested. These include all of the updates (security and non-security) prior to and after October 2016. Many customer environments do not have all updates prior to this change installed, which leaves some continued fragmentation in the ecosystem. Further, customers who are installing Security-Only Updates and potentially doing so inconsistently are also more fragmented than Microsoft’s test environments for legacy OS version. This remaining fragmentation results in issues like those seen when the September 2016 Servicing Stack Update (SSU) was needed for smooth installation of the August 2018 security update. These environments did not have the SSU applied previously. - -### Points to consider -- Windows 7 and Windows 8 legacy operating system updates [moved from individual to cumulative in October 2016](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/More-on-Windows-7-and-Windows-8-1-servicing-changes/ba-p/166783). Devices with updates missing prior to that point are still missing those updates, as they were not included in the subsequent cumulative packages. -- "Hotfixes" are no longer published for legacy OS versions. All updates are rolled into the appropriate package depending on their classification as either non-security, security, or Internet Explorer updates. (Note: any private fix is offered for customer validation only. Once validated they are then rolled into a Monthly Rollup or IE cumulative update, as appropriate.) -- Both Monthly Rollups and Security-only updates released on Update Tuesday for legacy OS versions are identified as "security required" updates, because both have the full set of security updates in them. The Monthly Rollup may have additional non-security updates that are not included in the Security Only update. The "security" classification requires the device be rebooted so the update can be fully installed. -- Given the differences between the cumulative Monthly Rollups and the single-month Security-only update packages, switching between these update types is not advised. Differences in the baselines of these packages may result in installation errors and conflicts. Choosing one and staying on that update type with high consistency – Monthly Rollup or Security-only – is recommended. -- With all Legacy OS versions now in the Extended Support stage of their 10-year lifecycle, they typically receive only security updates for both Monthly Rollup and Security Only updates. Using Express for the Monthly Rollup results in almost the same package size as Security Only, with the added confidence of ensuring all relevant updates are installed. -- In [February 2017](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Simplified-servicing-for-Windows-7-and-Windows-8-1-the-latest/ba-p/166798), Windows pulled IE updates out of the legacy OS versions Security-only updates, while leaving them in the Monthly Rollup updates. This was done specifically to reduce package size based on customer feedback. -- The IE cumulative update includes both security and non-security updates and is also needed for to help secure the entire environment. This update can be installed separately or as part of the Monthly Rollup. -- [Updates for .NET Framework](https://blogs.msdn.microsoft.com/dotnet/2016/10/11/net-framework-monthly-rollups-explained/) are NOT included in legacy Monthly Rollup or Security Only packages. They are separate packages with different behaviors depending on the version of the .NET Framework, and which legacy OS, being updated. -- For [Windows Server 2008 SP2](https://cloudblogs.microsoft.com/windowsserver/2018/06/12/windows-server-2008-sp2-servicing-changes/), cumulative updates began in October 2018, and follow the same model as Windows 7. Updates for IE9 are included in those packages, as the last supported version of Internet Explorer for that Legacy OS version. - -## Public preview releases -Lastly, the cumulative update model directly impacts the public Preview releases offered in the 3rd and/or 4th weeks of the month. Update Tuesday, also referred to as the "B" week release occurs on the second Tuesday of the month. It is always a required security update across all operating systems. In addition to this monthly release, Windows also releases non-security update "previews" targeting the 3rd (C) and the 4th (D) weeks of the month. These preview releases include that month’s B-release plus a set of non-security updates for testing and validation as a cumulative package. We recommend IT Administrators uses the C/D previews to test the update in their environments. Any issues identified with the updates in the C/D releases are identified and then fixed or removed, prior to being rolled up in to the next month’s B release package together with new security updates. Security-only Packages are not part of the C/D preview program. - -### Examples -Windows 10 version 1709: -- (9B) September 11, 2018 Update Tuesday / B release - includes security, non-security and IE update. This update is categorized as "Required, Security" it requires a system reboot. -- (9C) September 26, 2018 Preview C release - includes everything from 9B PLUS some non-security updates for testing/validation. This update is qualified as not required, non-security. No system reboot is required. -- (10B) October 9, 2018 Update Tuesday / B release includes all fixes included in 9B, all fixes in 9C and introduces new security fixes and IE updates. This update is qualified as "Required, Security" and requires a system reboot. -All of these updates are cumulative and build on each other for Windows 10. This is in contrast to legacy OS versions, where the 9C release becomes part of the "Monthly Rollup," but not the "Security Only" update. In other words, a Window 7 SP1 9C update is part of the cumulative "Monthly Rollup" but not included in the "Security Only" update because the fixes are qualified as "non-security". This is an important variation to note on the two models. - -![Preview releases in the Windows 10 LCU model](images/servicing-previews.png) -*Figure 3.0 - Preview releases within the Windows 10 LCU model* - -## Previews vs. on-demand releases -In 2018, we experienced incidents which required urgent remediation that didn’t map to the monthly update release cadence. These incidents were situations that required an immediate fix to an Update Tuesday release. While Windows engineering worked aggressively to respond within a week of the B-release, these "on-demand" releases created confusion with the C Preview releases. - -As a general policy, if a Security-Only package has a regression, which is defined as an unintentional error in the code of an update, then the fix for that regression will be added to the next month’s Security-Only Update. The fix for that regression may also be offered as part an On-Demand release and will be rolled into the next Monthly Update. (Note: Exceptions do exist to this policy, based on timing.) - -### Point to consider -- When Windows identifies an issue with a Update Tuesday release, engineering teams work to remediate or fix the issue as quickly as possible. The outcome is often a new update which may be released at any time, including during the 3rd or 4th week of the month. Such updates are independent of the regularly scheduled "C" and "D" update previews. These updates are created on-demand to remediate a customer impacting issue. In most cases they are qualified as a "non-security" update, and do not require a system reboot. -- Rarely do incidents with Update Tuesday releases impact more than .1% of the total population. With the new Windows Update (WU) architecture, updates can be targeted to affected devices. This targeting is not available through the Update Catalog or WSUS channels, however. -- On-demand releases address a specific issue with an Update Tuesday release and are often qualified as "non-security" for one of two reasons. First, the fix may not be an additional security fix, but a non-security change to the update. Second, the "non-security" designation allows individuals or companies to choose when and how to reboot the devices, rather than forcing a system reboot on all Windows devices receiving the update globally. This trade-off is rarely a difficult choice as it has the potential to impact customer experience across client and server, across consumer and commercial customers for more than one billion devices. -- Because the cumulative model is used across Window 10 and legacy Windows OS versions, despite variations between these OS versions, an out of band release will include all of the changes from the Update Tuesday release plus the fix that addresses the issue. And since Windows no longer releases hotfixes, everything is cumulative in some way. - -In closing, I hope this overview of the update model across current and legacy Windows OS versions highlights the benefits of the Windows 10 cumulative update model to help defragment the Windows ecosystem environments, simplify servicing and help make systems more secure. - -## Resources -- [Simplifying updates for Windows 7 and 8.1](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Simplifying-updates-for-Windows-7-and-8-1/ba-p/166530) -- [Further simplifying servicing models for Windows 7 and Windows 8.1](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Further-simplifying-servicing-models-for-Windows-7-and-Windows-8/ba-p/166772) -- [More on Windows 7 and Windows 8.1 servicing changes](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/More-on-Windows-7-and-Windows-8-1-servicing-changes/ba-p/166783) -- [.NET Framework Monthly Rollups Explained](https://blogs.msdn.microsoft.com/dotnet/2016/10/11/net-framework-monthly-rollups-explained/) -- [Simplified servicing for Windows 7 and Windows 8.1: the latest improvements](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Simplified-servicing-for-Windows-7-and-Windows-8-1-the-latest/ba-p/166798) -- [Windows Server 2008 SP2 servicing changes](https://cloudblogs.microsoft.com/windowsserver/2018/06/12/windows-server-2008-sp2-servicing-changes/) -- [Windows 10 update servicing cadence](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-update-servicing-cadence/ba-p/222376) -- [Windows 7 servicing stack updates: managing change and appreciating cumulative updates](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-7-servicing-stack-updates-managing-change-and/ba-p/260434) +--- +title: Servicing differences between Windows 10 and older operating systems +ms.reviewer: +manager: laurawi +description: Learn the differences between servicing Windows 10 and servicing older operating systems. +keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.audience: itpro +author: greg-lindsay +ms.topic: article +ms.collection: M365-modern-desktop +--- +# Understanding the differences between servicing Windows 10-era and legacy Windows operating systems + +> Applies to: Windows 10 +> +> **February 15, 2019: This document has been corrected and edited to reflect that security-only updates for legacy OS versions are not cumulative. They were previously identified as cumulative similar to monthly rollups, which is inaccurate.** + +Today, many enterprise customers have a mix of modern and legacy client and server operating systems. Managing the servicing and updating differences between those legacy operating systems and Windows 10 versions adds a level of complexity that is not well understood. This can be confusing. With the end of support for legacy [Windows 7 SP1](https://support.microsoft.com/help/4057281/windows-7-support-will-end-on-january-14-2020) and Windows Server 2008 R2 variants on January 14, 2020, System Administrators have a critical need to understand how best to leverage a modern workplace to support system updates. + +The following provides an initial overview of how updating client and server differs between the Windows 10-era Operating Systems (such as, Windows 10 version 1709, Windows Server 2016) and legacy operating systems (such as Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2). + +> [!NOTE] +> A note on naming convention in this article: For brevity, "Windows 10" refers to all operating systems across client, server and IoT released since July 2015, while "legacy" refers to all operating systems prior to that period for client and server, including Windows 7, Window 8.1, Windows Server 2008 R2, Windows Server 2012 R2, etc. + +## Infinite fragmentation +Prior to Windows 10, all updates to operating system (OS) components were published individually. On "Update Tuesday," customers would pick and choose individual updates they wanted to apply. Most chose to update security fixes, while far fewer selected non-security fixes, updated drivers, or installed .NET Framework updates. + +As a result, each environment within the global Windows ecosystem that had only a subset of security and non-security fixes installed had a different set of binaries and behaviors than those that consistently installed every available update as tested by Microsoft. + +This resulted in a fragmented ecosystem that created diverse challenges in predictively testing interoperability, resulting in high update failure rates - which were subsequently mitigated by customers removing individual updates that were causing issues. Each customer that selectively removed individual updates amplified this fragmentation by creating more diverse environment permutations across the ecosystem. As an IT Administrator once quipped, "If you’ve seen one Windows 7 PC, you have seen one Windows 7 PC," suggesting no consistency or predictability across more than 250M commercial devices at the time. + +## Windows 10 – Next generation +Windows 10 provided an opportunity to end the era of infinite fragmentation. With Windows 10 and the Windows as a service model, updates came rolled together in the "latest cumulative update" (LCU) packages for both client and server. Every new update published includes all changes from previous updates, as well as new fixes. Since Windows client and server share the same code base, these LCUs allow the same update to be installed on the same client and server OS family, further reducing fragmentation. + +This helps simplify servicing. Devices with the original Release to Market (RTM) version of a feature release installed could get up to date by installing the most recent LCU. + +Windows publishes the new LCU packages for each Windows 10 version (1607, 1709, etc.) on the second Tuesday of each month. This package is classified as a required security update and contains contents from the previous LCU as well as new security, non-security and Internet Explorer 11 (IE11) fixes. The security classification, by definition, requires a reboot of the device to complete installation of the update. + + +![High level cumulative update model](images/servicing-cadence.png) +*Figure 1.0 - High level cumulative update model* + +Another benefit of the LCU model is fewer steps. Devices that have the original Release to Market (RTM) version of a release can install the most recent LCU to get up to date in one step, rather than having to install multiple updates with reboots after each. + +This cumulative update model for Windows 10 has helped provide the Windows ecosystem with consistent update experiences that can be predicted by baseline testing before release. Even with highly complex updates with hundreds of fixes, the number of incidents with monthly security updates for Windows 10 have fallen month over month since the initial release of Windows 10. + +### Points to consider + +- Windows 10 does not have the concept of a Security-Only or Monthly Rollup for updates. All updates are an LCU package, which includes the last release plus anything new. +- Windows 10 no longer has the concept of a "hotfix" since all individual updates must be rolled into the cumulative packages. (Note: Any private fix is offered for customer validation only, and then rolled into an LCU.) +- [Updates for the .NET Framework](https://blogs.msdn.microsoft.com/dotnet/2016/10/11/net-framework-monthly-rollups-explained/) are NOT included in the Windows 10 LCU. They are separate packages with different behaviors depending on the version of .NET Framework being updated, and on which OS. As of October 2018, .NET Framework updates for Windows 10 will be separate and have their own cumulative update model. +- For Windows 10, available update types vary by publishing channel: + - For customers using Windows Server Update Services (WSUS) and for the Update Catalog, several different updates types for Windows 10 are rolled together for the core OS in a single LCU package, with exception of Servicing Stack Updates. + - Servicing Stack Updates (SSU) are available for download from the Update Catalog and can be imported through WSUS. Servicing Stack Updates (SSU) will be synced automatically (See this example for Windows 10, version 1709). Learn more about [Servicing Stack Updates](https://docs.microsoft.com/windows/deployment/update/servicing-stack-updates). + - For customers connecting to Windows Update, the new cloud update architecture uses a database of updates which break out all the different update types, including Servicing Stack Updates (SSU) and Dynamic Updates (DU). The update scanning in the Windows 10 servicing stack on the client automatically takes only the updates that are needed by the device to be completely up to date. +- Windows 7 and other legacy operating systems have cumulative updates that operate differently than in Windows 10 (see next section). + +## Windows 7 and legacy OS versions +While Windows 10 updates could have been controlled as cumulative from "Day 1," the legacy OS ecosystem for both client and server was highly fragmented. Recognizing the challenges of update quality in a fragmented environment, we moved Windows 7 to a cumulative update model in October 2016. + +Customers saw the LCU model used for Windows 10 as having packages that were too large and represented too much of a change for legacy operating systems, so a different model was implemented. Windows instead offered one cumulative package (Monthly Rollup) and one individual package (Security Only) for all legacy operating systems. + +The Monthly Rollup includes new non-security (if appropriate), security updates, Internet Explorer (IE) updates, and all updates from the previous month similar to the Windows 10 model. The Security-only package includes only new security updates for the month. This means that any security updates from any previous month are not included in current month’s Security-Only Package. If a Security-Only update is missed, it is missed. Those updates will not appear in a future Security-Only update. Additionally, a cumulative package is offered for IE, which can be tested and installed separately, reducing the total update package size. The IE cumulative update includes both security and non-security fixes following the same model as Windows 10. + +![Legacy OS security-only update model](images/security-only-update.png) +*Figure 2.0 - Legacy OS security-only update model* + +Moving to the cumulative model for legacy OS versions continues to improve predictability of update quality. The Windows legacy environments which have fully updated machines with Monthly Rollups are running the same baseline against which all legacy OS version updates are tested. These include all of the updates (security and non-security) prior to and after October 2016. Many customer environments do not have all updates prior to this change installed, which leaves some continued fragmentation in the ecosystem. Further, customers who are installing Security-Only Updates and potentially doing so inconsistently are also more fragmented than Microsoft’s test environments for legacy OS version. This remaining fragmentation results in issues like those seen when the September 2016 Servicing Stack Update (SSU) was needed for smooth installation of the August 2018 security update. These environments did not have the SSU applied previously. + +### Points to consider +- Windows 7 and Windows 8 legacy operating system updates [moved from individual to cumulative in October 2016](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/More-on-Windows-7-and-Windows-8-1-servicing-changes/ba-p/166783). Devices with updates missing prior to that point are still missing those updates, as they were not included in the subsequent cumulative packages. +- "Hotfixes" are no longer published for legacy OS versions. All updates are rolled into the appropriate package depending on their classification as either non-security, security, or Internet Explorer updates. (Note: any private fix is offered for customer validation only. Once validated they are then rolled into a Monthly Rollup or IE cumulative update, as appropriate.) +- Both Monthly Rollups and Security-only updates released on Update Tuesday for legacy OS versions are identified as "security required" updates, because both have the full set of security updates in them. The Monthly Rollup may have additional non-security updates that are not included in the Security Only update. The "security" classification requires the device be rebooted so the update can be fully installed. +- Given the differences between the cumulative Monthly Rollups and the single-month Security-only update packages, switching between these update types is not advised. Differences in the baselines of these packages may result in installation errors and conflicts. Choosing one and staying on that update type with high consistency – Monthly Rollup or Security-only – is recommended. +- With all Legacy OS versions now in the Extended Support stage of their 10-year lifecycle, they typically receive only security updates for both Monthly Rollup and Security Only updates. Using Express for the Monthly Rollup results in almost the same package size as Security Only, with the added confidence of ensuring all relevant updates are installed. +- In [February 2017](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Simplified-servicing-for-Windows-7-and-Windows-8-1-the-latest/ba-p/166798), Windows pulled IE updates out of the legacy OS versions Security-only updates, while leaving them in the Monthly Rollup updates. This was done specifically to reduce package size based on customer feedback. +- The IE cumulative update includes both security and non-security updates and is also needed for to help secure the entire environment. This update can be installed separately or as part of the Monthly Rollup. +- [Updates for .NET Framework](https://blogs.msdn.microsoft.com/dotnet/2016/10/11/net-framework-monthly-rollups-explained/) are NOT included in legacy Monthly Rollup or Security Only packages. They are separate packages with different behaviors depending on the version of the .NET Framework, and which legacy OS, being updated. +- For [Windows Server 2008 SP2](https://cloudblogs.microsoft.com/windowsserver/2018/06/12/windows-server-2008-sp2-servicing-changes/), cumulative updates began in October 2018, and follow the same model as Windows 7. Updates for IE9 are included in those packages, as the last supported version of Internet Explorer for that Legacy OS version. + +## Public preview releases +Lastly, the cumulative update model directly impacts the public Preview releases offered in the 3rd and/or 4th weeks of the month. Update Tuesday, also referred to as the "B" week release occurs on the second Tuesday of the month. It is always a required security update across all operating systems. In addition to this monthly release, Windows also releases non-security update "previews" targeting the 3rd (C) and the 4th (D) weeks of the month. These preview releases include that month’s B-release plus a set of non-security updates for testing and validation as a cumulative package. We recommend IT Administrators uses the C/D previews to test the update in their environments. Any issues identified with the updates in the C/D releases are identified and then fixed or removed, prior to being rolled up in to the next month’s B release package together with new security updates. Security-only Packages are not part of the C/D preview program. + +> [!NOTE] +> Only preview updates for the most recent release of Windows 10 are published to Windows Server Update Services (WSUS). For customers using the WSUS channel, and products such as System Center Configuration Manager that rely on it, will not see preview updates for older versions of Windows 10. + +> [!NOTE] +> Preview updates for Windows 10 are not named differently than their LCU counterparts and do not contain the word 'Preview'. They can be identified by their release date (C or D week) and their classification as non-security updates. + +### Examples +Windows 10 version 1709: +- (9B) September 11, 2018 Update Tuesday / B release - includes security, non-security and IE update. This update is categorized as "Required, Security" it requires a system reboot. +- (9C) September 26, 2018 Preview C release - includes everything from 9B PLUS some non-security updates for testing/validation. This update is qualified as not required, non-security. No system reboot is required. +- (10B) October 9, 2018 Update Tuesday / B release includes all fixes included in 9B, all fixes in 9C and introduces new security fixes and IE updates. This update is qualified as "Required, Security" and requires a system reboot. +All of these updates are cumulative and build on each other for Windows 10. This is in contrast to legacy OS versions, where the 9C release becomes part of the "Monthly Rollup," but not the "Security Only" update. In other words, a Window 7 SP1 9C update is part of the cumulative "Monthly Rollup" but not included in the "Security Only" update because the fixes are qualified as "non-security". This is an important variation to note on the two models. + +![Preview releases in the Windows 10 LCU model](images/servicing-previews.png) +*Figure 3.0 - Preview releases within the Windows 10 LCU model* + +## Previews vs. on-demand releases +In 2018, we experienced incidents which required urgent remediation that didn’t map to the monthly update release cadence. These incidents were situations that required an immediate fix to an Update Tuesday release. While Windows engineering worked aggressively to respond within a week of the B-release, these "on-demand" releases created confusion with the C Preview releases. + +As a general policy, if a Security-Only package has a regression, which is defined as an unintentional error in the code of an update, then the fix for that regression will be added to the next month’s Security-Only Update. The fix for that regression may also be offered as part an On-Demand release and will be rolled into the next Monthly Update. (Note: Exceptions do exist to this policy, based on timing.) + +### Point to consider +- When Windows identifies an issue with a Update Tuesday release, engineering teams work to remediate or fix the issue as quickly as possible. The outcome is often a new update which may be released at any time, including during the 3rd or 4th week of the month. Such updates are independent of the regularly scheduled "C" and "D" update previews. These updates are created on-demand to remediate a customer impacting issue. In most cases they are qualified as a "non-security" update, and do not require a system reboot. +- Rarely do incidents with Update Tuesday releases impact more than .1% of the total population. With the new Windows Update (WU) architecture, updates can be targeted to affected devices. This targeting is not available through the Update Catalog or WSUS channels, however. +- On-demand releases address a specific issue with an Update Tuesday release and are often qualified as "non-security" for one of two reasons. First, the fix may not be an additional security fix, but a non-security change to the update. Second, the "non-security" designation allows individuals or companies to choose when and how to reboot the devices, rather than forcing a system reboot on all Windows devices receiving the update globally. This trade-off is rarely a difficult choice as it has the potential to impact customer experience across client and server, across consumer and commercial customers for more than one billion devices. +- Because the cumulative model is used across Window 10 and legacy Windows OS versions, despite variations between these OS versions, an out of band release will include all of the changes from the Update Tuesday release plus the fix that addresses the issue. And since Windows no longer releases hotfixes, everything is cumulative in some way. + +In closing, I hope this overview of the update model across current and legacy Windows OS versions highlights the benefits of the Windows 10 cumulative update model to help defragment the Windows ecosystem environments, simplify servicing and help make systems more secure. + +## Resources +- [Simplifying updates for Windows 7 and 8.1](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Simplifying-updates-for-Windows-7-and-8-1/ba-p/166530) +- [Further simplifying servicing models for Windows 7 and Windows 8.1](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Further-simplifying-servicing-models-for-Windows-7-and-Windows-8/ba-p/166772) +- [More on Windows 7 and Windows 8.1 servicing changes](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/More-on-Windows-7-and-Windows-8-1-servicing-changes/ba-p/166783) +- [.NET Framework Monthly Rollups Explained](https://blogs.msdn.microsoft.com/dotnet/2016/10/11/net-framework-monthly-rollups-explained/) +- [Simplified servicing for Windows 7 and Windows 8.1: the latest improvements](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Simplified-servicing-for-Windows-7-and-Windows-8-1-the-latest/ba-p/166798) +- [Windows Server 2008 SP2 servicing changes](https://cloudblogs.microsoft.com/windowsserver/2018/06/12/windows-server-2008-sp2-servicing-changes/) +- [Windows 10 update servicing cadence](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-update-servicing-cadence/ba-p/222376) +- [Windows 7 servicing stack updates: managing change and appreciating cumulative updates](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-7-servicing-stack-updates-managing-change-and/ba-p/260434) diff --git a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md index 2162d1aafa..32e06ed8f5 100644 --- a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md +++ b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md @@ -1,74 +1,73 @@ ---- -title: Prepare servicing strategy for Windows 10 updates (Windows 10) -description: A strong Windows 10 deployment strategy begins with establishing a simple, repeatable process for testing and deploying each feature update. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 11/02/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Prepare servicing strategy for Windows 10 updates - - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - -In the past, traditional Windows deployments tended to be large, lengthy, and expensive. Windows 10 offers a new approach to deploying both quality and feature updates, making the process much simpler and therefore the planning much more straightforward. With Windows as a service, the methodology around updating Windows has completely changed, moving away from major upgrades every few years to iterative updates twice per year. Each iteration contains a smaller subset of changes so that they won’t seem like substantial differences, like they do today. This image illustrates the level of effort needed for traditional Windows deployments versus servicing Windows 10 and how it is now spread evenly over time versus spiking every few years. - - -![Compare traditional servicing to Windows 10](images/waas-strategy-fig1a.png) - -Windows 10 spreads the traditional deployment effort of a Windows upgrade, which typically occurred every few years, over smaller, continuous updates. With this change, you must approach the ongoing deployment and servicing of Windows differently. A strong Windows 10 deployment strategy begins with establishing a simple, repeatable process for testing and deploying each feature update. Here’s an example of what this process might look like: - -- **Configure test devices.** Configure test devices in the Windows Insider Program so that Insiders can test feature updates before they’re available to the Semi-Annual Channel. Typically, this would be a small number of test devices that IT staff members use to evaluate pre-releas builds of Windows. Microsoft provides current development builds to Windows Insider members approximately every week so that interested users can see the functionality Microsoft is adding. See the section Windows Insider for details on how to enroll in the Windows Insider Program on a Windows 10 device. -- **Identify excluded devices.** For some organizations, special-purpose devices such as those used to control factory or medical equipment or run ATMs require a stricter, less frequent feature update cycle than the Semi-annual Channel can offer. For those machines, you must install Windows 10 Enterprise LTSB to avoid feature updates for up to 10 years. Identify these devices, and separate them from the phased deployment and servicing cycles to help remove confusion for your administrators and ensure that devices are handled correctly. -- **Recruit volunteers.** The purpose of testing a deployment is to receive feedback. One effective way to recruit pilot users is to request volunteers. When doing so, clearly state that you’re looking for feedback rather than people to just “try it out” and that there could be occasional issues involved with accepting feature updates right away. With Windows as a service, the expectation is that there should be few issues, but if an issue does arise, you want testers to let you know as soon as possible. When considering whom to recruit for pilot groups, be sure to include members who provide the broadest set of applications and devices to validate the largest number of apps and devices possible. -- **Update Group Policy.** Each feature update includes new group policies to manage new features. If you use Group Policy to manage devices, the Group Policy Admin for the Active Directory domain will need to download a .admx package and copy it to their [Central Store](https://support.microsoft.com/help/929841/how-to-create-the-central-store-for-group-policy-administrative-templa) (or to the [PolicyDefinitions](https://msdn.microsoft.com/library/bb530196.aspx) directory in the SYSVOL of a domain controller if not using a Central Store). Always manage new group polices from the version of Windows 10 they shipped with by using the Remote Server Administration Tools. The ADMX download package is created at the end of each development cycle and then posted for download. To find the ADMX download package for a given Windows build, search for “ADMX download for Windows build xxxx”. For details about Group Policy management, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) -- **Choose a servicing tool.** Decide which product you’ll use to manage the Windows updates in your environment. If you’re currently using Windows Server Update Services (WSUS) or System Center Configuration Manager to manage your Windows updates, you can continue using those products to manage Windows 10 updates. Alternatively, you can use Windows Update for Business. In addition to which product you’ll use, consider how you’ll deliver the updates. With Windows 10, multiple peer-to-peer options are available to make update distribution faster. For a comparison of tools, see [Servicing tools](waas-overview.md#servicing-tools). -- **Prioritize applications.** First, create an application portfolio. This list should include everything installed in your organization and any webpages your organization hosts. Next, prioritize this list to identify those that are the most business critical. Because the expectation is that application compatibility with Windows 10 will be high, only the most business critical applications should be tested before the pilot phase; everything else can be tested afterwards. For more information about identifying compatibility issues withe applications, see [Manage Windows upgrades with Upgrade Analytics](../upgrade/manage-windows-upgrades-with-upgrade-readiness.md). - ->[!NOTE] ->This strategy is applicable to approaching an environment in which Windows 10 already exists. For information about how to deploy or upgrade to Windows 10 where another version of Windows exists, see [Plan for Windows 10 deployment](../planning/index.md). -> ->>Windows 10 Enterprise LTSB is a separate Long Term Servicing Channel version. - -Each time Microsoft releases a Windows 10 feature update, the IT department should use the following high-level process to help ensure that the broad deployment is successful: - -1. **Validate compatibility of business critical apps.** Test your most important business-critical applications for compatibility with the new Windows 10 feature update running on your Windows Insider machines identified in the earlier “Configure test machines” step of the Predeployment strategy section. The list of applications involved in this validation process should be small because most applications can be tested during the pilot phase. For more information about device and application compatibility in Windows 10, see the section Compatibility. -2. **Target and react to feedback.** With Windows 10, Microsoft expects application and device compatibility to be high, but it’s still important to have targeted groups within both the IT department and business units to verify application compatibility for the remaining applications in your application portfolio. Because only the most business-critical applications are tested beforehand, this will represent the majority of application compatibility testing in your environment. This should not necessarily be a formal process but rather user validation through the use of a particular application. So, the next step is to deploy the feature update to early-adopting IT users and your targeted groups running in the Semi-annual channel that you identified in the “Recruit volunteers” step of the Predeployment strategy section. Be sure to communicate clearly that you’re looking for feedback as soon as possible, and state exactly how users can submit feedback to you. Should an issue arise, have a remediation plan in place to address it. -3. **Deploy broadly.** Finally, focus on the large-scale deployment using deployment rings, like the ones discussed in Table 1. Build deployment rings that target groups of computers in your selected update-management product. To reduce risk as much as possible, construct your deployment rings in a way that splits individual departments into multiple rings. This way, if you were to encounter an issue, you don’t prevent any critical business from continuing. By using this method, each deployment ring reduces risk as more and more people have been updated in any particular department. - - -## Steps to manage updates for Windows 10 - -| | | -| --- | --- | -| ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | -| ![done](images/checklistdone.png) | Prepare servicing strategy for Windows 10 updates (this topic) | -| ![to do](images/checklistbox.gif) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                        or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | - - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) -- [Manage device restarts after updates](waas-restart.md) +--- +title: Prepare servicing strategy for Windows 10 updates (Windows 10) +description: A strong Windows 10 deployment strategy begins with establishing a simple, repeatable process for testing and deploying each feature update. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Prepare servicing strategy for Windows 10 updates + + +**Applies to** + +- Windows 10 + + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +In the past, traditional Windows deployments tended to be large, lengthy, and expensive. Windows 10 offers a new approach to deploying both quality and feature updates, making the process much simpler and therefore the planning much more straightforward. With Windows as a service, the methodology around updating Windows has completely changed, moving away from major upgrades every few years to iterative updates twice per year. Each iteration contains a smaller subset of changes so that they won’t seem like substantial differences, like they do today. This image illustrates the level of effort needed for traditional Windows deployments versus servicing Windows 10 and how it is now spread evenly over time versus spiking every few years. + + +![Compare traditional servicing to Windows 10](images/waas-strategy-fig1a.png) + +Windows 10 spreads the traditional deployment effort of a Windows upgrade, which typically occurred every few years, over smaller, continuous updates. With this change, you must approach the ongoing deployment and servicing of Windows differently. A strong Windows 10 deployment strategy begins with establishing a simple, repeatable process for testing and deploying each feature update. Here’s an example of what this process might look like: + +- **Configure test devices.** Configure test devices in the Windows Insider Program so that Insiders can test feature updates before they’re available to the Semi-Annual Channel. Typically, this would be a small number of test devices that IT staff members use to evaluate pre-releas builds of Windows. Microsoft provides current development builds to Windows Insider members approximately every week so that interested users can see the functionality Microsoft is adding. See the section Windows Insider for details on how to enroll in the Windows Insider Program on a Windows 10 device. +- **Identify excluded devices.** For some organizations, special-purpose devices such as those used to control factory or medical equipment or run ATMs require a stricter, less frequent feature update cycle than the Semi-annual Channel can offer. For those machines, you must install Windows 10 Enterprise LTSB to avoid feature updates for up to 10 years. Identify these devices, and separate them from the phased deployment and servicing cycles to help remove confusion for your administrators and ensure that devices are handled correctly. +- **Recruit volunteers.** The purpose of testing a deployment is to receive feedback. One effective way to recruit pilot users is to request volunteers. When doing so, clearly state that you’re looking for feedback rather than people to just “try it out” and that there could be occasional issues involved with accepting feature updates right away. With Windows as a service, the expectation is that there should be few issues, but if an issue does arise, you want testers to let you know as soon as possible. When considering whom to recruit for pilot groups, be sure to include members who provide the broadest set of applications and devices to validate the largest number of apps and devices possible. +- **Update Group Policy.** Each feature update includes new group policies to manage new features. If you use Group Policy to manage devices, the Group Policy Admin for the Active Directory domain will need to download a .admx package and copy it to their [Central Store](https://support.microsoft.com/help/929841/how-to-create-the-central-store-for-group-policy-administrative-templa) (or to the [PolicyDefinitions](https://msdn.microsoft.com/library/bb530196.aspx) directory in the SYSVOL of a domain controller if not using a Central Store). Always manage new group polices from the version of Windows 10 they shipped with by using the Remote Server Administration Tools. The ADMX download package is created at the end of each development cycle and then posted for download. To find the ADMX download package for a given Windows build, search for “ADMX download for Windows build xxxx”. For details about Group Policy management, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) +- **Choose a servicing tool.** Decide which product you’ll use to manage the Windows updates in your environment. If you’re currently using Windows Server Update Services (WSUS) or System Center Configuration Manager to manage your Windows updates, you can continue using those products to manage Windows 10 updates. Alternatively, you can use Windows Update for Business. In addition to which product you’ll use, consider how you’ll deliver the updates. With Windows 10, multiple peer-to-peer options are available to make update distribution faster. For a comparison of tools, see [Servicing tools](waas-overview.md#servicing-tools). +- **Prioritize applications.** First, create an application portfolio. This list should include everything installed in your organization and any webpages your organization hosts. Next, prioritize this list to identify those that are the most business critical. Because the expectation is that application compatibility with Windows 10 will be high, only the most business critical applications should be tested before the pilot phase; everything else can be tested afterwards. For more information about identifying compatibility issues withe applications, see [Manage Windows upgrades with Upgrade Analytics](../upgrade/manage-windows-upgrades-with-upgrade-readiness.md). + +>[!NOTE] +>This strategy is applicable to approaching an environment in which Windows 10 already exists. For information about how to deploy or upgrade to Windows 10 where another version of Windows exists, see [Plan for Windows 10 deployment](../planning/index.md). +> +>>Windows 10 Enterprise LTSB is a separate Long Term Servicing Channel version. + +Each time Microsoft releases a Windows 10 feature update, the IT department should use the following high-level process to help ensure that the broad deployment is successful: + +1. **Validate compatibility of business critical apps.** Test your most important business-critical applications for compatibility with the new Windows 10 feature update running on your Windows Insider machines identified in the earlier “Configure test machines” step of the Predeployment strategy section. The list of applications involved in this validation process should be small because most applications can be tested during the pilot phase. For more information about device and application compatibility in Windows 10, see the section Compatibility. +2. **Target and react to feedback.** With Windows 10, Microsoft expects application and device compatibility to be high, but it’s still important to have targeted groups within both the IT department and business units to verify application compatibility for the remaining applications in your application portfolio. Because only the most business-critical applications are tested beforehand, this will represent the majority of application compatibility testing in your environment. This should not necessarily be a formal process but rather user validation through the use of a particular application. So, the next step is to deploy the feature update to early-adopting IT users and your targeted groups running in the Semi-annual channel that you identified in the “Recruit volunteers” step of the Predeployment strategy section. Be sure to communicate clearly that you’re looking for feedback as soon as possible, and state exactly how users can submit feedback to you. Should an issue arise, have a remediation plan in place to address it. +3. **Deploy broadly.** Finally, focus on the large-scale deployment using deployment rings, like the ones discussed in Table 1. Build deployment rings that target groups of computers in your selected update-management product. To reduce risk as much as possible, construct your deployment rings in a way that splits individual departments into multiple rings. This way, if you were to encounter an issue, you don’t prevent any critical business from continuing. By using this method, each deployment ring reduces risk as more and more people have been updated in any particular department. + + +## Steps to manage updates for Windows 10 + +| | | +| --- | --- | +| ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | +| ![done](images/checklistdone.png) | Prepare servicing strategy for Windows 10 updates (this topic) | +| ![to do](images/checklistbox.gif) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | +| ![to do](images/checklistbox.gif) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | +| ![to do](images/checklistbox.gif) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | +| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                        or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                        or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | + + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index d38b3d01e4..2b84969903 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -1,262 +1,263 @@ ---- -title: Manage additional Windows Update settings (Windows 10) -description: Additional settings to control the behavior of Windows Update (WU) in Windows 10 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 07/27/2017 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Manage additional Windows Update settings - - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - -You can use Group Policy settings or mobile device management (MDM) to configure the behavior of Windows Update (WU) on your Windows 10 devices. You can configure the update detection frequency, select when updates are received, specify the update service location and more. - ->[!IMPORTANT] ->In Windows 10, any Group Policy user configuration settings for Windows Update were deprecated and are no longer supported on this platform. - -## Summary of Windows Update settings - -| Group Policy setting | MDM setting | Supported from version | -| --- | --- | --- | -| [Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location) | [UpdateServiceUrl](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurl) and [UpdateServiceUrlAlternate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurlalternate) | All | -| [Automatic Updates Detection Frequency](#automatic-updates-detection-frequency) | [DetectionFrequency](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-detectionfrequency) | 1703 | -| [Remove access to use all Windows Update features](#remove-access-to-use-all-windows-update-features) | | All | -| [Do not connect to any Windows Update Internet locations](#do-not-connect-to-any-windows-update-internet-locations) | | All | -| [Enable client-side targeting](#enable-client-side-targeting) | | All | -| [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location) | [AllowNonMicrosoftSignedUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | All | -| [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) | [ExcludeWUDriversInQualityUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | 1607 | -| [Configure Automatic Updates](#configure-automatic-updates) | [AllowAutoUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-allowautoupdate) | All | - ->[!IMPORTANT] ->Additional information about settings to manage device restarts and restart notifications for updates is available on **[Manage device restarts after updates](waas-restart.md)**. -> ->Additional settings that configure when Feature and Quality updates are received are detailed on **[Configure Windows Update for Business](waas-configure-wufb.md)**. - -## Scanning for updates - -With Windows 10, admins have a lot of flexibility in configuring how their devices scan and receive updates. - -[Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location) allows admins to point devices to an internal Microsoft update service location, while [Do not connect to any Windows Update Internet locations](#do-not-connect-to-any-windows-update-internet-locations) gives them to option to restrict devices to just that internal update service. [Automatic Updates Detection Frequency](#automatic-updates-detection-frequency) controls how frequently devices scan for updates. - -You can make custom device groups that'll work with your internal Microsoft update service by using [Enable client-side targeting](#enable-client-side-targeting). You can also make sure your devices receive updates that were not signed by Microsoft from your internal Microsoft update service, through [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location). - -Finally, to make sure the updating experience is fully controlled by the admins, you can [Remove access to use all Windows Update features](#remove-access-to-use-all-windows-update-features) for users. - -For additional settings that configure when Feature and Quality updates are received, see [Configure Windows Update for Business](waas-configure-wufb.md). - -### Specify Intranet Microsoft update service location - -Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. -This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. - -To use this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify Intranet Microsoft update service location**. You must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of the intranet update service. - -If the setting is set to **Enabled**, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don’t have to go through a firewall to get updates, and it gives you the opportunity to test updates after deploying them. -If the setting is set to **Disabled** or **Not Configured**, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. - -The alternate download server configures the Windows Update Agent to download files from an alternative download server instead of the intranet update service. -The option to download files with missing Urls allows content to be downloaded from the Alternate Download Server when there are no download Urls for files in the update metadata. This option should only be used when the intranet update service does not provide download Urls in the update metadata for files which are present on the alternate download server. - ->[!NOTE] ->If the "Configure Automatic Updates" policy is disabled, then this policy has no effect. -> ->If the "Alternate Download Server" is not set, it will use the intranet update service by default to download updates. -> ->The option to "Download files with no Url..." is only used if the "Alternate Download Server" is set. - -To configure this policy with MDM, use [UpdateServiceUrl](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurl) and [UpdateServiceUrlAlternate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurlalternate). - -### Automatic Updates detection frequency - -Specifies the hours that Windows will use to determine how long to wait before checking for available updates. The exact wait time is determined by using the hours specified here minus zero to twenty percent of the hours specified. For example, if this policy is used to specify a 20-hour detection frequency, then all clients to which this policy is applied will check for updates anywhere between 16 to 20 hours. - -To set this setting with Group Policy, navigate to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Automatic Updates detection frequency**. - -If the setting is set to **Enabled**, Windows will check for available updates at the specified interval. -If the setting is set to **Disabled** or **Not Configured**, Windows will check for available updates at the default interval of 22 hours. - ->[!NOTE] ->The “Specify intranet Microsoft update service location” setting must be enabled for this policy to have effect. -> ->If the “Configure Automatic Updates” policy is disabled, this policy has no effect. - -To configure this policy with MDM, use [DetectionFrequency](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-detectionfrequency). - -### Remove access to use all Windows Update features - -By enabling the Group Policy setting under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features**, administrators can disable the "Check for updates" option for users. Any background update scans, downloads and installations will continue to work as configured. - -### Do not connect to any Windows Update Internet locations - -Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft Store. - -Use **Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not connect to any Windows Update Internet locations** to enable this policy. When enabled, this policy will disable the functionality described above, and may cause connection to public services such as the Microsoft Store, Windows Update for Business and Delivery Optimization to stop working. - ->[!NOTE] ->This policy applies only when the device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. - -### Enable client-side targeting - -Specifies the target group name or names that should be used to receive updates from an intranet Microsoft update service. This allows admins to configure device groups that will receive different updates from sources like WSUS or SCCM. - -This Group Policy setting can be found under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Enable client-side targeting**. -If the setting is set to **Enabled**, the specified target group information is sent to the intranet Microsoft update service which uses it to determine which updates should be deployed to this computer. -If the setting is set to **Disabled** or **Not Configured**, no target group information will be sent to the intranet Microsoft update service. - -If the intranet Microsoft update service supports multiple target groups, this policy can specify multiple group names separated by semicolons. Otherwise, a single group must be specified. - ->[!NOTE] ->This policy applies only when the intranet Microsoft update service the device is directed to is configured to support client-side targeting. If the “Specify intranet Microsoft update service location” policy is disabled or not configured, this policy has no effect. - -### Allow signed updates from an intranet Microsoft update service location - -This policy setting allows you to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. - -To configure this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows update\Allow signed updates from an intranet Microsoft update service location**. - -If you enable this policy setting, Automatic Updates accepts updates received through an intranet Microsoft update service location, as specified by [Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location), if they are signed by a certificate found in the “Trusted Publishers” certificate store of the local computer. -If you disable or do not configure this policy setting, updates from an intranet Microsoft update service location must be signed by Microsoft. - ->[!NOTE] ->Updates from a service other than an intranet Microsoft update service must always be signed by Microsoft and are not affected by this policy setting. - -To configure this policy with MDM, use [AllowNonMicrosoftSignedUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate). - - -## Installing updates - -To add more flexibility to the update process, settings are available to control update installation. - -[Configure Automatic Updates](#configure-automatic-updates) offers 4 different options for automatic update installation, while [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) makes sure drivers are not installed with the rest of the received updates. - -### Do not include drivers with Windows Updates - -Allows admins to exclude Windows Update (WU) drivers during updates. - -To configure this setting in Group Policy, use **Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not include drivers with Windows Updates**. -Enable this policy to not include drivers with Windows quality updates. -If you disable or do not configure this policy, Windows Update will include updates that have a Driver classification. - -### Configure Automatic Updates - -Enables the IT admin to manage automatic update behavior to scan, download, and install updates. - -#### Configuring Automatic Updates by using Group Policy - -Under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Configure Automatic Updates**, you must select one of the four options: - -**2 - Notify for download and auto install** - When Windows finds updates that apply to this device, users will be notified that updates are ready to be downloaded. After going to **Settings > Update & security > Windows Update**, users can download and install any available updates. - -**3 - Auto download and notify for Install** - Windows finds updates that apply to the device and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to **Settings > Update & security > Windows Update**, users can install them. - -**4 - Auto download and schedule the install** - Specify the schedule using the options in the Group Policy Setting. For more information about this setting, see [Schedule update installation](waas-restart.md#schedule-update-installation). - -**5 - Allow local admin to choose setting** - With this option, local administrators will be allowed to use the settings app to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. - -If this setting is set to *Disabled*, any updates that are available on Windows Update must be downloaded and installed manually. To do this, users must go to **Settings > Update & security > Windows Update**. - -If this setting is set to *Not Configured*, an administrator can still configure Automatic Updates through the settings app, under **Settings > Update & security > Windows Update > Advanced options**. - -#### Configuring Automatic Updates by editing the registry - -> [!NOTE] -> Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require you to reinstall the operating system. Microsoft cannot guarantee that these problems can be resolved. Modify the registry at your own risk. - -In an environment that does not have Active Directory deployed, you can edit registry settings to configure group policies for Automatic Update. - -To do this, follow these steps: - -1. Select **Start**, search for "regedit", and then open Registry Editor. - -2. Open the following registry key: - - ``` - HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU - ``` - -3. Add one of the following registry values to configure Automatic Update. - - * NoAutoUpdate (REG_DWORD): - - * **0**: Automatic Updates is enabled (default). - - * **1**: Automatic Updates is disabled. - - * AUOptions (REG_DWORD): - - * **1**: Keep my computer up to date is disabled in Automatic Updates. - - * **2**: Notify of download and installation. - - * **3**: Automatically download and notify of installation. - - * **4**: Automatically download and scheduled installation. - - * ScheduledInstallDay (REG_DWORD): - - * **0**: Every day. - - * **1** through **7**: The days of the week from Sunday (1) to Saturday (7). - - * ScheduledInstallTime (REG_DWORD): - - **n**, where **n** equals the time of day in a 24-hour format (0-23). - - * UseWUServer (REG_DWORD) - - Set this value to **1** to configure Automatic Updates to use a server that is running Software Update Services instead of Windows Update. - - * RescheduleWaitTime (REG_DWORD) - - **m**, where **m** equals the time period to wait between the time Automatic Updates starts and the time that it begins installations where the scheduled times have passed. The time is set in minutes from 1 to 60, representing 1 minute to 60 minutes) - - > [!NOTE] - > This setting only affects client behavior after the clients have updated to the SUS SP1 client version or later versions. - - * NoAutoRebootWithLoggedOnUsers (REG_DWORD): - - **0** (false) or **1** (true). If set to **1**, Automatic Updates does not automatically restart a computer while users are logged on. - - > [!NOTE] - > This setting affects client behavior after the clients have updated to the SUS SP1 client version or later versions. - -To use Automatic Updates with a server that is running Software Update Services, see the Deploying Microsoft Windows Server Update Services 2.0 guidance. - -When you configure Automatic Updates directly by using the policy registry keys, the policy overrides the preferences that are set by the local administrative user to configure the client. If an administrator removes the registry keys at a later date, the preferences that were set by the local administrative user are used again. - -To determine the WSUS server that the client computers and servers connect to for updates, add the following registry values to the registry: -``` -HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ -``` - -* WUServer (REG_SZ) - - This value sets the WSUS server by HTTP name (for example, http://IntranetSUS). - -* WUStatusServer (REG_SZ) - - This value sets the SUS statistics server by HTTP name (for example, http://IntranetSUS). - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Overview of Windows as a service](waas-overview.md) -- [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Manage device restarts after updates](waas-restart.md) +--- +title: Manage additional Windows Update settings (Windows 10) +description: Additional settings to control the behavior of Windows Update (WU) in Windows 10 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: jaimeo +ms.localizationpriority: medium +ms.audience: itpro +author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Manage additional Windows Update settings + + +**Applies to** + +- Windows 10 + + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +You can use Group Policy settings or mobile device management (MDM) to configure the behavior of Windows Update (WU) on your Windows 10 devices. You can configure the update detection frequency, select when updates are received, specify the update service location and more. + +>[!IMPORTANT] +>In Windows 10, any Group Policy user configuration settings for Windows Update are no longer supported on this platform. + +## Summary of Windows Update settings + +| Group Policy setting | MDM setting | Supported from version | +| --- | --- | --- | +| [Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location) | [UpdateServiceUrl](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurl) and [UpdateServiceUrlAlternate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurlalternate) | All | +| [Automatic Updates Detection Frequency](#automatic-updates-detection-frequency) | [DetectionFrequency](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-detectionfrequency) | 1703 | +| [Remove access to use all Windows Update features](#remove-access-to-use-all-windows-update-features) | | All | +| [Do not connect to any Windows Update Internet locations](#do-not-connect-to-any-windows-update-internet-locations) | | All | +| [Enable client-side targeting](#enable-client-side-targeting) | | All | +| [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location) | [AllowNonMicrosoftSignedUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | All | +| [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) | [ExcludeWUDriversInQualityUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | 1607 | +| [Configure Automatic Updates](#configure-automatic-updates) | [AllowAutoUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-allowautoupdate) | All | + +>[!IMPORTANT] +>Additional information about settings to manage device restarts and restart notifications for updates is available on **[Manage device restarts after updates](waas-restart.md)**. +> +>Additional settings that configure when Feature and Quality updates are received are detailed on **[Configure Windows Update for Business](waas-configure-wufb.md)**. + +## Scanning for updates + +With Windows 10, admins have a lot of flexibility in configuring how their devices scan and receive updates. + +[Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location) allows admins to point devices to an internal Microsoft update service location, while [Do not connect to any Windows Update Internet locations](#do-not-connect-to-any-windows-update-internet-locations) gives them to option to restrict devices to just that internal update service. [Automatic Updates Detection Frequency](#automatic-updates-detection-frequency) controls how frequently devices scan for updates. + +You can make custom device groups that'll work with your internal Microsoft update service by using [Enable client-side targeting](#enable-client-side-targeting). You can also make sure your devices receive updates that were not signed by Microsoft from your internal Microsoft update service, through [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location). + +Finally, to make sure the updating experience is fully controlled by the admins, you can [Remove access to use all Windows Update features](#remove-access-to-use-all-windows-update-features) for users. + +For additional settings that configure when Feature and Quality updates are received, see [Configure Windows Update for Business](waas-configure-wufb.md). + +### Specify Intranet Microsoft update service location + +Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. +This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. + +To use this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify Intranet Microsoft update service location**. You must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of the intranet update service. + +If the setting is set to **Enabled**, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don’t have to go through a firewall to get updates, and it gives you the opportunity to test updates after deploying them. +If the setting is set to **Disabled** or **Not Configured**, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. + +The alternate download server configures the Windows Update Agent to download files from an alternative download server instead of the intranet update service. +The option to download files with missing Urls allows content to be downloaded from the Alternate Download Server when there are no download Urls for files in the update metadata. This option should only be used when the intranet update service does not provide download Urls in the update metadata for files which are present on the alternate download server. + +>[!NOTE] +>If the "Configure Automatic Updates" policy is disabled, then this policy has no effect. +> +>If the "Alternate Download Server" is not set, it will use the intranet update service by default to download updates. +> +>The option to "Download files with no Url..." is only used if the "Alternate Download Server" is set. + +To configure this policy with MDM, use [UpdateServiceUrl](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurl) and [UpdateServiceUrlAlternate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurlalternate). + +### Automatic Updates detection frequency + +Specifies the hours that Windows will use to determine how long to wait before checking for available updates. The exact wait time is determined by using the hours specified here minus zero to twenty percent of the hours specified. For example, if this policy is used to specify a 20-hour detection frequency, then all clients to which this policy is applied will check for updates anywhere between 16 to 20 hours. + +To set this setting with Group Policy, navigate to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Automatic Updates detection frequency**. + +If the setting is set to **Enabled**, Windows will check for available updates at the specified interval. +If the setting is set to **Disabled** or **Not Configured**, Windows will check for available updates at the default interval of 22 hours. + +>[!NOTE] +>The “Specify intranet Microsoft update service location” setting must be enabled for this policy to have effect. +> +>If the “Configure Automatic Updates” policy is disabled, this policy has no effect. + +To configure this policy with MDM, use [DetectionFrequency](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-detectionfrequency). + +### Remove access to use all Windows Update features + +By enabling the Group Policy setting under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Remove access to use all Windows update features**, administrators can disable the "Check for updates" option for users. Any background update scans, downloads and installations will continue to work as configured. + +### Do not connect to any Windows Update Internet locations + +Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft Store. + +Use **Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not connect to any Windows Update Internet locations** to enable this policy. When enabled, this policy will disable the functionality described above, and may cause connection to public services such as the Microsoft Store, Windows Update for Business and Delivery Optimization to stop working. + +>[!NOTE] +>This policy applies only when the device is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. + +### Enable client-side targeting + +Specifies the target group name or names that should be used to receive updates from an intranet Microsoft update service. This allows admins to configure device groups that will receive different updates from sources like WSUS or SCCM. + +This Group Policy setting can be found under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Enable client-side targeting**. +If the setting is set to **Enabled**, the specified target group information is sent to the intranet Microsoft update service which uses it to determine which updates should be deployed to this computer. +If the setting is set to **Disabled** or **Not Configured**, no target group information will be sent to the intranet Microsoft update service. + +If the intranet Microsoft update service supports multiple target groups, this policy can specify multiple group names separated by semicolons. Otherwise, a single group must be specified. + +>[!NOTE] +>This policy applies only when the intranet Microsoft update service the device is directed to is configured to support client-side targeting. If the “Specify intranet Microsoft update service location” policy is disabled or not configured, this policy has no effect. + +### Allow signed updates from an intranet Microsoft update service location + +This policy setting allows you to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. + +To configure this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows update\Allow signed updates from an intranet Microsoft update service location**. + +If you enable this policy setting, Automatic Updates accepts updates received through an intranet Microsoft update service location, as specified by [Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location), if they are signed by a certificate found in the “Trusted Publishers” certificate store of the local computer. +If you disable or do not configure this policy setting, updates from an intranet Microsoft update service location must be signed by Microsoft. + +>[!NOTE] +>Updates from a service other than an intranet Microsoft update service must always be signed by Microsoft and are not affected by this policy setting. + +To configure this policy with MDM, use [AllowNonMicrosoftSignedUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate). + + +## Installing updates + +To add more flexibility to the update process, settings are available to control update installation. + +[Configure Automatic Updates](#configure-automatic-updates) offers 4 different options for automatic update installation, while [Do not include drivers with Windows Updates](#do-not-include-drivers-with-windows-updates) makes sure drivers are not installed with the rest of the received updates. + +### Do not include drivers with Windows Updates + +Allows admins to exclude Windows Update (WU) drivers during updates. + +To configure this setting in Group Policy, use **Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not include drivers with Windows Updates**. +Enable this policy to not include drivers with Windows quality updates. +If you disable or do not configure this policy, Windows Update will include updates that have a Driver classification. + +### Configure Automatic Updates + +Enables the IT admin to manage automatic update behavior to scan, download, and install updates. + +#### Configuring Automatic Updates by using Group Policy + +Under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Configure Automatic Updates**, you must select one of the four options: + +**2 - Notify for download and auto install** - When Windows finds updates that apply to this device, users will be notified that updates are ready to be downloaded. After going to **Settings > Update & security > Windows Update**, users can download and install any available updates. + +**3 - Auto download and notify for Install** - Windows finds updates that apply to the device and downloads them in the background (the user is not notified or interrupted during this process). When the downloads are complete, users will be notified that they are ready to install. After going to **Settings > Update & security > Windows Update**, users can install them. + +**4 - Auto download and schedule the install** - Specify the schedule using the options in the Group Policy Setting. For more information about this setting, see [Schedule update installation](waas-restart.md#schedule-update-installation). + +**5 - Allow local admin to choose setting** - With this option, local administrators will be allowed to use the settings app to select a configuration option of their choice. Local administrators will not be allowed to disable the configuration for Automatic Updates. + +If this setting is set to *Disabled*, any updates that are available on Windows Update must be downloaded and installed manually. To do this, users must go to **Settings > Update & security > Windows Update**. + +If this setting is set to *Not Configured*, an administrator can still configure Automatic Updates through the settings app, under **Settings > Update & security > Windows Update > Advanced options**. + +#### Configuring Automatic Updates by editing the registry + +> [!NOTE] +> Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require you to reinstall the operating system. Microsoft cannot guarantee that these problems can be resolved. Modify the registry at your own risk. + +In an environment that does not have Active Directory deployed, you can edit registry settings to configure group policies for Automatic Update. + +To do this, follow these steps: + +1. Select **Start**, search for "regedit", and then open Registry Editor. + +2. Open the following registry key: + + ``` + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU + ``` + +3. Add one of the following registry values to configure Automatic Update. + + * NoAutoUpdate (REG_DWORD): + + * **0**: Automatic Updates is enabled (default). + + * **1**: Automatic Updates is disabled. + + * AUOptions (REG_DWORD): + + * **1**: Keep my computer up to date is disabled in Automatic Updates. + + * **2**: Notify of download and installation. + + * **3**: Automatically download and notify of installation. + + * **4**: Automatically download and scheduled installation. + + * ScheduledInstallDay (REG_DWORD): + + * **0**: Every day. + + * **1** through **7**: The days of the week from Sunday (1) to Saturday (7). + + * ScheduledInstallTime (REG_DWORD): + + **n**, where **n** equals the time of day in a 24-hour format (0-23). + + * UseWUServer (REG_DWORD) + + Set this value to **1** to configure Automatic Updates to use a server that is running Software Update Services instead of Windows Update. + + * RescheduleWaitTime (REG_DWORD) + + **m**, where **m** equals the time period to wait between the time Automatic Updates starts and the time that it begins installations where the scheduled times have passed. The time is set in minutes from 1 to 60, representing 1 minute to 60 minutes) + + > [!NOTE] + > This setting only affects client behavior after the clients have updated to the SUS SP1 client version or later versions. + + * NoAutoRebootWithLoggedOnUsers (REG_DWORD): + + **0** (false) or **1** (true). If set to **1**, Automatic Updates does not automatically restart a computer while users are logged on. + + > [!NOTE] + > This setting affects client behavior after the clients have updated to the SUS SP1 client version or later versions. + +To use Automatic Updates with a server that is running Software Update Services, see the Deploying Microsoft Windows Server Update Services 2.0 guidance. + +When you configure Automatic Updates directly by using the policy registry keys, the policy overrides the preferences that are set by the local administrative user to configure the client. If an administrator removes the registry keys at a later date, the preferences that were set by the local administrative user are used again. + +To determine the WSUS server that the client computers and servers connect to for updates, add the following registry values to the registry: +``` +HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ +``` + +* WUServer (REG_SZ) + + This value sets the WSUS server by HTTP name (for example, http://IntranetSUS). + +* WUStatusServer (REG_SZ) + + This value sets the SUS statistics server by HTTP name (for example, http://IntranetSUS). + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Overview of Windows as a service](waas-overview.md) +- [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index e8912d59ed..d45100b41b 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -1,149 +1,148 @@ ---- -title: Walkthrough use Group Policy to configure Windows Update for Business - Windows 10 -description: Configure Windows Update for Business settings using Group Policy. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 07/27/2017 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Walkthrough: use Group Policy to configure Windows Update for Business - - -**Applies to** - -- Windows 10 - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - - -## Overview - -You can use Group Policy through the Group Policy Management Console (GPMC) to control how Windows Update for Business works. You should consider and devise a deployment strategy for updates before you make changes to the Windows Update for Business settings. See - -An IT administrator can set policies for Windows Update for Business by using Group Policy, or they can be set locally (per device). All of the relevant policies are under the path **Computer configuration > Administrative Templates > Windows Components > Windows Update**. - -To manage updates with Windows Update for Business as described in this topic, you should prepare with these steps, if you haven't already: - -- Create Active Directory security groups that align with the deployment rings you use to phase deployment of updates. See [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) to learn more about deployment rings in Windows 10. -- Allow access to the Windows Update service. -- Download and install ADMX templates appropriate to your Windows 10 version. For more information, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759) and [Step-By-Step: Managing Windows 10 with Administrative templates](https://blogs.technet.microsoft.com/canitpro/2015/10/20/step-by-step-managing-windows-10-with-administrative-templates/). - - -## Set up Windows Update for Business - -In this example, one security group is used to manage updates. Typically we would recommend having at least three rings (early testers for pre-release builds, broad deployment for releases, critical devices for mature releases) to deploy. See [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) for more information. - -Follow these steps on a device running the Remote Server Administration Tools or on a domain controller: - -### Set up a ring -1. Start Group Policy Management Console (gpmc.msc). -2. Expand **Forest > Domains > *\*. -3. Right-click *\* and select **Create a GPO in this domain and link it here**. -4. In the **New GPO** dialog box, enter *Windows Update for Business - Group 1* as the name of the new Group Policy Object. -5. Right-click the **Windows Update for Business - Group 1" object, and then select **Edit**. -6. In the Group Policy Management Editor, go to **Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update**. You are now ready to start assigning policies to this ring (group) of devices. - - -## Offering - -You can control when updates are applied, for example by deferring when an update is installed on a device or by pausing updates for a certain period of time. - -### Manage which updates are offered - -Windows Update for Business offers you the ability to turn on or off both driver and Microsoft product updates. - -- Drivers (on/off): **Computer configuration > Administrative Templates > Windows Components > Windows Update > Do not include drivers with Windows Updates** -- Microsoft product updates (on/off): **Computer configuration > Administrative Templates > Windows Components > Windows Update > Get updates for other Microsoft Products** - -We recommend that you allow the driver policy to allow drivers to updated on devices (the default), but you can turn this setting off if you prefer to manage drivers manually. We also recommend that you leave the "Microsoft product updates" setting on. - -### Manage when updates are offered -You can defer or pause the installation of updates for a set period of time. - -#### Defer or pause an update - -A Windows Update for Business administrator can defer or pause updates and preview builds. You can defer features updates for up to 365 days. You can pause feature or quality updates for up to 35 days from a given start date that you specify. - -- Defer or pause a feature update: **Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are Received** -- Defer or pause a quality update: **Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are Received** - -#### Example - -In this example, there are three rings for quality updates. The first ring ("pilot") has a deferral period of 0 days. The second ring ("fast") has a deferral of five days. The third ring ("slow") has a deferral of ten days. - -![illustration of devices divided into three rings](images/waas-wufb-3-rings.png) - -When the quality update is released, it is offered to devices in the pilot ring the next time they scan for updates. - -##### Five days later -The devices in the fast ring are offered the quality update the next time they scan for updates. - -![illustration of devices with fast ring deployed](images/waas-wufb-fast-ring.png) - -##### Ten days later -Ten days after the quality update is released, it is offered to the devices in the slow ring the next time they scan for updates. - -![illustration of devices with slow ring deployed](images/waas-wufb-slow-ring.png) - -If no problems occur, all of the devices that scan for updates will be offered the quality update within ten days of its release, in three waves. - -##### What if a problem occurs with the update? - -In this example, some problem is discovered during the deployment of the update to the "pilot" ring. - -![illustration of devices divided with pilot ring experiencing a problem](images/waas-wufb-pilot-problem.png) - -At this point, the IT administrator can set a policy to pause the update. In this example, the admin selects the **Pause quality updates** check box. - -![illustration of rings with pause quality update check box selected](images/waas-wufb-pause.png) - -Now all devices are paused from updating for 35 days. When the pause is removed, they will be offered the *next* quality update, which ideally will not have the same issue. If there is still an issue, the IT admin can pause updates again. - - - -#### Set branch readiness level for feature updates - -This policy only applies to feature updates. To enable preview builds for devices in your organization, set the "Enable preview builds" policy and then use the "Select when preview builds and feature updates are received" policy. - -We recommend that you set up a ring to receive preview builds by joining the Windows Insider Program for Business. By having a ring of devices receiving "pre-release slow" builds and learning about commercial pre-release features, you can ensure that any issues you have with the release are fixed before it is ever released and far before you broadly deploy. - -- Enable preview builds: **Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Manage Preview Builds** - - - -- Set branch readiness level: **Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are Received** - - - - - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Overview of Windows as a service](waas-overview.md) -- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) -- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) -- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) -- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) -- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) -- [Manage device restarts after updates](waas-restart.md) - - - - - +--- +title: Walkthrough use Group Policy to configure Windows Update for Business - Windows 10 +description: Configure Windows Update for Business settings using Group Policy. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Walkthrough: use Group Policy to configure Windows Update for Business + + +**Applies to** + +- Windows 10 + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + + +## Overview + +You can use Group Policy through the Group Policy Management Console (GPMC) to control how Windows Update for Business works. You should consider and devise a deployment strategy for updates before you make changes to the Windows Update for Business settings. See + +An IT administrator can set policies for Windows Update for Business by using Group Policy, or they can be set locally (per device). All of the relevant policies are under the path **Computer configuration > Administrative Templates > Windows Components > Windows Update**. + +To manage updates with Windows Update for Business as described in this topic, you should prepare with these steps, if you haven't already: + +- Create Active Directory security groups that align with the deployment rings you use to phase deployment of updates. See [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) to learn more about deployment rings in Windows 10. +- Allow access to the Windows Update service. +- Download and install ADMX templates appropriate to your Windows 10 version. For more information, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759) and [Step-By-Step: Managing Windows 10 with Administrative templates](https://blogs.technet.microsoft.com/canitpro/2015/10/20/step-by-step-managing-windows-10-with-administrative-templates/). + + +## Set up Windows Update for Business + +In this example, one security group is used to manage updates. Typically we would recommend having at least three rings (early testers for pre-release builds, broad deployment for releases, critical devices for mature releases) to deploy. See [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) for more information. + +Follow these steps on a device running the Remote Server Administration Tools or on a domain controller: + +### Set up a ring +1. Start Group Policy Management Console (gpmc.msc). +2. Expand **Forest > Domains > *\*. +3. Right-click *\* and select **Create a GPO in this domain and link it here**. +4. In the **New GPO** dialog box, enter *Windows Update for Business - Group 1* as the name of the new Group Policy Object. +5. Right-click the **Windows Update for Business - Group 1" object, and then select **Edit**. +6. In the Group Policy Management Editor, go to **Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update**. You are now ready to start assigning policies to this ring (group) of devices. + + +## Offering + +You can control when updates are applied, for example by deferring when an update is installed on a device or by pausing updates for a certain period of time. + +### Manage which updates are offered + +Windows Update for Business offers you the ability to turn on or off both driver and Microsoft product updates. + +- Drivers (on/off): **Computer configuration > Administrative Templates > Windows Components > Windows Update > Do not include drivers with Windows Updates** +- Microsoft product updates (on/off): **Computer configuration > Administrative Templates > Windows Components > Windows Update > Get updates for other Microsoft Products** + +We recommend that you allow the driver policy to allow drivers to updated on devices (the default), but you can turn this setting off if you prefer to manage drivers manually. We also recommend that you leave the "Microsoft product updates" setting on. + +### Manage when updates are offered +You can defer or pause the installation of updates for a set period of time. + +#### Defer or pause an update + +A Windows Update for Business administrator can defer or pause updates and preview builds. You can defer features updates for up to 365 days. You can pause feature or quality updates for up to 35 days from a given start date that you specify. + +- Defer or pause a feature update: **Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are Received** +- Defer or pause a quality update: **Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are Received** + +#### Example + +In this example, there are three rings for quality updates. The first ring ("pilot") has a deferral period of 0 days. The second ring ("fast") has a deferral of five days. The third ring ("slow") has a deferral of ten days. + +![illustration of devices divided into three rings](images/waas-wufb-3-rings.png) + +When the quality update is released, it is offered to devices in the pilot ring the next time they scan for updates. + +##### Five days later +The devices in the fast ring are offered the quality update the next time they scan for updates. + +![illustration of devices with fast ring deployed](images/waas-wufb-fast-ring.png) + +##### Ten days later +Ten days after the quality update is released, it is offered to the devices in the slow ring the next time they scan for updates. + +![illustration of devices with slow ring deployed](images/waas-wufb-slow-ring.png) + +If no problems occur, all of the devices that scan for updates will be offered the quality update within ten days of its release, in three waves. + +##### What if a problem occurs with the update? + +In this example, some problem is discovered during the deployment of the update to the "pilot" ring. + +![illustration of devices divided with pilot ring experiencing a problem](images/waas-wufb-pilot-problem.png) + +At this point, the IT administrator can set a policy to pause the update. In this example, the admin selects the **Pause quality updates** check box. + +![illustration of rings with pause quality update check box selected](images/waas-wufb-pause.png) + +Now all devices are paused from updating for 35 days. When the pause is removed, they will be offered the *next* quality update, which ideally will not have the same issue. If there is still an issue, the IT admin can pause updates again. + + + +#### Set branch readiness level for feature updates + +This policy only applies to feature updates. To enable preview builds for devices in your organization, set the "Enable preview builds" policy and then use the "Select when preview builds and feature updates are received" policy. + +We recommend that you set up a ring to receive preview builds by joining the Windows Insider Program for Business. By having a ring of devices receiving "pre-release slow" builds and learning about commercial pre-release features, you can ensure that any issues you have with the release are fixed before it is ever released and far before you broadly deploy. + +- Enable preview builds: **Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Manage Preview Builds** + + + +- Set branch readiness level: **Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are Received** + + + + + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Manage device restarts after updates](waas-restart.md) + + + + + diff --git a/windows/deployment/update/waas-wufb-intune.md b/windows/deployment/update/waas-wufb-intune.md index 30f7702f19..7736d4e6c7 100644 --- a/windows/deployment/update/waas-wufb-intune.md +++ b/windows/deployment/update/waas-wufb-intune.md @@ -1,293 +1,295 @@ ---- -title: Walkthrough use Intune to configure Windows Update for Business (Windows 10) -description: Configure Windows Update for Business settings using Microsoft Intune. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 07/27/2017 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Walkthrough: use Microsoft Intune to configure Windows Update for Business - - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - ->[!IMPORTANT] ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products. -> ->In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. - -You can use Intune to configure Windows Update for Business even if you don’t have on-premises infrastructure when you use Intune in conjunction with Azure AD. Before configuring Windows Update for Business, consider a [deployment strategy](waas-servicing-strategy-windows-10-updates.md) for updates and feature updates in your environment. - -Windows Update for Business in Windows 10 version 1511 allows you to delay quality updates up to 4 weeks and feature updates up to an additional 8 months after Microsoft releases builds to the Current Branch for Business (CBB) servicing branch. In Windows 10 version 1607 and later, you can delay quality updates for up to 30 days and feature updates up to an additional 180 days after the release of either a Current Branch (CB) or CBB build. - -To use Intune to manage quality and feature updates in your environment, you must first create computer groups that align with your constructed deployment rings. - ->[!NOTE] ->Coming soon: [Intune Groups will be converted to Azure Active Directory-based Security Groups](https://docs.microsoft.com/intune/deploy-use/use-groups-to-manage-users-and-devices-with-microsoft-intune) - -## Configure Windows Update for Business in Windows 10, version 1511 - -In this example, you use two security groups to manage your updates: **Ring 4 Broad business users** and **Ring 5 Broad business users #2** from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md). - -- The **Ring 4 Broad business users** group contains PCs of IT members who test the updates as soon as they’re released for Windows clients in the Current Branch for Business (CBB) servicing branch. This phase typically occurs after testing on Current Branch (CB) devices. -- The **Ring 5 Broad business users #2** group consists of the first line-of-business (LOB) users, who consume quality updates after 1 week and feature updates 1 month after the CBB release. - ->[!NOTE] ->Although the [sample deployment rings](waas-deployment-rings-windows-10-updates.md) specify a feature update deferral of 2 weeks for Ring 5, deferrals in Windows 10, version 1511 are in increments of months only. - -### Configure the Ring 4 Broad business users deployment ring for CBB with no deferral - -1. Sign in to [https://manage.microsoft.com](https://manage.microsoft.com) with your Intune administrator credentials. - -2. Click the **Policy** workspace. In the middle pane, click **Configuration Policies**, and then click **Add** in the details pane. - - ![Shows the UI for this step](images/waas-wufb-intune-step2a.png) - -3. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. - -4. Name the policy **Windows Update for Business - CBB1**. Then, in the **OMA-URI Settings** section, click **Add**. - -5. In **Setting name**, type **Enable Clients for CBB**, and then select **Integer** from the **Data type** list. - -6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/RequireDeferUpgrade**. - -7. In the **Value** box, type **1**, and then click **OK**. - - >[!NOTE] - >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. - - ![Settings for this policy](images/waas-wufb-intune-step7a.png) - -8. For this deployment ring, you’re required to enable only CBB, so click **Save Policy**. - -9. In the **Deploy Policy: Windows Update for Business – CBB1** dialog box, click **Yes**. - - >[!NOTE] - >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. - -10. In the **Manage Deployment: Windows Update for Business – CBB1** dialog box, select the **Ring 4 Broad business users** group, click **Add**, and then click **OK**. - -You have now configured the **Ring 4 Broad business users** deployment ring to enable the CBB servicing branch. Now, you must configure **Ring 5 Broad business users #2** to accommodate a 1-week delay for quality updates and a 1-month delay for feature updates. - -### Configure the Ring 5 Broad business users \#2 deployment ring for CBB with deferrals - -1. In the Policy workspace, click **Configuration Policies**, and then click **Add**. - -2. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. - -3. Name the policy **Windows Update for Business – CBB2**. Then, in the **OMA-URI Settings** section, click **Add**. - In this policy, you add two OMA-URI settings, one for each deferment type. - -4. In **Setting name**, type **Enable Clients for CBB**, and then in the **Data type** list, select **Integer**. - -6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/RequireDeferUpgrade**. Then, in the **Value** box, type **1**. - -7. Click **OK** to save the setting. - -8. In the **OMA-URI Settings** section, click **Add**. - -9. For this setting, in **Setting name**, type **Defer Updates for 1 Week**, and then in the **Data type** list, select **Integer**. - -11. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferUpdatePeriod**. - -12. In the **Value** box, type **1**. - -13. Click **OK** to save the setting. - -14. In the **OMA-URI Settings** section, click **Add**. - -15. For this setting, in **Setting name**, type **Defer Upgrades for 1 Month**, and then in the **Data type** list, select **Integer**. - -17. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferUpgradePeriod**. - -18. In the **Value** box, type **1**. - -19. Click **OK** to save the setting. - - Three settings should appear in the **Windows Update for Business – CBB2** policy. - - ![Settings for CBB2 policy](images/waas-wufb-intune-step19a.png) - -20. Click **Save Policy**, and then click **Yes** at the **Deploy Policy** prompt. - -21. In the **Manage Deployment** dialog box, select the **Ring 5 Broad business users #2** computer group, click **Add**, and then click **OK**. - -## Configure Windows Update for Business in Windows 10 version 1607 - -To use Intune to manage quality and feature updates in your environment, you must first create computer groups that align with your constructed deployment rings. - -In this example, you use three security groups from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) to manage your updates: - -- **Ring 2 Pilot Business Users** contains the PCs of business users which are part of the pilot testing process, receiving CB builds 28 days after they are released. -- **Ring 4 Broad business users** consists of IT members who receive updates after Microsoft releases a Windows 10 build to the CBB servicing branch. -- **Ring 5 Broad business users #2** consists of LOB users on CBB, who receive quality updates after 7 days and feature updates after 14 days. - -### Configure Ring 2 Pilot Business Users policy - -1. Sign in to [https://manage.microsoft.com](https://manage.microsoft.com) with your Intune administrator credentials. - -2. Click the **Policy** workspace. In the middle pane, click **Configuration Policies**, and then click **Add** in the details pane. - - ![Shows the UI for this step](images/waas-wufb-intune-step2a.png) - -3. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. - -4. Name the policy **Windows Update for Business - CB2**. Then, in the **OMA-URI Settings** section, click **Add**. - -4. In **Setting name**, type **Enable Clients for CB**, and then select **Integer** from the **Data type** list. - -6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel**. - -7. In the **Value** box, type **0**, and then click **OK**. - - >[!NOTE] - >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. - - ![Settings for this policy](images/waas-wufb-intune-cb2a.png) - -8. Because the **Ring 2 Pilot Business Users** deployment ring receives the CB feature updates after 28 days, in the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. - -8. In **Setting name**, type **Defer feature updates for 28 days**, and then select **Integer** from the **Data type** list. -10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. -11. In the **Value** box, type **28**, and then click **OK**. - - ![Settings for this policy](images/waas-wufb-intune-step11a.png) - -9. Click **Save Policy**. - -9. In the **Deploy Policy: Windows Update for Business – CB2** dialog box, click **Yes**. - - >[!NOTE] - >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. - -10. In the **Manage Deployment: Windows Update for Business – CB2** dialog box, select the **Ring 2 Pilot Business Users** group, click **Add**, and then click **OK**. - -You have now configured the **Ring 2 Pilot Business Users** deployment ring to enable CB feature update deferment for 14 days. Now, you must configure **Ring 4 Broad business users** to receive CBB features updates as soon as they’re available. - -### Configure Ring 4 Broad business users policy - -2. Click the **Policy** workspace. In the middle pane, click **Configuration Policies**, and then click **Add** in the details pane. - - ![Shows the UI for this step](images/waas-wufb-intune-step2a.png) - -3. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. - -4. Name the policy **Windows Update for Business - CBB1**. Then, in the **OMA-URI Settings** section, click **Add**. - -5. In **Setting name**, type **Enable Clients for CBB**, and then select **Integer** from the **Data type** list. - -6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel**. - -7. In the **Value** box, type **1**, and then click **OK**. - - >[!NOTE] - >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. - - -8. Because the **Ring 4 Broad business users** deployment ring receives the CBB feature updates immediately, in the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. - -9. In **Setting name**, type **Defer feature updates for 0 days**, and then select **Integer** from the **Data type** list. - -10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. - -11. In the **Value** box, type **0**, and then click **OK**. - - ![Settings for this policy](images/waas-wufb-intune-cbb1a.png) - -12. Click **Save Policy**. - -13. In the **Deploy Policy: Windows Update for Business – CBB1** dialog box, click **Yes**. - - >[!NOTE] - >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. - -14. In the **Manage Deployment: Windows Update for Business – CBB1** dialog box, select the **Ring 4 Broad business users** group, click **Add**, and then click **OK**. - -You have now configured the **Ring 4 Broad business users** deployment ring to receive CBB feature updates as soon as they’re available. Finally, configure **Ring 5 Broad business users #2** to accommodate a 7-day delay for quality updates and a 14-day delay for feature updates. - - -### Configure Ring 5 Broad business users \#2 policy - -2. Click the **Policy** workspace. In the middle pane, click **Configuration Policies**, and then click **Add** in the details pane. - - ![Shows the UI for this step](images/waas-wufb-intune-step2a.png) - -3. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. - -4. Name the policy **Windows Update for Business - CBB2**. Then, in the **OMA-URI Settings** section, click **Add**. - -5. In **Setting name**, type **Enable Clients for CBB**, and then select **Integer** from the **Data type** list. - -6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel**. - -7. In the **Value** box, type **1**, and then click **OK**. - - >[!NOTE] - >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. - - -8. In the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. - -9. In **Setting name**, type **Defer quality updates for 7 days**, and then select **Integer** from the **Data type** list. - -10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferQualityUpdatesPeriodInDays**. - -11. In the **Value** box, type **7**, and then click **OK**. - -12. In the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. - -13. In **Setting name**, type **Defer feature updates for 14 days**, and then select **Integer** from the **Data type** list. - -14. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. - -15. In the **Value** box, type **14**, and then click **OK**. - - ![Settings for this policy](images/waas-wufb-intune-cbb2a.png) - -16. Click **Save Policy**. - -17. In the **Deploy Policy: Windows Update for Business – CBB2** dialog box, click **Yes**. - - >[!NOTE] - >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. - -18. In the **Manage Deployment: Windows Update for Business – CBB2** dialog box, select the **Ring 5 Broad Business Users #2** group, click **Add**, and then click **OK**. - -## Related topics - -- [Update Windows 10 in the enterprise](index.md) -- [Overview of Windows as a service](waas-overview.md) -- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) -- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) -- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) -- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) -- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) -- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) -- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) -- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) -- [Configure Windows Update for Business](waas-configure-wufb.md) -- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) -- [Manage device restarts after updates](waas-restart.md) - - - - - - - - +--- +title: Walkthrough use Intune to configure Windows Update for Business (Windows 10) +description: Configure Windows Update for Business settings using Microsoft Intune. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.audience: itpro +author: greg-lindsay +ms.date: 07/27/2017 +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Walkthrough: use Microsoft Intune to configure Windows Update for Business + + +**Applies to** + +- Windows 10 + + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +>[!IMPORTANT] +>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products. +> +>In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. + +You can use Intune to configure Windows Update for Business even if you don’t have on-premises infrastructure when you use Intune in conjunction with Azure AD. Before configuring Windows Update for Business, consider a [deployment strategy](waas-servicing-strategy-windows-10-updates.md) for updates and feature updates in your environment. + +Windows Update for Business in Windows 10 version 1511 allows you to delay quality updates up to 4 weeks and feature updates up to an additional 8 months after Microsoft releases builds to the Current Branch for Business (CBB) servicing branch. In Windows 10 version 1607 and later, you can delay quality updates for up to 30 days and feature updates up to an additional 180 days after the release of either a Current Branch (CB) or CBB build. + +To use Intune to manage quality and feature updates in your environment, you must first create computer groups that align with your constructed deployment rings. + +>[!NOTE] +>Coming soon: [Intune Groups will be converted to Azure Active Directory-based Security Groups](https://docs.microsoft.com/intune/deploy-use/use-groups-to-manage-users-and-devices-with-microsoft-intune) + +## Configure Windows Update for Business in Windows 10, version 1511 + +In this example, you use two security groups to manage your updates: **Ring 4 Broad business users** and **Ring 5 Broad business users #2** from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md). + +- The **Ring 4 Broad business users** group contains PCs of IT members who test the updates as soon as they’re released for Windows clients in the Current Branch for Business (CBB) servicing branch. This phase typically occurs after testing on Current Branch (CB) devices. +- The **Ring 5 Broad business users #2** group consists of the first line-of-business (LOB) users, who consume quality updates after 1 week and feature updates 1 month after the CBB release. + +>[!NOTE] +>Although the [sample deployment rings](waas-deployment-rings-windows-10-updates.md) specify a feature update deferral of 2 weeks for Ring 5, deferrals in Windows 10, version 1511 are in increments of months only. + +### Configure the Ring 4 Broad business users deployment ring for CBB with no deferral + +1. Sign in to [https://manage.microsoft.com](https://manage.microsoft.com) with your Intune administrator credentials. + +2. Click the **Policy** workspace. In the middle pane, click **Configuration Policies**, and then click **Add** in the details pane. + + ![Shows the UI for this step](images/waas-wufb-intune-step2a.png) + +3. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. + +4. Name the policy **Windows Update for Business - CBB1**. Then, in the **OMA-URI Settings** section, click **Add**. + +5. In **Setting name**, type **Enable Clients for CBB**, and then select **Integer** from the **Data type** list. + +6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/RequireDeferUpgrade**. + +7. In the **Value** box, type **1**, and then click **OK**. + + >[!NOTE] + >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. + + ![Settings for this policy](images/waas-wufb-intune-step7a.png) + +8. For this deployment ring, you’re required to enable only CBB, so click **Save Policy**. + +9. In the **Deploy Policy: Windows Update for Business – CBB1** dialog box, click **Yes**. + + >[!NOTE] + >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. + +10. In the **Manage Deployment: Windows Update for Business – CBB1** dialog box, select the **Ring 4 Broad business users** group, click **Add**, and then click **OK**. + +You have now configured the **Ring 4 Broad business users** deployment ring to enable the CBB servicing branch. Now, you must configure **Ring 5 Broad business users #2** to accommodate a 1-week delay for quality updates and a 1-month delay for feature updates. + +### Configure the Ring 5 Broad business users \#2 deployment ring for CBB with deferrals + +1. In the Policy workspace, click **Configuration Policies**, and then click **Add**. + +2. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. + +3. Name the policy **Windows Update for Business – CBB2**. Then, in the **OMA-URI Settings** section, click **Add**. + In this policy, you add two OMA-URI settings, one for each deferment type. + +4. In **Setting name**, type **Enable Clients for CBB**, and then in the **Data type** list, select **Integer**. + +6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/RequireDeferUpgrade**. Then, in the **Value** box, type **1**. + +7. Click **OK** to save the setting. + +8. In the **OMA-URI Settings** section, click **Add**. + +9. For this setting, in **Setting name**, type **Defer Updates for 1 Week**, and then in the **Data type** list, select **Integer**. + +11. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferUpdatePeriod**. + +12. In the **Value** box, type **1**. + +13. Click **OK** to save the setting. + +14. In the **OMA-URI Settings** section, click **Add**. + +15. For this setting, in **Setting name**, type **Defer Upgrades for 1 Month**, and then in the **Data type** list, select **Integer**. + +17. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferUpgradePeriod**. + +18. In the **Value** box, type **1**. + +19. Click **OK** to save the setting. + + Three settings should appear in the **Windows Update for Business – CBB2** policy. + + ![Settings for CBB2 policy](images/waas-wufb-intune-step19a.png) + +20. Click **Save Policy**, and then click **Yes** at the **Deploy Policy** prompt. + +21. In the **Manage Deployment** dialog box, select the **Ring 5 Broad business users #2** computer group, click **Add**, and then click **OK**. + +## Configure Windows Update for Business in Windows 10 version 1607 + +To use Intune to manage quality and feature updates in your environment, you must first create computer groups that align with your constructed deployment rings. + +In this example, you use three security groups from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) to manage your updates: + +- **Ring 2 Pilot Business Users** contains the PCs of business users which are part of the pilot testing process, receiving CB builds 28 days after they are released. +- **Ring 4 Broad business users** consists of IT members who receive updates after Microsoft releases a Windows 10 build to the CBB servicing branch. +- **Ring 5 Broad business users #2** consists of LOB users on CBB, who receive quality updates after 7 days and feature updates after 14 days. + +### Configure Ring 2 Pilot Business Users policy + +1. Sign in to [https://manage.microsoft.com](https://manage.microsoft.com) with your Intune administrator credentials. + +2. Click the **Policy** workspace. In the middle pane, click **Configuration Policies**, and then click **Add** in the details pane. + + ![Shows the UI for this step](images/waas-wufb-intune-step2a.png) + +3. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. + +4. Name the policy **Windows Update for Business - CB2**. Then, in the **OMA-URI Settings** section, click **Add**. + +4. In **Setting name**, type **Enable Clients for CB**, and then select **Integer** from the **Data type** list. + +6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel**. + +7. In the **Value** box, type **0**, and then click **OK**. + + >[!NOTE] + >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. + + ![Settings for this policy](images/waas-wufb-intune-cb2a.png) + +8. Because the **Ring 2 Pilot Business Users** deployment ring receives the CB feature updates after 28 days, in the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. + +8. In **Setting name**, type **Defer feature updates for 28 days**, and then select **Integer** from the **Data type** list. +10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. +11. In the **Value** box, type **28**, and then click **OK**. + + ![Settings for this policy](images/waas-wufb-intune-step11a.png) + +9. Click **Save Policy**. + +9. In the **Deploy Policy: Windows Update for Business – CB2** dialog box, click **Yes**. + + >[!NOTE] + >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. + +10. In the **Manage Deployment: Windows Update for Business – CB2** dialog box, select the **Ring 2 Pilot Business Users** group, click **Add**, and then click **OK**. + +You have now configured the **Ring 2 Pilot Business Users** deployment ring to enable CB feature update deferment for 14 days. Now, you must configure **Ring 4 Broad business users** to receive CBB features updates as soon as they’re available. + +### Configure Ring 4 Broad business users policy + +2. Click the **Policy** workspace. In the middle pane, click **Configuration Policies**, and then click **Add** in the details pane. + + ![Shows the UI for this step](images/waas-wufb-intune-step2a.png) + +3. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. + +4. Name the policy **Windows Update for Business - CBB1**. Then, in the **OMA-URI Settings** section, click **Add**. + +5. In **Setting name**, type **Enable Clients for CBB**, and then select **Integer** from the **Data type** list. + +6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel**. + +7. In the **Value** box, type **1**, and then click **OK**. + + >[!NOTE] + >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. + + +8. Because the **Ring 4 Broad business users** deployment ring receives the CBB feature updates immediately, in the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. + +9. In **Setting name**, type **Defer feature updates for 0 days**, and then select **Integer** from the **Data type** list. + +10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. + +11. In the **Value** box, type **0**, and then click **OK**. + + ![Settings for this policy](images/waas-wufb-intune-cbb1a.png) + +12. Click **Save Policy**. + +13. In the **Deploy Policy: Windows Update for Business – CBB1** dialog box, click **Yes**. + + >[!NOTE] + >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. + +14. In the **Manage Deployment: Windows Update for Business – CBB1** dialog box, select the **Ring 4 Broad business users** group, click **Add**, and then click **OK**. + +You have now configured the **Ring 4 Broad business users** deployment ring to receive CBB feature updates as soon as they’re available. Finally, configure **Ring 5 Broad business users #2** to accommodate a 7-day delay for quality updates and a 14-day delay for feature updates. + + +### Configure Ring 5 Broad business users \#2 policy + +2. Click the **Policy** workspace. In the middle pane, click **Configuration Policies**, and then click **Add** in the details pane. + + ![Shows the UI for this step](images/waas-wufb-intune-step2a.png) + +3. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. + +4. Name the policy **Windows Update for Business - CBB2**. Then, in the **OMA-URI Settings** section, click **Add**. + +5. In **Setting name**, type **Enable Clients for CBB**, and then select **Integer** from the **Data type** list. + +6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel**. + +7. In the **Value** box, type **1**, and then click **OK**. + + >[!NOTE] + >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. + + +8. In the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. + +9. In **Setting name**, type **Defer quality updates for 7 days**, and then select **Integer** from the **Data type** list. + +10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferQualityUpdatesPeriodInDays**. + +11. In the **Value** box, type **7**, and then click **OK**. + +12. In the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. + +13. In **Setting name**, type **Defer feature updates for 14 days**, and then select **Integer** from the **Data type** list. + +14. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. + +15. In the **Value** box, type **14**, and then click **OK**. + + ![Settings for this policy](images/waas-wufb-intune-cbb2a.png) + +16. Click **Save Policy**. + +17. In the **Deploy Policy: Windows Update for Business – CBB2** dialog box, click **Yes**. + + >[!NOTE] + >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. + +18. In the **Manage Deployment: Windows Update for Business – CBB2** dialog box, select the **Ring 5 Broad Business Users #2** group, click **Add**, and then click **OK**. + +## Related topics + +- [Update Windows 10 in the enterprise](index.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Manage device restarts after updates](waas-restart.md) + + + + + + + + diff --git a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md index 423c82f71c..8ba5c114c5 100644 --- a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md +++ b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md @@ -8,8 +8,10 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay +ms.audience: itpro +author: greg-lindsay ms.localizationpriority: medium ms.collection: M365-analytics ms.topic: article @@ -53,12 +55,12 @@ If you've followed the steps in the [Enrolling devices in Windows Analytics](win ### Devices not appearing in Upgrade Readiness -In Log Analytics, go to **Settings > Connected sources > Windows telemetry** and verify that you are subscribed to the Windows Analytics solutions you intend to use. +In Log Analytics workspace, go to **Solutions** and verify that you are subscribed to the Windows Analytics solutions you intend to use. Even though devices can take 2-3 days after enrollment to show up due to latency in the system, you can now verify the status of your devices within a few hours of running the deployment script as described in [You can now check on the status of your computers within hours of running the deployment script](https://techcommunity.microsoft.com/t5/Windows-Analytics-Blog/You-can-now-check-on-the-status-of-your-computers-within-hours/ba-p/187213) on the Tech Community Blog. >[!NOTE] -> If you generate the status report and get an error message saying "Sorry! We’re not recognizing your Commercial Id," go to **Settings > Connected sources > Windows telemetry** remove the Upgrade Readiness solution, and then re-add it. +> If you generate the status report and get an error message saying "Sorry! We’re not recognizing your Commercial Id, See [Enrolling devices in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started). If devices are not showing up as expected, find a representative device and follow these steps to run the latest pilot version of the Upgrade Readiness deployment script on it to troubleshoot issues: @@ -230,9 +232,7 @@ We have identified an incompatibility between AbnormalShutdownCount and the Limi If you want to stop using Upgrade Readiness and stop sending diagnostic data to Microsoft, follow these steps: -1. Unsubscribe from the Upgrade Readiness solution in Azure Portal. In Azure Portal, go to **Settings** > **Connected Sources** > **Windows Telemetry** and choose the **Unsubscribe** option. - - ![Upgrade Readiness unsubscribe](images/upgrade-analytics-unsubscribe.png) +1. Delete the Upgrade Readiness solution in Log Analytics workspace. In Log Analytics workspace. select **Solutions** > **Compatibility Assessment** > **Delete**. 2. Disable the Commercial Data Opt-in Key on computers running Windows 7 SP1 or 8.1. On computers running Windows 10, set the diagnostic data level to **Security**: diff --git a/windows/deployment/update/windows-analytics-get-started.md b/windows/deployment/update/windows-analytics-get-started.md index 35a8196735..0a0a06c7eb 100644 --- a/windows/deployment/update/windows-analytics-get-started.md +++ b/windows/deployment/update/windows-analytics-get-started.md @@ -78,7 +78,7 @@ To enable data sharing, configure your proxy server to whitelist the following e >[!NOTE] >Microsoft has a strong commitment to providing the tools and resources that put you in control of your privacy. As a result, Microsoft doesn't collect the following data from devices located in European countries (EEA and Switzerland): >- Windows diagnostic data from Windows 8.1 devices ->- App usage data for Windows 7 devices +>- App usage data and [Internet Explorer site discovery](../upgrade/upgrade-readiness-additional-insights.md#site-discovery) features for Windows 7 devices diff --git a/windows/deployment/update/windows-as-a-service.md b/windows/deployment/update/windows-as-a-service.md index ab43140802..d7d45d741a 100644 --- a/windows/deployment/update/windows-as-a-service.md +++ b/windows/deployment/update/windows-as-a-service.md @@ -80,7 +80,7 @@ Prepare to implement Windows as a service effectively using the right tools, pro -Simplified updates +Simplified updates Windows 10 end user readiness diff --git a/windows/deployment/update/windows-update-resources.md b/windows/deployment/update/windows-update-resources.md index c98b9d29d0..ead5fd7aaf 100644 --- a/windows/deployment/update/windows-update-resources.md +++ b/windows/deployment/update/windows-update-resources.md @@ -1,126 +1,132 @@ ---- -title: Windows Update - Additional resources -description: Additional resources for Windows Update -ms.prod: w10 -ms.mktglfcycl: -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 09/18/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- - -# Windows Update - additional resources - ->Applies to: Windows 10 - -The following resources provide additional information about using Windows Update. - -## WSUS Troubleshooting - -[Troubleshooting issues with WSUS client agents](https://support.microsoft.com/help/10132/) - -[How to troubleshoot WSUS](https://support.microsoft.com/help/4025764/) - -[Error 80244007 when WSUS client scans for updates](https://support.microsoft.com/help/4096317/) - -[Updates may not be installed with Fast Startup in Windows 10](https://support.microsoft.com/help/4011287/) - - -## How do I reset Windows Update components? - -[This script](https://gallery.technet.microsoft.com/scriptcenter/Reset-WindowsUpdateps1-e0c5eb78) will completely reset the Windows Update client settings. It has been tested on Windows 7, 8, 10, and Windows Server 2012 R2. It will configure the services and registry keys related to Windows Update for default settings. It will also clean up files related to Windows Update, in addition to BITS related data. - - -[This script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc) allow reset the Windows Update Agent resolving issues with Windows Update. - - -## Reset Windows Update components manually -1. Open a Windows command prompt. To open a command prompt, click **Start > Run**. Copy and paste (or type) the following command and then press ENTER: - ``` - cmd - ``` -2. Stop the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command. - ``` - net stop bits - net stop wuauserv - ``` -3. Delete the qmgr\*.dat files. To do this, type the following command at a command prompt, and then press ENTER: - ``` - Del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat" - ``` -4. If this is your first attempt at resolving your Windows Update issues by using the steps in this article, go to step 5 without carrying out the steps in step 4. The steps in step 4 should only be performed at this point in the troubleshooting if you cannot resolve your Windows Update issues after following all steps but step 4. The steps in step 4 are also performed by the "Aggressive" mode of the Fix it Solution above. - 1. Rename the following folders to *.BAK: - - %systemroot%\SoftwareDistribution\DataStore - - %systemroot%\SoftwareDistribution\Download - - %systemroot%\system32\catroot2 - - To do this, type the following commands at a command prompt. Press ENTER after you type each command. - - Ren %systemroot%\SoftwareDistribution\DataStore *.bak - - Ren %systemroot%\SoftwareDistribution\Download *.bak - - Ren %systemroot%\system32\catroot2 *.bak - 2. Reset the BITS service and the Windows Update service to the default security descriptor. To do this, type the following commands at a command prompt. Press ENTER after you type each command. - - sc.exe sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) - - sc.exe sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) -5. Type the following command at a command prompt, and then press ENTER: - ``` - cd /d %windir%\system32 - ``` -6. Reregister the BITS files and the Windows Update files. To do this, type the following commands at a command prompt. Press ENTER after you type each command. - - regsvr32.exe atl.dll - - regsvr32.exe urlmon.dll - - regsvr32.exe mshtml.dll - - regsvr32.exe shdocvw.dll - - regsvr32.exe browseui.dll - - regsvr32.exe jscript.dll - - regsvr32.exe vbscript.dll - - regsvr32.exe scrrun.dll - - regsvr32.exe msxml.dll - - regsvr32.exe msxml3.dll - - regsvr32.exe msxml6.dll - - regsvr32.exe actxprxy.dll - - regsvr32.exe softpub.dll - - regsvr32.exe wintrust.dll - - regsvr32.exe dssenh.dll - - regsvr32.exe rsaenh.dll - - regsvr32.exe gpkcsp.dll - - regsvr32.exe sccbase.dll - - regsvr32.exe slbcsp.dll - - regsvr32.exe cryptdlg.dll - - regsvr32.exe oleaut32.dll - - regsvr32.exe ole32.dll - - regsvr32.exe shell32.dll - - regsvr32.exe initpki.dll - - regsvr32.exe wuapi.dll - - regsvr32.exe wuaueng.dll - - regsvr32.exe wuaueng1.dll - - regsvr32.exe wucltui.dll - - regsvr32.exe wups.dll - - regsvr32.exe wups2.dll - - regsvr32.exe wuweb.dll - - regsvr32.exe qmgr.dll - - regsvr32.exe qmgrprxy.dll - - regsvr32.exe wucltux.dll - - regsvr32.exe muweb.dll - - regsvr32.exe wuwebv.dll -7. Reset Winsock. To do this, type the following command at a command prompt, and then press ENTER: - ``` - netsh winsock reset - ``` -8. If you are running Windows XP or Windows Server 2003, you have to set the proxy settings. To do this, type the following command at a command prompt, and then press ENTER: - ``` - proxycfg.exe -d - ``` -9. Restart the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command. - ``` - net start bits - - net start wuauserv - ``` -10. If you are running Windows Vista or Windows Server 2008, clear the BITS queue. To do this, type the following command at a command prompt, and then press ENTER: - ``` - bitsadmin.exe /reset /allusers - ``` +--- +title: Windows Update - Additional resources +description: Additional resources for Windows Update +ms.prod: w10 +ms.mktglfcycl: +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.audience: itpro +author: greg-lindsay +ms.date: 09/18/2018 +ms.reviewer: +manager: laurawi +ms.topic: article +--- + +# Windows Update - additional resources + +>Applies to: Windows 10 + +The following resources provide additional information about using Windows Update. + +## WSUS Troubleshooting + +[Troubleshooting issues with WSUS client agents](https://support.microsoft.com/help/10132/) + +[How to troubleshoot WSUS](https://support.microsoft.com/help/4025764/) + +[Error 80244007 when WSUS client scans for updates](https://support.microsoft.com/help/4096317/) + +[Updates may not be installed with Fast Startup in Windows 10](https://support.microsoft.com/help/4011287/) + + +## How do I reset Windows Update components? + +[This script](https://gallery.technet.microsoft.com/scriptcenter/Reset-WindowsUpdateps1-e0c5eb78) will completely reset the Windows Update client settings. It has been tested on Windows 7, 8, 10, and Windows Server 2012 R2. It will configure the services and registry keys related to Windows Update for default settings. It will also clean up files related to Windows Update, in addition to BITS related data. + + +[This script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc) allow reset the Windows Update Agent resolving issues with Windows Update. + + +## Reset Windows Update components manually +1. Open a Windows command prompt. To open a command prompt, click **Start > Run**. Copy and paste (or type) the following command and then press ENTER: + ``` + cmd + ``` +2. Stop the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command. + ``` + net stop bits + net stop wuauserv + ``` +3. Delete the qmgr\*.dat files. To do this, type the following command at a command prompt, and then press ENTER: + ``` + Del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat" + ``` +4. If this is your first attempt at resolving your Windows Update issues by using the steps in this article, go to step 5 without carrying out the steps in step 4. The steps in step 4 should only be performed at this point in the troubleshooting if you cannot resolve your Windows Update issues after following all steps but step 4. The steps in step 4 are also performed by the "Aggressive" mode of the Fix it Solution above. + 1. Rename the following folders to *.BAK: + - %systemroot%\SoftwareDistribution\DataStore + - %systemroot%\SoftwareDistribution\Download + - %systemroot%\system32\catroot2 + + To do this, type the following commands at a command prompt. Press ENTER after you type each command. + - Ren %systemroot%\SoftwareDistribution\DataStore *.bak + - Ren %systemroot%\SoftwareDistribution\Download *.bak + - Ren %systemroot%\system32\catroot2 *.bak + 2. Reset the BITS service and the Windows Update service to the default security descriptor. To do this, type the following commands at a command prompt. Press ENTER after you type each command. + - sc.exe sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) + - sc.exe sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) +5. Type the following command at a command prompt, and then press ENTER: + ``` + cd /d %windir%\system32 + ``` +6. Reregister the BITS files and the Windows Update files. To do this, type the following commands at a command prompt. Press ENTER after you type each command. + + ``` + regsvr32.exe atl.dll + regsvr32.exe urlmon.dll + regsvr32.exe mshtml.dll + regsvr32.exe shdocvw.dll + regsvr32.exe browseui.dll + regsvr32.exe jscript.dll + regsvr32.exe vbscript.dll + regsvr32.exe scrrun.dll + regsvr32.exe msxml.dll + regsvr32.exe msxml3.dll + regsvr32.exe msxml6.dll + regsvr32.exe actxprxy.dll + regsvr32.exe softpub.dll + regsvr32.exe wintrust.dll + regsvr32.exe dssenh.dll + regsvr32.exe rsaenh.dll + regsvr32.exe gpkcsp.dll + regsvr32.exe sccbase.dll + regsvr32.exe slbcsp.dll + regsvr32.exe cryptdlg.dll + regsvr32.exe oleaut32.dll + regsvr32.exe ole32.dll + regsvr32.exe shell32.dll + regsvr32.exe initpki.dll + regsvr32.exe wuapi.dll + regsvr32.exe wuaueng.dll + regsvr32.exe wuaueng1.dll + regsvr32.exe wucltui.dll + regsvr32.exe wups.dll + regsvr32.exe wups2.dll + regsvr32.exe wuweb.dll + regsvr32.exe qmgr.dll + regsvr32.exe qmgrprxy.dll + regsvr32.exe wucltux.dll + regsvr32.exe muweb.dll + regsvr32.exe wuwebv.dll + ``` + +7. Reset Winsock. To do this, type the following command at a command prompt, and then press ENTER: + ``` + netsh winsock reset + ``` +8. If you are running Windows XP or Windows Server 2003, you have to set the proxy settings. To do this, type the following command at a command prompt, and then press ENTER: + ``` + proxycfg.exe -d + ``` +9. Restart the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command. + ``` + net start bits + + net start wuauserv + ``` +10. If you are running Windows Vista or Windows Server 2008, clear the BITS queue. To do this, type the following command at a command prompt, and then press ENTER: + ``` + bitsadmin.exe /reset /allusers + ``` diff --git a/windows/deployment/update/wufb-compliancedeadlines.md b/windows/deployment/update/wufb-compliancedeadlines.md index bb088093c1..1edad940a4 100644 --- a/windows/deployment/update/wufb-compliancedeadlines.md +++ b/windows/deployment/update/wufb-compliancedeadlines.md @@ -1,100 +1,173 @@ ---- -title: Enforce compliance deadlines with policies in Windows Update for Business (Windows 10) -description: Learn how to enforce compliance deadlines using Windows Update for Business. -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.audience: itpro author: greg-lindsay -ms.date: 06/20/2018 -ms.reviewer: -manager: laurawi -ms.topic: article ---- -# Enforcing compliance deadlines for updates - ->Applies to: Windows 10 - -Deploying feature or quality updates for many organizations is only part of the equation for managing their device ecosystem. The ability to enforce patch compliance is the next important part. Windows Update for Business provides controls to manage deadlines for when devices should migrate to newer revisions. We offer two compliance flows that you can choose from: - -- [Deadline only](#deadline-only) -- [Deadline with user engagement](#deadline-with-user-engagement) - -## Deadline Only - -This flow only enforces the deadline where the device will attempt to silently restart outside of active hours before the deadline is reached. Once the deadline is reached the user is prompted with either a confirmation button or a restart now option. - -### End User Experience - -Once the device is in the pending restart state, it will attempt to restart the device during non-active hours. This is known as the auto-restart period, and by default it does not require user interaction to reboot the device. - ->[!NOTE] ->Deadlines are enforced from pending restart state (for example, when the device has completed the installation and download from Windows Update). - -### Policy overview - -|Policy|Description | -|-|-| -|Specify deadline before auto-restart for update installation|Governs the update experience once the device has entered pending reboot state. It specifies a deadline, in days, to enforce compliance (such as imminent install).| -|Configure Auto-restart warning notification schedule for updates|Configures the reminder notification and the warning notification for a scheduled install. The user can dismiss a reminder, but not the warning.| - -### Suggested Configuration - -|Policy|Location|3 Day Compliance|5 Day Compliance|7 Day Compliance | -|-|-|-|-|-| -|Specify deadline before auto-restart for update installation| GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadline before auto-restart for update installation |State: Enabled
                        **Specify the number of days before pending restart will automatically be executed outside of active hours**: 2|State: Enabled
                        **Specify the number of days before pending restart will automatically be executed outside of active hours**: 3|State: Enabled
                        **Specify the number of days before pending restart will automatically be executed outside of active hours**: 4 - -### Controlling notification experience for deadline - -|Policy| Location|Suggested Configuration | -|-|-|-| -|Configure Auto-restart warning notification schedule for updates|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure auto-restart warning notifications schedule for updates |State: Enabled
                        **Reminder** (hours): 2
                        **Warning** (minutes): 60 | - -### Notification experience for deadline - -Notification users get for a quality update deadline: -![The notification users get for an impending quality update deadline](images/wufb-quality-notification.png) - -Notification users get for a feature update deadline: -![The notification users get for an impending feature update deadline](images/wufb-feature-notification.png) - -## Deadline with user engagement - -This flow provides the end user with prompts to select a time to restart the device before the deadline is reached. If the device is unable to restart at the time specified by the user or the time selected is outside the deadline, the device will restart the next time it is active. - -### End user experience - -Before the deadline the device will be in two states: auto-restart period and engaged-restart period. During the auto-restart period the device will silently try to restart outside of active hours. If the device can't find an idle moment to restart, then the device will go into engaged-restart. The end user, at this point, can select a time that they would like the device to try to restart. Both phases happen before the deadline; once that deadline has passed then the device will restart at the next available time. - -### Policy overview - -|Policy| Description | -|-|-| -|Specify engaged restart transition and notification schedule for updates|Governs how the user will be impacted by the pending reboot. Transition days, first starts out in Auto-Restart where the device will find an idle moment to reboot the device. After 2 days engaged restart will commence and the user will be able to choose a time| -|Configure Auto-restart required notification for updates|Governs the notifications during the Auto-Restart period. During Active hours, the user will be notified that the device is trying to reboot. They will have the option to confirm or dismiss the notification| - -### Suggested configuration - -|Policy| Location| 3 Day Compliance| 5 Day Compliance| 7 Day Compliance | -|-|-|-|-|-| -|Specify engaged restart transition and notification schedule for updates|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify Engaged restart transition and notification schedule for updates|State: Enabled
                        **Transition** (Days): 2
                        **Snooze** (Days): 2
                        **Deadline** (Days): 3|State: Enabled
                        **Transition** (Days): 2
                        **Snooze** (Days): 2
                        **Deadline** (Days): 4|State: Enabled
                        **Transition** (Days): 2
                        **Snooze** (Days): 2
                        **Deadline** (Days): 5| - -### Controlling notification experience for engaged deadline - -|Policy| Location |Suggested Configuration -|-|-|-| -|Configure Auto-restart required notification for updates |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Auto-restart required notification for updates|State: Enabled
                        **Method**: 2- User| - -### Notification experience for engaged deadlines -Notification users get for quality update engaged deadline: -![The notification users get for an impending engaged quality update deadline](images/wufb-quality-engaged-notification.png) - -Notification users get for a quality update deadline: -![The notification users get for an impending quality update deadline](images/wufb-quality-notification.png) - -Notification users get for a feature update engaged deadline: -![The notification users get for an impending feature update engaged deadline](images/wufb-feature-update-engaged-notification.png) - -Notification users get for a feature update deadline: -![The notification users get for an impending feature update deadline](images/wufb-feature-update-deadline-notification.png) +--- +title: Enforce compliance deadlines with policies in Windows Update for Business (Windows 10) +description: Learn how to enforce compliance deadlines using Windows Update for Business. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jaimeo +ms.localizationpriority: medium +ms.author: jaimeo +ms.reviewer: +manager: laurawi +ms.topic: article +--- +# Enforcing compliance deadlines for updates + +>Applies to: Windows 10 + +Deploying feature or quality updates for many organizations is only part of the equation for managing their device ecosystem. The ability to enforce update compliance is the next important part. Windows Update for Business provides controls to manage deadlines for when devices should migrate to newer versions. + +The compliance options have changed with the release of Windows 10, version 1903: + +- [Starting with Windows 10, version 1903](#starting-with-windows-10-version-1903) +- [Prior to Windows 10, version 1903](#prior-to-windows-10-version-1903) + + +## Starting with Windows 10, version 1903 + +With a current version of Windows 10, it's best to use the new policy introduced in Windows 10, version 1903: **Specify deadlines for automatic updates and restarts**. In MDM, this policy is available as four separate settings: + +- Update/ConfigureDeadlineForFeatureUpdates +- Update/ConfigureDeadlineForQualityUpdates +- Update/ConfigureDeadlineGracePeriod +- Update/ConfigureDeadlineNoAutoReboot + +This policy starts the countdown for the update installation deadline from when the update is published, instead of starting with the "restart pending" state as the older policies did. + +The policy also includes a configurable grace period to allow, for example, users who have been away to have extra time before being forced to restart their devices. + +Further, the policy includes the option to opt out of automatic restarts until the deadline is reached by presenting the "engaged restart experience" until the deadline has actually expired. At this point the device will automatically schedule a restart regardless of active hours. + + + +### Policy setting overview + +|Policy|Description | +|-|-| +| (starting in Windows 10, version 1903) Specify deadlines for automatic updates and restarts | Similar to the older "Specify deadline before auto-restart for update installation," but starts the deadline countdown from when the update was published. Also introduces a configurable grace period and the option to opt out of automatic restarts until the deadline is reached. | + + + +### Suggested configurations + +|Policy|Location|Quality update deadline in days|Feature update deadline in days|Grace period in days| +|-|-|-|-|-| +|(starting in Windows 10, version 1903) Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 7 | 7 | 2 | + +When **Specify deadlines for automatic updates and restarts** is set (starting in Windows 10, version 1903): + +**While restart is pending, before the deadline occurs:** +- For the first few days, the user receives a toast notification +- After this period, the user receives this dialog: + +![The notification users get for an impending restart prior to deadline](images/wufb-update-deadline-warning.png) +- If the user scheduled a restart, or if an auto restart is scheduled, 15 minutes before the scheduled time the user is receives this notification that the restart is about to occur: + +![The notification users get for an impending restart 15 minutes prior to restart](images/wufb-restart-imminent-warning.png) + +**If the restart is still pending after the deadline passes:** +- Within 12 hours before the deadline passes, the user receives this notification that the deadline is approaching: + +![The notification users get for an approaching restart deadline](images/wufb-pastdeadline-restart-warning.png) +- Once the deadline has passed, the user is forced to restart to keep their devices in compliance and receives this notification: + +![The notification users get for an imminent restart after the deadline](images/wufb-pastdeadline-restartnow.png) + + + + +## Prior to Windows 10, version 1903 + + +Two compliance flows are available: + +- [Deadline only](#deadline-only) +- [Deadline with user engagement](#deadline-with-user-engagement) + +### Deadline only + +This flow only enforces the deadline where the device will attempt to silently restart outside of active hours before the deadline is reached. Once the deadline is reached the user is prompted with either a confirmation button or a restart now option. + +#### End-user experience + +Once the device is in the pending restart state, it will attempt to restart the device during non-active hours. This is known as the auto-restart period, and by default it does not require user interaction to restart the device. + +>[!NOTE] +>Deadlines are enforced from pending restart state (for example, when the device has completed the installation and download from Windows Update). + +#### Policy overview + +|Policy|Description | +|-|-| +|Specify deadline before auto-restart for update installation|Governs the update experience once the device has entered pending restart state. It specifies a deadline, in days, to enforce compliance (such as imminent installation).| +|Configure Auto-restart warning notification schedule for updates|Configures the reminder notification and the warning notification for a scheduled installation. The user can dismiss a reminder, but not the warning.| + + + + +#### Suggested configuration + +|Policy|Location|3-day compliance|5-day compliance|7-day compliance| +|-|-|-|-|-| +|Specify deadline before auto-restart for update installation| GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadline before auto-restart for update installation |State: Enabled
                        **Specify the number of days before pending restart will automatically be executed outside of active hours:** 2| State: Enabled
                        **Specify the number of days before pending restart will automatically be executed outside of active hours:** 3 | State: Enabled
                        **Specify the number of days before pending restart will automatically be executed outside of active hours:** 4| + +#### Controlling notification experience for deadline + +|Policy| Location|Suggested Configuration | +|-|-|-| +|Configure Auto-restart warning notification schedule for updates|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure auto-restart warning notifications schedule for updates |State: Enabled
                        **Reminder** (hours): 2
                        **Warning** (minutes): 60 | + +#### Notification experience for deadline + +Notification users get for a quality update deadline: +![The notification users get for an impending quality update deadline](images/wufb-quality-notification.png) + +Notification users get for a feature update deadline: +![The notification users get for an impending feature update deadline](images/wufb-feature-notification.png) + +### Deadline with user engagement + +This flow provides the end user with prompts to select a time to restart the device before the deadline is reached. If the device is unable to restart at the time specified by the user or the time selected is outside the deadline, the device will restart the next time it is active. + +#### End-user experience + +Before the deadline the device will be in two states: auto-restart period and engaged-restart period. During the auto-restart period the device will silently try to restart outside of active hours. If the device can't find an idle moment to restart, then the device will go into engaged-restart. The end user, at this point, can select a time that they would like the device to try to restart. Both phases happen before the deadline; once that deadline has passed then the device will restart at the next available time. + +#### Policy overview + +|Policy| Description | +|-|-| +|Specify engaged restart transition and notification schedule for updates|Governs how the user will be impacted by the pending restart. Transition days, first starts out in Auto-Restart where the device will find an idle moment to restart the device. After 2 days engaged restart will commence and the user will be able to choose a time| +|Configure Auto-restart required notification for updates|Governs the notifications during the Auto-Restart period. During Active hours, the user will be notified that the device is trying to restart. They will have the option to confirm or dismiss the notification| + +#### Suggested configuration + +|Policy| Location| 3-day compliance| 5-day compliance| 7-day compliance | +|-|-|-|-|-| +|Specify engaged restart transition and notification schedule for updates|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify Engaged restart transition and notification schedule for updates|State: Enabled
                        **Transition** (Days): 2
                        **Snooze** (Days): 2
                        **Deadline** (Days): 3|State: Enabled
                        **Transition** (Days): 2
                        **Snooze** (Days): 2
                        **Deadline** (Days): 4|State: Enabled
                        **Transition** (Days): 2
                        **Snooze** (Days): 2
                        **Deadline** (Days): 5| + +#### Controlling notification experience for engaged deadline + +|Policy| Location |Suggested Configuration +|-|-|-| +|Configure Auto-restart required notification for updates |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Auto-restart required notification for updates|State: Enabled
                        **Method**: 2- User| + +#### Notification experience for engaged deadlines + +Notification users get for quality update engaged deadline: + +![The notification users get for an impending engaged quality update deadline](images/wufb-quality-engaged-notification.png) + +Notification users get for a quality update deadline: + +![The notification users get for an impending quality update deadline](images/wufb-quality-notification.png) + +Notification users get for a feature update engaged deadline: + +![The notification users get for an impending feature update engaged deadline](images/wufb-feature-update-engaged-notification.png) + +Notification users get for a feature update deadline: + +![The notification users get for an impending feature update deadline](images/wufb-feature-update-deadline-notification.png) + + diff --git a/windows/deployment/upgrade/log-files.md b/windows/deployment/upgrade/log-files.md index 0216aec2c1..0214e53ad8 100644 --- a/windows/deployment/upgrade/log-files.md +++ b/windows/deployment/upgrade/log-files.md @@ -166,6 +166,6 @@ Therefore, Windows Setup failed because it was not able to migrate the corrupt f [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx)
                        [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
                        [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +
                        [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
                        [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
                        [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/quick-fixes.md b/windows/deployment/upgrade/quick-fixes.md index 305917b360..01850db7f6 100644 --- a/windows/deployment/upgrade/quick-fixes.md +++ b/windows/deployment/upgrade/quick-fixes.md @@ -234,6 +234,6 @@ If you downloaded the SetupDiag.exe program to your computer, then copied it to [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx)
                        [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
                        [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +
                        [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
                        [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
                        [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/resolution-procedures.md b/windows/deployment/upgrade/resolution-procedures.md index 34e22a7ab7..15c4156866 100644 --- a/windows/deployment/upgrade/resolution-procedures.md +++ b/windows/deployment/upgrade/resolution-procedures.md @@ -504,7 +504,7 @@ This error has more than one possible cause. Attempt [quick fixes](quick-fixes.m 0xC1900200 Setup.exe has detected that the machine does not meet the minimum system requirements. -Ensure the system you are trying to upgrade meets the minimum system requirements.
                        See Windows 10 specifications for information. +Ensure the system you are trying to upgrade meets the minimum system requirements.
                        See Windows 10 specifications for information. @@ -524,14 +524,14 @@ This error has more than one possible cause. Attempt [quick fixes](quick-fixes.m 0x80190001 An unexpected error was encountered while attempting to download files required for upgrade. -To resolve this issue, download and run the media creation tool. See Download windows 10. +To resolve this issue, download and run the media creation tool. See Download windows 10. 0x80246007 The update was not downloaded successfully. Attempt other methods of upgrading the operating system.
                        -Download and run the media creation tool. See Download windows 10. +Download and run the media creation tool. See Download windows 10.
                        Attempt to upgrade using .ISO or USB.
                        Note: Windows 10 Enterprise isn’t available in the media creation tool. For more information, go to the Volume Licensing Service Center. @@ -640,7 +640,7 @@ Download and run the media creation tool. See Windows 10 Specifications and verify the computer meets minimum requirements. +See Windows 10 Specifications and verify the computer meets minimum requirements.
                        Review logs for [compatibility information](https://blogs.technet.microsoft.com/askcore/2016/01/21/using-the-windows-10-compatibility-reports-to-understand-upgrade-issues/). 0x80070004 - 0x3000D @@ -766,6 +766,6 @@ Also see the following sequential list of modern setup (mosetup) error codes wit [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx)
                        [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
                        [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +
                        [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
                        [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
                        [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md index af24d3c075..3a7f854132 100644 --- a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md +++ b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md @@ -58,7 +58,7 @@ See the following topics in this article: [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx)
                        [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
                        [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +
                        [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
                        [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
                        [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821)
                        diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md index c9dc96d32e..0a503b2010 100644 --- a/windows/deployment/upgrade/setupdiag.md +++ b/windows/deployment/upgrade/setupdiag.md @@ -1,524 +1,540 @@ ---- -title: SetupDiag -ms.reviewer: -manager: laurawi -ms.author: greglin -description: How to use the SetupDiag tool to diagnose Windows Setup errors -keywords: deploy, troubleshoot, windows, 10, upgrade, update, setup, diagnose -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.localizationpriority: medium -ms.topic: article ---- - -# SetupDiag - -**Applies to** -- Windows 10 - ->[!NOTE] ->This is a 300 level topic (moderate advanced).
                        ->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article.
                        - - [![Download SetupDiag](../images/download.png)](https://go.microsoft.com/fwlink/?linkid=870142) - -## About SetupDiag - -Current version of SetupDiag: 1.5.0.0 - -SetupDiag is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. - -SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10. SetupDiag can be run on the computer that failed to update, or you can export logs from the computer to another location and run SetupDiag in offline mode. - -To quickly use SetupDiag on your current computer: -1. Verify that your system meets the [requirements](#requirements) described below. If needed, install the [.NET framework 4.6](https://www.microsoft.com/download/details.aspx?id=48137). -2. [Download SetupDiag](https://go.microsoft.com/fwlink/?linkid=870142). -3. If your web browser asks what to do with the file, choose **Save**. By default, the file will be saved to your **Downloads** folder. You can also save it to a different location if desired by using **Save As**. -4. When SetupDiag has finished downloading, open the folder where you downloaded the file. As mentioned above, by default this is your **Downloads** folder which is displayed in File Explorer under **Quick access** in the left navigation pane. -5. Double-click the **SetupDiag** file to run it. Click **Yes** if you are asked to approve running the program. - - Double-clicking the file to run it will automatically close the command window when SetupDiag has completed its analysis. If you wish to keep this window open instead, and review the messages that you see, run the program by typing **SetupDiag** at the command prompt instead of double-clicking it. You will need to change directories to the location of SetupDiag to run it this way. -6. A command window will open while SetupDiag diagnoses your computer. Wait for this to finish. -7. When SetupDiag finishes, two files will be created in the same folder where you double-clicked SetupDiag. One is a configuration file, the other is a log file. -8. Use Notepad to open the log file: **SetupDiagResults.log**. -9. Review the information that is displayed. If a rule was matched this can tell you why the computer failed to upgrade, and potentially how to fix the problem. See the [Text log sample](#text-log-sample) below. - -For instructions on how to run the tool in offline mode and with more advanced options, see the [Parameters](#parameters) and [Examples](#examples) sections below. - -The [Release notes](#release-notes) section at the bottom of this topic has information about recent updates to this tool. - -## Requirements - -1. The destination OS must be Windows 10. -2. [.NET Framework 4.6](https://www.microsoft.com/download/details.aspx?id=48137) must be installed. If you are not sure what version of .NET is currently installed, see [How to: Determine Which .NET Framework Versions Are Installed](https://docs.microsoft.com/dotnet/framework/migration-guide/how-to-determine-which-versions-are-installed). You can also use the following command-line query to display the installed v4 versions: - - ``` - reg query "HKLM\SOFTWARE\Microsoft\Net Framework Setup\NDP\v4" /s - ``` - -## Parameters - -| Parameter | Description | -| --- | --- | -| /? |
                        • Displays interactive help
                        | -| /Output:\ |
                        • This optional parameter enables you to specify the output file for results. This is where you will find what SetupDiag was able to determine. Only text format output is supported. UNC paths will work, provided the context under which SetupDiag runs has access to the UNC path. If the path has a space in it, you must enclose the entire path in double quotes (see the example section below).
                        • Default: If not specified, SetupDiag will create the file **SetupDiagResults.log** in the same directory where SetupDiag.exe is run.
                        | -| /LogsPath:\ |
                        • This optional parameter tells SetupDiag.exe where to find the log files for an offline analysis. These log files can be in a flat folder format, or containing multiple subdirectories. SetupDiag will recursively search all child directories.
                        | -| /ZipLogs:\ |
                        • This optional parameter tells SetupDiag.exe to create a zip file containing the results and all the log files it parsed. The zip file is created in the same directory where SetupDiag.exe is run.
                        • Default: If not specified, a value of 'true' is used.
                        | -| /Format:\ |
                        • This optional parameter can be used to output log files in xml or JSON format. If this parameter is not specified, text format is used by default.
                        | -| /Scenario:\[Recovery\] |
                        • This optional parameter instructs SetupDiag.exe to look for and process reset and recovery logs and ignore setup/upgrade logs.
                        | -| /Verbose |
                        • This optional parameter will output much more data to a log file. By default, SetupDiag will only produce a log file entry for serious errors. Using **/Verbose** will cause SetupDiag to always produce an additional log file with debugging details. These details can be useful when reporting a problem with SetupDiag.
                        | -| /NoTel |
                        • This optional parameter tells SetupDiag.exe not to send diagnostic telemetry to Microsoft.
                        | -| /AddReg |
                        • This optional parameter instructs SetupDiag.exe to add failure information to the registry in offline mode. By default, SetupDiag will add failure information to the registry in online mode only. Registry data is added to the following location on the system where SetupDiag is run: **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag**.
                        | - -Note: The **/Mode** parameter is deprecated in version 1.4.0.0 of SetupDiag. -- In previous versions, this command was used with the LogsPath parameter to specify that SetupDiag should run in an offline manner to analyze a set of log files that were captured from a different computer. In version 1.4.0.0 when you specify /LogsPath then SetupDiag will automatically run in offline mode, therefore the /Mode parameter is not needed. - -### Examples: - -In the following example, SetupDiag is run with default parameters (online mode, results file is SetupDiagResults.log in the same folder where SetupDiag is run). - -``` -SetupDiag.exe -``` - -In the following example, SetupDiag is run in online mode (this is the default). It will know where to look for logs on the current (failing) system, so there is no need to gather logs ahead of time. A custom location for results is specified. - -``` -SetupDiag.exe /Output:C:\SetupDiag\Results.log -``` - -The following example uses the /Output parameter to save results to a path name that contains a space: - -``` -SetupDiag /Output:"C:\Tools\SetupDiag\SetupDiag Results\Results.log" -``` - -The following example specifies that SetupDiag is to run in offline mode, and to process the log files found in **D:\Temp\Logs\LogSet1**. - -``` -SetupDiag.exe /Output:C:\SetupDiag\Results.log /LogsPath:D:\Temp\Logs\LogSet1 -``` - -The following example sets recovery scenario in offline mode. In the example, SetupDiag will search for reset/recovery logs in the specified LogsPath location and output the resuts to the directory specified by the /Output parameter. - -``` -SetupDiag.exe /Output:C:\SetupDiag\RecoveryResults.log /LogsPath:D:\Temp\Cabs\PBR_Log /Scenario:Recovery -``` - -The following example sets recovery scenario in online mode. In the example, SetupDiag will search for reset/recovery logs on the current system and output results in XML format. - -``` -SetupDiag.exe /Scenario:Recovery /Format:xml -``` - - -## Log files - -[Windows Setup Log Files and Event Logs](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-log-files-and-event-logs) has information about where logs are created during Windows Setup. For offline processing, you should run SetupDiag against the contents of the entire folder. For example, depending on when the upgrade failed, copy one of the following folders to your offline location: - -\\$Windows.~bt\sources\panther -
                        \\$Windows.~bt\Sources\Rollback -
                        \Windows\Panther -
                        \Windows\Panther\NewOS - -If you copy the parent folder and all sub-folders, SetupDiag will automatically search for log files in all subdirectories. - -## Setup bug check analysis - -When Microsoft Windows encounters a condition that compromises safe system operation, the system halts. This condition is called a bug check. It is also commonly referred to as a system crash, a kernel error, a Stop error, or BSOD. Typically a hardware device, hardware driver, or related software causes this error. - -If crash dumps [are enabled](https://docs.microsoft.com/windows-hardware/drivers/debugger/enabling-a-kernel-mode-dump-file) on the system, a crash dump file is created. If the bug check occurs during an upgrade, Windows Setup will extract a minidump (setupmem.dmp) file. SetupDiag can also debug these setup related minidumps. - -To debug a setup related bug check, you must: -- Specify the **/LogsPath** parameter. You cannot debug memory dumps in online mode. -- Gather the setup memory dump file (setupmem.dmp) from the failing system. - - Setupmem.dmp will be created in either **%SystemDrive%\$Windows.~bt\Sources\Rollback**, or in **%WinDir%\Panther\NewOS\Rollback** depending on when the bug check occurs. -- Install the [Windows Debugging Tools](https://docs.microsoft.com/windows-hardware/drivers/debugger/debugger-download-tools) on the computer that runs SetupDiag. - -In the following example, the **setupmem.dmp** file is copied to the **D:\Dump** directory and the Windows Debugging Tools are installed prior to running SetupDiag: - -``` -SetupDiag.exe /Output:C:\SetupDiag\Dumpdebug.log /LogsPath:D:\Dump -``` - -## Known issues - -1. Some rules can take a long time to process if the log files involved are large. -2. If the failing computer is opted into the Insider program and getting regular pre-release updates, or an update is already pending on the computer when SetupDiag is run, it can encounter problems trying to open these log files. This will likely cause a failure to determine a root cause. In this case, try gathering the log files and running SetupDiag in offline mode. - - -## Sample output - -The following is an example where SetupDiag is run in offline mode. - -``` -D:\SetupDiag>SetupDiag.exe /output:c:\setupdiag\result.xml /logspath:D:\Tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e /format:xml - -SetupDiag v1.5.0.0 -Copyright (c) Microsoft Corporation. All rights reserved. - -Searching for setup logs... -Found d:\tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e\setupact_6.log with update date 6/12/2019 2:44:20 PM to be the correct setup log. -Found d:\tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e\setupact_1.log with update date 6/12/2019 2:45:19 PM to be the correct rollback log. - -Gathering baseline information from setup logs... - -SetupDiag: processing rule: CompatScanOnly. -...No match. - -... - -SetupDiag: processing rule: DISMImageSessionFailure. -.. -Error: SetupDiag reports DISM provider failure. -Last Phase: Safe OS -Last Operation: Apply Optional Component status -Message = Failed to get the IDismImage instance from the image session -Function: CDISMManager::CloseImageSession -Error: 0x800706ba -Recommend you re-download the update source files, reboot and try the update again. - -SetupDiag found 1 matching issue. - -SetupDiag results were logged to: c:\setupdiag\results.xml -Logs ZipFile created at: c:\setupdiag\Logs_14.zip - -``` - -## Rules - -When searching log files, SetupDiag uses a set of rules to match known issues. These rules are contained in the rules.xml file which is extracted when SetupDiag is run. The rules.xml file might be updated as new versions of SetupDiag are made available. See [Release notes](#release-notes) for more information. - -Each rule name and its associated unique rule identifier are listed with a description of the known upgrade-blocking issue. In the rule descriptions, the term "down-level" refers to the first phase of the upgrade process, which runs under the starting OS. - -1. CompatScanOnly - FFDAFD37-DB75-498A-A893-472D49A1311D - - This rule indicates that setup.exe was called with a specific command line parameter that indicated setup was to do a compat scan only, not an upgrade. -2. BitLockerHardblock - C30152E2-938E-44B8-915B-D1181BA635AE - - This is a block when the target OS does not support BitLocker, yet the host OS has BitLocker enabled. -3. VHDHardblock - D9ED1B82-4ED8-4DFD-8EC0-BE69048978CC - - This block happens when the host OS is booted to a VHD image. Upgrade is not supported when the host OS is booted from a VHD image. -4. PortableWorkspaceHardblock - 5B0D3AB4-212A-4CE4-BDB9-37CA404BB280 - - This indicates that the host OS is booted from a Windows To-Go device (USB key). Upgrade is not supported in the Windows To-Go environment. -5. AuditModeHardblock - A03BD71B-487B-4ACA-83A0-735B0F3F1A90 - - This block indicates that the host OS is currently booted into Audit Mode, a special mode for modifying the Windows state. Upgrade is not supported from this state. -6. SafeModeHardblock - 404D9523-B7A8-4203-90AF-5FBB05B6579B - - This block indicates that the host OS is booted to Safe Mode, where upgrade is not supported. -7. InsufficientSystemPartitionDiskSpaceHardblock - 3789FBF8-E177-437D-B1E3-D38B4C4269D1 - - This block is encountered when setup determines the system partition (where the boot loader files are stored) does not have enough space to be serviced with the newer boot files required during the upgrade process. -8. CompatBlockedApplicationAutoUninstall – BEBA5BC6-6150-413E-8ACE-5E1EC8D34DD5 - - This rule indicates there is an application that needs to be uninstalled before setup can continue. -9. CompatBlockedApplicationDismissable - EA52620B-E6A0-4BBC-882E-0686605736D9 - - When running setup in /quiet mode, there are dismissible application messages that turn into blocks unless the command line also specifies “/compat /ignore warning”. This rule indicates setup was executed in /quiet mode but there is an application dismissible block message that have prevented setup from continuing. -10. CompatBlockedApplicationManualUninstall - 9E912E5F-25A5-4FC0-BEC1-CA0EA5432FF4 - - This rule indicates that an application without an Add/Remove Programs entry, is present on the system and blocking setup from continuing. This typically requires manual removal of the files associated with this application to continue. -11. HardblockDeviceOrDriver - ED3AEFA1-F3E2-4F33-8A21-184ADF215B1B - - This indicates a device driver that is loaded on the host OS is not compatible with the newer OS version and needs to be removed prior to the upgrade. -12. HardblockMismatchedLanguage - 60BA8449-CF23-4D92-A108-D6FCEFB95B45 - - This rule indicates the host OS and the target OS language editions do not match. -13. HardblockFlightSigning - 598F2802-3E7F-4697-BD18-7A6371C8B2F8 - - This rule indicates the target OS is a pre-release, Windows Insider build, and the target machine has Secure Boot enabled. This will block the pre-release signed build from booting if installed on the machine. -14. DiskSpaceBlockInDownLevel - 6080AFAC-892E-4903-94EA-7A17E69E549E - - This failure indicates the system ran out of disk space during the down-level operations of upgrade. -15. DiskSpaceFailure - 981DCBA5-B8D0-4BA7-A8AB-4030F7A10191 - - This failure indicates the system drive ran out of available disk space at some point after the first reboot into the upgrade. -16. DeviceInstallHang - 37BB1C3A-4D79-40E8-A556-FDA126D40BC6 - - This failure rule indicates the system hung or bug checked during the device installation phase of upgrade. -17. DebugSetupMemoryDump - C7C63D8A-C5F6-4255-8031-74597773C3C6 - - This offline only rule indicates a bug check occurred during setup. If the debugger tools are available on the system, SetupDiag will debug the memory dump and provide details. -18. DebugSetupCrash - CEEBA202-6F04-4BC3-84B8-7B99AED924B1 - - This offline only rule indicates that setup itself encountered a failure that resulted in a process memory dump. If the debugger tools are installed on the system, SetupDiag will debug the memory dump and give further details. -19. DebugMemoryDump - 505ED489-329A-43F5-B467-FCAAF6A1264C - - This offline only rule is for any memory.dmp file that resulted during the setup/upgrade operation. If the debugger tools are installed on the system, SetupDiag will debug the memory dump and give further details. -20. BootFailureDetected - 4FB446C2-D4EC-40B4-97E2-67EB19D1CFB7 - - This rule indicates a boot failure occurred during a specific phase of the update. The rule will indicate the failure code and phase for diagnostic purposes. -21. FindDebugInfoFromRollbackLog - 9600EB68-1120-4A87-9FE9-3A4A70ACFC37 - - This rule will determine and give details when a bug check occurs during the setup/upgrade process that resulted in a memory dump, but without the requirement of the debugger package being on the executing machine. -22. AdvancedInstallerFailed - 77D36C96-32BE-42A2-BB9C-AAFFE64FCADC - - Finds fatal advanced installer operations that cause setup failures. -23. FindMigApplyUnitFailure - A4232E11-4043-4A37-9BF4-5901C46FD781 - - Detects a migration unit failure that caused the update to fail. This rule will output the name of the migration plug-in as well as the error code it produced for diagnostic purposes. -24. FindMigGatherUnitFailure - D04C064B-CD77-4E64-96D6-D26F30B4EE29 - - Detects a migration gather unit failure that caused the update to fail. This rule will output the name of the gather unit/plug-in as well as the error code it produced for diagnostic purposes. -25. CriticalSafeOSDUFailure - 73566DF2-CA26-4073-B34C-C9BC70DBF043 - - This rule indicates a failure occurred while updating the SafeOS image with a critical dynamic update. It will indicate the phase and error code that occurred while attempting to update the SafeOS image for diagnostic purposes. -26. UserProfileCreationFailureDuringOnlineApply - 678117CE-F6A9-40C5-BC9F-A22575C78B14 - - Indicates there was a critical failure while creating or modifying a User Profile during the online apply phase of the update. It will indicate the operation and error code associated with the failure for diagnostic purposes. -27. WimMountFailure - BE6DF2F1-19A6-48C6-AEF8-D3B0CE3D4549 - - This rule indicates the update failed to mount a wim file. It will show the name of the wim file as well as the error message and error code associated with the failure for diagnostic purposes. -28. FindSuccessfulUpgrade - 8A0824C8-A56D-4C55-95A0-22751AB62F3E - - Determines if the given setup was a success or not based off the logs. -29. FindSetupHostReportedFailure - 6253C04F-2E4E-4F7A-B88E-95A69702F7EC - - Gives information about failures surfaced early in the upgrade process by setuphost.exe -30. FindDownlevelFailure - 716334B7-F46A-4BAA-94F2-3E31BC9EFA55 - - Gives failure information surfaced by SetupPlatform, later in the down-level phase. -31. FindAbruptDownlevelFailure - 55882B1A-DA3E-408A-9076-23B22A0472BD - - Gives last operation failure information when the system fails in the down-level, but the log just ends abruptly. -32. FindSetupPlatformFailedOperationInfo - 307A0133-F06B-4B75-AEA8-116C3B53C2D1 - - Gives last phase and error information when SetupPlatform indicates a critical failure. This rule will indicate the operation and error associated with the failure for diagnostic purposes. -33. FindRollbackFailure - 3A43C9B5-05B3-4F7C-A955-88F991BB5A48 - - Gives last operation, failure phase and error information when a rollback occurs. -34. AdvancedInstallerGenericFailure – 4019550D-4CAA-45B0-A222-349C48E86F71 - - A rule to match AdvancedInstaller read/write failures in a generic sense. Will output the executable being called as well as the error code and exit code reported. -35. OptionalComponentFailedToGetOCsFromPackage – D012E2A2-99D8-4A8C-BBB2-088B92083D78 (NOTE: This rule replaces the OptionalComponentInstallFailure rule present in v1.10. - - This matches a specific Optional Component failure when attempting to enumerate components in a package. Will output the package name and error code. -36. OptionalComponentOpenPackageFailed – 22952520-EC89-4FBD-94E0-B67DF88347F6 - - Matches a specific Optional Component failure when attempting to open an OC package. Will output the package name and error code. -37. OptionalComponentInitCBSSessionFailed – 63340812-9252-45F3-A0F2-B2A4CA5E9317 - - Matches a specific failure where the advanced installer service or components aren’t operating or started on the system. Will output the error code. -38. UserProfileCreationFailureDuringFinalize – C6677BA6-2E53-4A88-B528-336D15ED1A64 - - Matches a specific User Profile creation error during the finalize phase of setup. Will output the failure code. -39. WimApplyExtractFailure – 746879E9-C9C5-488C-8D4B-0C811FF3A9A8 - - Matches a wim apply failure during wim extraction phases of setup. Will output the extension, path and error code. -40. UpdateAgentExpanderFailure – 66E496B3-7D19-47FA-B19B-4040B9FD17E2 - - Matches DPX expander failures in the down-level phase of update from WU. Will output the package name, function, expression and error code. -41. FindFatalPluginFailure – E48E3F1C-26F6-4AFB-859B-BF637DA49636 - - Matches any plug-in failure that setupplatform decides is fatal to setup. Will output the plugin name, operation and error code. -42. AdvancedInstallerFailed - 77D36C96-32BE-42A2-BB9C-AAFFE64FCADC - - Indicates critical failure in the AdvancedInstaller while running an installer package, includes the .exe being called, the phase, mode, component and error codes. -43. MigrationAbortedDueToPluginFailure - D07A24F6-5B25-474E-B516-A730085940C9 - - Indicates a critical failure in a migration plugin that causes setup to abort the migration. Will provide the setup operation, plug-in name, plug-in action and error code. -44. DISMAddPackageFailed - 6196FF5B-E69E-4117-9EC6-9C1EAB20A3B9 - - Indicates a critical failure during a DISM add package operation. Will specify the Package Name, DISM error and add package error code. -45. PlugInComplianceBlock - D912150B-1302-4860-91B5-527907D08960 - - Detects all compat blocks from Server compliance plug-ins. Outputs the block information and remediation. -46. AdvancedInstallerGenericFailure - 4019550D-4CAA-45B0-A222-349C48E86F71 - - Triggers on advanced installer failures in a generic sense, outputting the application called, phase, mode, component and error code. -47. FindMigGatherApplyFailure - A9964E6C-A2A8-45FF-B6B5-25E0BD71428E - - Shows errors when the migration Engine fails out on a gather or apply operation. Indicates the Migration Object (file or registry path), the Migration -48. OptionalComponentFailedToGetOCsFromPackage - D012E2A2-99D8-4A8C-BBB2-088B92083D78 - - Indicates the optional component (OC) migration operation failed to enumerate optional components from an OC Package. Outputs the package name and error code. -49. OptionalComponentOpenPackageFailed - 22952520-EC89-4FBD-94E0-B67DF88347F6 - - Indicates the optional component migration operation failed to open an optional component Package. Outputs the package name and error code. -50. OptionalComponentInitCBSSessionFailed - 63340812-9252-45F3-A0F2-B2A4CA5E9317 - - Indicates corruption in the servicing stack on the down-level system. Outputs the error code encountered while trying to initialize the servicing component on the existing OS. -51. DISMproviderFailure - D76EF86F-B3F8-433F-9EBF-B4411F8141F4 - - Triggers when a DISM provider (plug-in) fails in a critical operation. Outputs the file (plug-in name), function called + error code, and error message from the provider. -52. SysPrepLaunchModuleFailure - 7905655C-F295-45F7-8873-81D6F9149BFD - - Indicates a sysPrep plug-in has failed in a critical operation. Indicates the plug-in name, operation name and error code. -53. UserProvidedDriverInjectionFailure - 2247C48A-7EE3-4037-AFAB-95B92DE1D980 - - A driver provided to setup (via command line input) has failed in some way. Outputs the driver install function and error code. -54. PlugInComplianceBlock - D912150B-1302-4860-91B5-527907D08960 - - These are for server upgrades only, will output the compliance block and remediation required. -55. PreReleaseWimMountDriverFound - 31EC76CC-27EC-4ADC-9869-66AABEDB56F0 - - Captures failures due to having an unrecognized wimmount.sys driver registered on the system. -56. WinSetupBootFilterFailure - C073BFC8-5810-4E19-B53B-4280B79E096C - - Detects failures in the kernel mode file operations. -57. WimMountDriverIssue - 565B60DD-5403-4797-AE3E-BC5CB972FBAE - - Detects failures in WimMount.sys registration on the system. -58. DISMImageSessionFailure - 61B7886B-10CD-4C98-A299-B987CB24A11C - - Captures failure information when DISM fails to start an image session successfully. -59. FindEarlyDownlevelError - A4CE4FC9-5E10-4BB1-8ECE-3B29EB9D7C52 - - Detects failures in down-level phase before setup platform is invoked. -60. FindSPFatalError - A4028172-1B09-48F8-AD3B-86CDD7D55852 - - Captures failure information when setup platform encounters a fatal error. - - -## Release notes - -06/19/2019 - SetupDiag v1.5.0.0 is released with 60 rules, as a standalone tool available from the Download Center. - - All date and time outputs are updated to localized format per user request. - - Added setup Operation and Phase information to /verbose log. - - Added last Setup Operation and last Setup Phase information to most rules where it make sense (see new output below). - - Performance improvement in searching setupact.logs to determine correct log to parse. - - Added SetupDiag version number to text report (xml and json always had it). - - Added "no match" reports for xml and json per user request. - - Formatted Json output for easy readability. - - Performance improvements when searching for setup logs; this should be much faster now. - - Added 7 new rules: PlugInComplianceBlock, PreReleaseWimMountDriverFound, WinSetupBootFilterFailure, WimMountDriverIssue, DISMImageSessionFailure, FindEarlyDownlevelError, and FindSPFatalError. See the [Rules](#rules) section above for more information. - - Diagnostic information is now output to the registry at **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag** - - The **/AddReg** command was added to toggle registry output. This setting is off by default for offline mode, and on by default for online mode. The command has no effect for online mode and enables registry output for offline mode. - - This registry key is deleted as soon as SetupDiag is run a second time, and replaced with current data, so it’s always up to date. - - This registry key also gets deleted when a new update instance is invoked. - - For an example, see [Sample registry key](#sample-registry-key). - -05/17/2019 - SetupDiag v1.4.1.0 is released with 53 rules, as a standalone tool available from the Download Center. - - This release dds the ability to find and diagnose reset and recovery failures (Push Button Reset). - -12/18/2018 - SetupDiag v1.4.0.0 is released with 53 rules, as a standalone tool available from the Download Center. - - This release includes major improvements in rule processing performance: ~3x faster rule processing performance! - - The FindDownlevelFailure rule is up to 10x faster. - - New rules have been added to analyze failures upgrading to Windows 10 version 1809. - - A new help link is available for resolving servicing stack failures on the down-level OS when the rule match indicates this type of failure. - - Removed the need to specify /Mode parameter. Now if you specify /LogsPath, it automatically assumes offline mode. - - Some functional and output improvements were made for several rules. - -07/16/2018 - SetupDiag v1.3.1 is released with 44 rules, as a standalone tool available from the Download Center. - - This release fixes a problem that can occur when running SetupDiag in online mode on a computer that produces a setupmem.dmp file, but does not have debugger binaries installed. - -07/10/2018 - SetupDiag v1.30 is released with 44 rules, as a standalone tool available from the Download Center. - - Bug fix for an over-matched plug-in rule. The rule will now correctly match only critical (setup failure) plug-in issues. - - New feature: Ability to output logs in JSON and XML format. - - Use "/Format:xml" or "/Format:json" command line parameters to specify the new output format. See [sample logs](#sample-logs) at the bottom of this topic. - - If the “/Format:xml” or “/Format:json” parameter is omitted, the log output format will default to text. - - New Feature: Where possible, specific instructions are now provided in rule output to repair the identified error. For example, instructions are provided to remediate known blocking issues such as uninstalling an incompatible app or freeing up space on the system drive. - - 3 new rules added: AdvancedInstallerFailed, MigrationAbortedDueToPluginFailure, DISMAddPackageFailed. - -05/30/2018 - SetupDiag v1.20 is released with 41 rules, as a standalone tool available from the Download Center. - - Fixed a bug in device install failure detection in online mode. - - Changed SetupDiag to work without an instance of setupact.log. Previously, SetupDiag required at least one setupact.log to operate. This change enables the tool to analyze update failures that occur prior to calling SetupHost. - - Telemetry is refactored to only send the rule name and GUID (or “NoRuleMatched” if no rule is matched) and the Setup360 ReportId. This change assures data privacy during rule processing. - -05/02/2018 - SetupDiag v1.10 is released with 34 rules, as a standalone tool available from the Download Center. - - A performance enhancment has been added to result in faster rule processing. - - Rules output now includes links to support articles, if applicable. - - SetupDiag now provides the path and name of files that it is processing. - - You can now run SetupDiag by simply clicking on it and then examining the output log file. - - An output log file is now always created, whether or not a rule was matched. - -03/30/2018 - SetupDiag v1.00 is released with 26 rules, as a standalone tool available from the Download Center. - -## Sample logs - -### Text log sample - -``` -Matching Profile found: OptionalComponentOpenPackageFailed - 22952520-EC89-4FBD-94E0-B67DF88347F6 -System Information: - Machine Name = Offline - Manufacturer = MSI - Model = MS-7998 - HostOSArchitecture = x64 - FirmwareType = PCAT - BiosReleaseDate = 20160727000000.000000+000 - BiosVendor = BIOS Date: 07/27/16 10:01:46 Ver: V1.70 - BiosVersion = 1.70 - HostOSVersion = 10.0.15063 - HostOSBuildString = 15063.0.amd64fre.rs2_release.170317-1834 - TargetOSBuildString = 10.0.16299.15 (rs3_release.170928-1534) - HostOSLanguageId = 2057 - HostOSEdition = Core - RegisteredAV = Windows Defender, - FilterDrivers = WdFilter,wcifs,WIMMount,luafv,Wof,FileInfo, - UpgradeStartTime = 3/21/2018 9:47:16 PM - UpgradeEndTime = 3/21/2018 10:02:40 PM - UpgradeElapsedTime = 00:15:24 - ReportId = dd4db176-4e3f-4451-aef6-22cf46de8bde - -Error: SetupDiag reports Optional Component installation failed to open OC Package. Package Name: Foundation, Error: 0x8007001F -Recommend you check the "Windows Modules Installer" service (Trusted Installer) is started on the system and set to automatic start, reboot and try the update again. Optionally, you can check the status of optional components on the system (search for Windows Features), uninstall any unneeded optional components, reboot and try the update again. -Error: SetupDiag reports down-level failure, Operation: Finalize, Error: 0x8007001F - 0x50015 -Refer to https://docs.microsoft.com/windows/deployment/upgrade/upgrade-error-codes for error information. -``` - -### XML log sample - -```xml - - - 1.5.0.0 - FindSPFatalError - A4028172-1B09-48F8-AD3B-86CDD7D55852 - - Offline - Gigabyte Technology Co., Ltd. - X470 AORUS ULTRA GAMING - 1033 - UEFI - 20180808000000.000000+000 - F3 - - 10.0.18908 - 18908.1000.amd64fre.rs_prerelease.190524-1658 - 10.0.18912.1001 (rs_prerelease.190601-1739) - - Professional - Windows Defender - - 2019-06-06T21:19:10 - - 2019-06-06T22:21:49 - 0001-01-01T00:00:00 - 0001-01-01T00:00:00 - - 0001-01-01T00:00:00 - 0001-01-01T00:00:00 - - Offline - MgUweCZk90KdwUiZ - F21F8FB6-00FD-4349-84FB-2AC75F389E73 - F21F8FB6-00FD-4349-84FB-2AC75F389E73 - - 2019-06-06 21:47:11, Error SP Error converting install time 5/2/2019 to structure[gle=0x00000057] - -Error: SetupDiag reports Fatal Error. -Last Setup Phase = Downlevel -Last Setup Operation: Gather data, scope: EVERYTHING -Error: 0x00000057 - LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5/2/2019 to structure[gle=0x00000057] - LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5/2/2019 to structure[gle=0x00000057] - -Refer to "https://docs.microsoft.com/windows/desktop/Debug/system-error-codes" for error information. - Err = 0x00000057, LastOperation = Gather data, scope: EVERYTHING, LastPhase = Downlevel - -``` - -### JSON log sample - -``` -{ - "Version":"1.5.0.0", - "ProfileName":"FindSPFatalError", - "ProfileGuid":"A4028172-1B09-48F8-AD3B-86CDD7D55852", - "SystemInfo":{ - "BiosReleaseDate":"20180808000000.000000+000", - "BiosVendor":"F3", - "BiosVersion":"F3", - "CV":"MgUweCZk90KdwUiZ", - "CommercialId":"Offline", - "FilterDrivers":"", - "FinalizeStartTime":"\/Date(-62135568000000-0800)\/", - "FirmwareType":"UEFI", - "HostOSArchitecture":"x64", - "HostOSBuildString":"18908.1000.amd64fre.rs_prerelease.190524-1658", - "HostOSEdition":"Professional", - "HostOSLanguageId":"", - "HostOSVersion":"", - "MachineName":"Offline", - "Manufacturer":"Gigabyte Technology Co., Ltd.", - "Model":"X470 AORUS ULTRA GAMING", - "PostOOBESuccessTime":"\/Date(-62135568000000-0800)\/", - "RegisteredAV":"Windows Defender", - "ReportId":"F21F8FB6-00FD-4349-84FB-2AC75F389E73", - "RollbackElapsedTime":"PT0S", - "RollbackEndTime":"\/Date(-62135568000000-0800)\/", - "RollbackStartTime":"\/Date(-62135568000000-0800)\/", - "SetupReportId":"F21F8FB6-00FD-4349-84FB-2AC75F389E73", - "TargetOSArchitecture":null, - "TargetOSBuildString":"10.0.18912.1001 (rs_prerelease.190601-1739)", - "TotalOfflineTime":"PT0S", - "UpgradeElapsedTime":"PT1H2M39S", - "UpgradeEndTime":"\/Date(1559884909000-0700)\/", - "UpgradeStartTime":"\/Date(1559881150000-0700)\/" - }, - "LogErrorLine":"2019-06-06 21:47:11, Error SP Error converting install time 5\/2\/2019 to structure[ - gle=0x00000057 - ]", - "FailureData":[ - "\u000aError: SetupDiag reports Fatal Error.\u000aLast Setup Phase = Downlevel\u000aLast Setup Operation: Gather data, scope: EVERYTHING\u000aError: 0x00000057", - "LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5\/2\/2019 to structure[ - gle=0x00000057 - ]", - "LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5\/2\/2019 to structure[ - gle=0x00000057 - ]", - "\u000aRefer to \"https:\/\/docs.microsoft.com\/en-us\/windows\/desktop\/Debug\/system-error-codes\" for error information." - ], - "FailureDetails":"Err = 0x00000057, LastOperation = Gather data, scope: EVERYTHING, LastPhase = Downlevel", - "DeviceDriverInfo":null, - "Remediation":[ - - ], - "SetupPhaseInfo":null, - "SetupOperationInfo":null -} -``` - -## Sample registry key - -![Addreg](./../images/addreg.png) - -## Related topics - -[Resolve Windows 10 upgrade errors: Technical information for IT Pros](https://docs.microsoft.com/windows/deployment/upgrade/resolve-windows-10-upgrade-errors) +--- +title: SetupDiag +ms.reviewer: +manager: laurawi +ms.author: greglin +description: How to use the SetupDiag tool to diagnose Windows Setup errors +keywords: deploy, troubleshoot, windows, 10, upgrade, update, setup, diagnose +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# SetupDiag + +**Applies to** +- Windows 10 + +>[!NOTE] +>This is a 300 level topic (moderate advanced).
                        +>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article.
                        + + [![Download SetupDiag](../images/download.png)](https://go.microsoft.com/fwlink/?linkid=870142) + +## About SetupDiag + +Current version of SetupDiag: 1.6.0.42 +>Always be sure to run the most recent version of SetupDiag, so that can access new functionality and fixes to known issues. + +SetupDiag is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. + +SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10. SetupDiag can be run on the computer that failed to update, or you can export logs from the computer to another location and run SetupDiag in offline mode. + +To quickly use SetupDiag on your current computer: +1. Verify that your system meets the [requirements](#requirements) described below. If needed, install the [.NET framework 4.6](https://www.microsoft.com/download/details.aspx?id=48137). +2. [Download SetupDiag](https://go.microsoft.com/fwlink/?linkid=870142). +3. If your web browser asks what to do with the file, choose **Save**. By default, the file will be saved to your **Downloads** folder. You can also save it to a different location if desired by using **Save As**. +4. When SetupDiag has finished downloading, open the folder where you downloaded the file. As mentioned above, by default this is your **Downloads** folder which is displayed in File Explorer under **Quick access** in the left navigation pane. +5. Double-click the **SetupDiag** file to run it. Click **Yes** if you are asked to approve running the program. + - Double-clicking the file to run it will automatically close the command window when SetupDiag has completed its analysis. If you wish to keep this window open instead, and review the messages that you see, run the program by typing **SetupDiag** at the command prompt instead of double-clicking it. You will need to change directories to the location of SetupDiag to run it this way. +6. A command window will open while SetupDiag diagnoses your computer. Wait for this to finish. +7. When SetupDiag finishes, two files will be created in the same folder where you double-clicked SetupDiag. One is a configuration file, the other is a log file. +8. Use Notepad to open the log file: **SetupDiagResults.log**. +9. Review the information that is displayed. If a rule was matched this can tell you why the computer failed to upgrade, and potentially how to fix the problem. See the [Text log sample](#text-log-sample) below. + +For instructions on how to run the tool in offline mode and with more advanced options, see the [Parameters](#parameters) and [Examples](#examples) sections below. + +The [Release notes](#release-notes) section at the bottom of this topic has information about recent updates to this tool. + +## Requirements + +1. The destination OS must be Windows 10. +2. [.NET Framework 4.6](https://www.microsoft.com/download/details.aspx?id=48137) must be installed. If you are not sure what version of .NET is currently installed, see [How to: Determine Which .NET Framework Versions Are Installed](https://docs.microsoft.com/dotnet/framework/migration-guide/how-to-determine-which-versions-are-installed). You can also use the following command-line query to display the installed v4 versions: + + ``` + reg query "HKLM\SOFTWARE\Microsoft\Net Framework Setup\NDP\v4" /s + ``` + +## Parameters + +| Parameter | Description | +| --- | --- | +| /? |
                        • Displays interactive help
                        | +| /Output:\ |
                        • This optional parameter enables you to specify the output file for results. This is where you will find what SetupDiag was able to determine. Only text format output is supported. UNC paths will work, provided the context under which SetupDiag runs has access to the UNC path. If the path has a space in it, you must enclose the entire path in double quotes (see the example section below).
                        • Default: If not specified, SetupDiag will create the file **SetupDiagResults.log** in the same directory where SetupDiag.exe is run.
                        | +| /LogsPath:\ |
                        • This optional parameter tells SetupDiag.exe where to find the log files for an offline analysis. These log files can be in a flat folder format, or containing multiple subdirectories. SetupDiag will recursively search all child directories.
                        | +| /ZipLogs:\ |
                        • This optional parameter tells SetupDiag.exe to create a zip file containing the results and all the log files it parsed. The zip file is created in the same directory where SetupDiag.exe is run.
                        • Default: If not specified, a value of 'true' is used.
                        | +| /Format:\ |
                        • This optional parameter can be used to output log files in xml or JSON format. If this parameter is not specified, text format is used by default.
                        | +| /Scenario:\[Recovery\] |
                        • This optional parameter instructs SetupDiag.exe to look for and process reset and recovery logs and ignore setup/upgrade logs.
                        | +| /Verbose |
                        • This optional parameter will output much more data to a log file. By default, SetupDiag will only produce a log file entry for serious errors. Using **/Verbose** will cause SetupDiag to always produce an additional log file with debugging details. These details can be useful when reporting a problem with SetupDiag.
                        | +| /NoTel |
                        • This optional parameter tells SetupDiag.exe not to send diagnostic telemetry to Microsoft.
                        | +| /AddReg |
                        • This optional parameter instructs SetupDiag.exe to add failure information to the registry in offline mode. By default, SetupDiag will add failure information to the registry in online mode only. Registry data is added to the following location on the system where SetupDiag is run: **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag**.
                        | +| /RegPath |
                        • This optional parameter instructs SetupDiag.exe to add failure information to the registry using the specified path. If this parameter is not specified the default path is **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag**. +
                        | + +Note: The **/Mode** parameter is deprecated in version 1.4.0.0 of SetupDiag. +- In previous versions, this command was used with the LogsPath parameter to specify that SetupDiag should run in an offline manner to analyze a set of log files that were captured from a different computer. In version 1.4.0.0 when you specify /LogsPath then SetupDiag will automatically run in offline mode, therefore the /Mode parameter is not needed. + +### Examples: + +In the following example, SetupDiag is run with default parameters (online mode, results file is SetupDiagResults.log in the same folder where SetupDiag is run). + +``` +SetupDiag.exe +``` + +In the following example, SetupDiag is run in online mode (this is the default). It will know where to look for logs on the current (failing) system, so there is no need to gather logs ahead of time. A custom location for results is specified. + +``` +SetupDiag.exe /Output:C:\SetupDiag\Results.log +``` + +The following example uses the /Output parameter to save results to a path name that contains a space: + +``` +SetupDiag /Output:"C:\Tools\SetupDiag\SetupDiag Results\Results.log" +``` + +The following example specifies that SetupDiag is to run in offline mode, and to process the log files found in **D:\Temp\Logs\LogSet1**. + +``` +SetupDiag.exe /Output:C:\SetupDiag\Results.log /LogsPath:D:\Temp\Logs\LogSet1 +``` + +The following example sets recovery scenario in offline mode. In the example, SetupDiag will search for reset/recovery logs in the specified LogsPath location and output the resuts to the directory specified by the /Output parameter. + +``` +SetupDiag.exe /Output:C:\SetupDiag\RecoveryResults.log /LogsPath:D:\Temp\Cabs\PBR_Log /Scenario:Recovery +``` + +The following example sets recovery scenario in online mode. In the example, SetupDiag will search for reset/recovery logs on the current system and output results in XML format. + +``` +SetupDiag.exe /Scenario:Recovery /Format:xml +``` + + +## Log files + +[Windows Setup Log Files and Event Logs](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-log-files-and-event-logs) has information about where logs are created during Windows Setup. For offline processing, you should run SetupDiag against the contents of the entire folder. For example, depending on when the upgrade failed, copy one of the following folders to your offline location: + +\\$Windows.~bt\sources\panther +
                        \\$Windows.~bt\Sources\Rollback +
                        \Windows\Panther +
                        \Windows\Panther\NewOS + +If you copy the parent folder and all sub-folders, SetupDiag will automatically search for log files in all subdirectories. + +## Setup bug check analysis + +When Microsoft Windows encounters a condition that compromises safe system operation, the system halts. This condition is called a bug check. It is also commonly referred to as a system crash, a kernel error, a Stop error, or BSOD. Typically a hardware device, hardware driver, or related software causes this error. + +If crash dumps [are enabled](https://docs.microsoft.com/windows-hardware/drivers/debugger/enabling-a-kernel-mode-dump-file) on the system, a crash dump file is created. If the bug check occurs during an upgrade, Windows Setup will extract a minidump (setupmem.dmp) file. SetupDiag can also debug these setup related minidumps. + +To debug a setup related bug check, you must: +- Specify the **/LogsPath** parameter. You cannot debug memory dumps in online mode. +- Gather the setup memory dump file (setupmem.dmp) from the failing system. + - Setupmem.dmp will be created in either **%SystemDrive%\$Windows.~bt\Sources\Rollback**, or in **%WinDir%\Panther\NewOS\Rollback** depending on when the bug check occurs. +- Install the [Windows Debugging Tools](https://docs.microsoft.com/windows-hardware/drivers/debugger/debugger-download-tools) on the computer that runs SetupDiag. + +In the following example, the **setupmem.dmp** file is copied to the **D:\Dump** directory and the Windows Debugging Tools are installed prior to running SetupDiag: + +``` +SetupDiag.exe /Output:C:\SetupDiag\Dumpdebug.log /LogsPath:D:\Dump +``` + +## Known issues + +1. Some rules can take a long time to process if the log files involved are large. + + +## Sample output + +The following is an example where SetupDiag is run in offline mode. + +``` +D:\SetupDiag>SetupDiag.exe /output:c:\setupdiag\result.xml /logspath:D:\Tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e /format:xml + +SetupDiag v1.6.0.0 +Copyright (c) Microsoft Corporation. All rights reserved. + +Searching for setup logs... +Found d:\tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e\setupact_6.log with update date 6/12/2019 2:44:20 PM to be the correct setup log. +Found d:\tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e\setupact_1.log with update date 6/12/2019 2:45:19 PM to be the correct rollback log. + +Gathering baseline information from setup logs... + +SetupDiag: processing rule: CompatScanOnly. +...No match. + +... + +SetupDiag: processing rule: DISMImageSessionFailure. +.. +Error: SetupDiag reports DISM provider failure. +Last Phase: Safe OS +Last Operation: Apply Optional Component status +Message = Failed to get the IDismImage instance from the image session +Function: CDISMManager::CloseImageSession +Error: 0x800706ba +Recommend you re-download the update source files, reboot and try the update again. + +SetupDiag found 1 matching issue. + +SetupDiag results were logged to: c:\setupdiag\results.xml +Logs ZipFile created at: c:\setupdiag\Logs_14.zip + +``` + +## Rules + +When searching log files, SetupDiag uses a set of rules to match known issues. These rules are contained in the rules.xml file which is extracted when SetupDiag is run. The rules.xml file might be updated as new versions of SetupDiag are made available. See [Release notes](#release-notes) for more information. + +Each rule name and its associated unique rule identifier are listed with a description of the known upgrade-blocking issue. In the rule descriptions, the term "down-level" refers to the first phase of the upgrade process, which runs under the starting OS. + +1. CompatScanOnly - FFDAFD37-DB75-498A-A893-472D49A1311D + - This rule indicates that setup.exe was called with a specific command line parameter that indicated setup was to do a compat scan only, not an upgrade. +2. BitLockerHardblock - C30152E2-938E-44B8-915B-D1181BA635AE + - This is a block when the target OS does not support BitLocker, yet the host OS has BitLocker enabled. +3. VHDHardblock - D9ED1B82-4ED8-4DFD-8EC0-BE69048978CC + - This block happens when the host OS is booted to a VHD image. Upgrade is not supported when the host OS is booted from a VHD image. +4. PortableWorkspaceHardblock - 5B0D3AB4-212A-4CE4-BDB9-37CA404BB280 + - This indicates that the host OS is booted from a Windows To-Go device (USB key). Upgrade is not supported in the Windows To-Go environment. +5. AuditModeHardblock - A03BD71B-487B-4ACA-83A0-735B0F3F1A90 + - This block indicates that the host OS is currently booted into Audit Mode, a special mode for modifying the Windows state. Upgrade is not supported from this state. +6. SafeModeHardblock - 404D9523-B7A8-4203-90AF-5FBB05B6579B + - This block indicates that the host OS is booted to Safe Mode, where upgrade is not supported. +7. InsufficientSystemPartitionDiskSpaceHardblock - 3789FBF8-E177-437D-B1E3-D38B4C4269D1 + - This block is encountered when setup determines the system partition (where the boot loader files are stored) does not have enough space to be serviced with the newer boot files required during the upgrade process. +8. CompatBlockedApplicationAutoUninstall – BEBA5BC6-6150-413E-8ACE-5E1EC8D34DD5 + - This rule indicates there is an application that needs to be uninstalled before setup can continue. +9. CompatBlockedApplicationDismissable - EA52620B-E6A0-4BBC-882E-0686605736D9 + - When running setup in /quiet mode, there are dismissible application messages that turn into blocks unless the command line also specifies “/compat ignorewarning”. This rule indicates setup was executed in /quiet mode but there is an application dismissible block message that have prevented setup from continuing. +10. CompatBlockedApplicationManualUninstall - 9E912E5F-25A5-4FC0-BEC1-CA0EA5432FF4 + - This rule indicates that an application without an Add/Remove Programs entry, is present on the system and blocking setup from continuing. This typically requires manual removal of the files associated with this application to continue. +11. HardblockDeviceOrDriver - ED3AEFA1-F3E2-4F33-8A21-184ADF215B1B + - This indicates a device driver that is loaded on the host OS is not compatible with the newer OS version and needs to be removed prior to the upgrade. +12. HardblockMismatchedLanguage - 60BA8449-CF23-4D92-A108-D6FCEFB95B45 + - This rule indicates the host OS and the target OS language editions do not match. +13. HardblockFlightSigning - 598F2802-3E7F-4697-BD18-7A6371C8B2F8 + - This rule indicates the target OS is a pre-release, Windows Insider build, and the target machine has Secure Boot enabled. This will block the pre-release signed build from booting if installed on the machine. +14. DiskSpaceBlockInDownLevel - 6080AFAC-892E-4903-94EA-7A17E69E549E + - This failure indicates the system ran out of disk space during the down-level operations of upgrade. +15. DiskSpaceFailure - 981DCBA5-B8D0-4BA7-A8AB-4030F7A10191 + - This failure indicates the system drive ran out of available disk space at some point after the first reboot into the upgrade. +16. DeviceInstallHang - 37BB1C3A-4D79-40E8-A556-FDA126D40BC6 + - This failure rule indicates the system hung or bug checked during the device installation phase of upgrade. +17. DebugSetupMemoryDump - C7C63D8A-C5F6-4255-8031-74597773C3C6 + - This offline only rule indicates a bug check occurred during setup. If the debugger tools are available on the system, SetupDiag will debug the memory dump and provide details. +18. DebugSetupCrash - CEEBA202-6F04-4BC3-84B8-7B99AED924B1 + - This offline only rule indicates that setup itself encountered a failure that resulted in a process memory dump. If the debugger tools are installed on the system, SetupDiag will debug the memory dump and give further details. +19. DebugMemoryDump - 505ED489-329A-43F5-B467-FCAAF6A1264C + - This offline only rule is for any memory.dmp file that resulted during the setup/upgrade operation. If the debugger tools are installed on the system, SetupDiag will debug the memory dump and give further details. +20. BootFailureDetected - 4FB446C2-D4EC-40B4-97E2-67EB19D1CFB7 + - This rule indicates a boot failure occurred during a specific phase of the update. The rule will indicate the failure code and phase for diagnostic purposes. +21. FindDebugInfoFromRollbackLog - 9600EB68-1120-4A87-9FE9-3A4A70ACFC37 + - This rule will determine and give details when a bug check occurs during the setup/upgrade process that resulted in a memory dump, but without the requirement of the debugger package being on the executing machine. +22. AdvancedInstallerFailed - 77D36C96-32BE-42A2-BB9C-AAFFE64FCADC + - Finds fatal advanced installer operations that cause setup failures. +23. FindMigApplyUnitFailure - A4232E11-4043-4A37-9BF4-5901C46FD781 + - Detects a migration unit failure that caused the update to fail. This rule will output the name of the migration plug-in as well as the error code it produced for diagnostic purposes. +24. FindMigGatherUnitFailure - D04C064B-CD77-4E64-96D6-D26F30B4EE29 + - Detects a migration gather unit failure that caused the update to fail. This rule will output the name of the gather unit/plug-in as well as the error code it produced for diagnostic purposes. +25. CriticalSafeOSDUFailure - 73566DF2-CA26-4073-B34C-C9BC70DBF043 + - This rule indicates a failure occurred while updating the SafeOS image with a critical dynamic update. It will indicate the phase and error code that occurred while attempting to update the SafeOS image for diagnostic purposes. +26. UserProfileCreationFailureDuringOnlineApply - 678117CE-F6A9-40C5-BC9F-A22575C78B14 + - Indicates there was a critical failure while creating or modifying a User Profile during the online apply phase of the update. It will indicate the operation and error code associated with the failure for diagnostic purposes. +27. WimMountFailure - BE6DF2F1-19A6-48C6-AEF8-D3B0CE3D4549 + - This rule indicates the update failed to mount a wim file. It will show the name of the wim file as well as the error message and error code associated with the failure for diagnostic purposes. +28. FindSuccessfulUpgrade - 8A0824C8-A56D-4C55-95A0-22751AB62F3E + - Determines if the given setup was a success or not based off the logs. +29. FindSetupHostReportedFailure - 6253C04F-2E4E-4F7A-B88E-95A69702F7EC + - Gives information about failures surfaced early in the upgrade process by setuphost.exe +30. FindDownlevelFailure - 716334B7-F46A-4BAA-94F2-3E31BC9EFA55 + - Gives failure information surfaced by SetupPlatform, later in the down-level phase. +31. FindAbruptDownlevelFailure - 55882B1A-DA3E-408A-9076-23B22A0472BD + - Gives last operation failure information when the system fails in the down-level, but the log just ends abruptly. +32. FindSetupPlatformFailedOperationInfo - 307A0133-F06B-4B75-AEA8-116C3B53C2D1 + - Gives last phase and error information when SetupPlatform indicates a critical failure. This rule will indicate the operation and error associated with the failure for diagnostic purposes. +33. FindRollbackFailure - 3A43C9B5-05B3-4F7C-A955-88F991BB5A48 + - Gives last operation, failure phase and error information when a rollback occurs. +34. AdvancedInstallerGenericFailure – 4019550D-4CAA-45B0-A222-349C48E86F71 + - A rule to match AdvancedInstaller read/write failures in a generic sense. Will output the executable being called as well as the error code and exit code reported. +35. OptionalComponentFailedToGetOCsFromPackage – D012E2A2-99D8-4A8C-BBB2-088B92083D78 (NOTE: This rule replaces the OptionalComponentInstallFailure rule present in v1.10. + - This matches a specific Optional Component failure when attempting to enumerate components in a package. Will output the package name and error code. +36. OptionalComponentOpenPackageFailed – 22952520-EC89-4FBD-94E0-B67DF88347F6 + - Matches a specific Optional Component failure when attempting to open an OC package. Will output the package name and error code. +37. OptionalComponentInitCBSSessionFailed – 63340812-9252-45F3-A0F2-B2A4CA5E9317 + - Matches a specific failure where the advanced installer service or components aren’t operating or started on the system. Will output the error code. +38. UserProfileCreationFailureDuringFinalize – C6677BA6-2E53-4A88-B528-336D15ED1A64 + - Matches a specific User Profile creation error during the finalize phase of setup. Will output the failure code. +39. WimApplyExtractFailure – 746879E9-C9C5-488C-8D4B-0C811FF3A9A8 + - Matches a wim apply failure during wim extraction phases of setup. Will output the extension, path and error code. +40. UpdateAgentExpanderFailure – 66E496B3-7D19-47FA-B19B-4040B9FD17E2 + - Matches DPX expander failures in the down-level phase of update from WU. Will output the package name, function, expression and error code. +41. FindFatalPluginFailure – E48E3F1C-26F6-4AFB-859B-BF637DA49636 + - Matches any plug-in failure that setupplatform decides is fatal to setup. Will output the plugin name, operation and error code. +42. AdvancedInstallerFailed - 77D36C96-32BE-42A2-BB9C-AAFFE64FCADC + - Indicates critical failure in the AdvancedInstaller while running an installer package, includes the .exe being called, the phase, mode, component and error codes. +43. MigrationAbortedDueToPluginFailure - D07A24F6-5B25-474E-B516-A730085940C9 + - Indicates a critical failure in a migration plugin that causes setup to abort the migration. Will provide the setup operation, plug-in name, plug-in action and error code. +44. DISMAddPackageFailed - 6196FF5B-E69E-4117-9EC6-9C1EAB20A3B9 + - Indicates a critical failure during a DISM add package operation. Will specify the Package Name, DISM error and add package error code. +45. PlugInComplianceBlock - D912150B-1302-4860-91B5-527907D08960 + - Detects all compat blocks from Server compliance plug-ins. Outputs the block information and remediation. +46. AdvancedInstallerGenericFailure - 4019550D-4CAA-45B0-A222-349C48E86F71 + - Triggers on advanced installer failures in a generic sense, outputting the application called, phase, mode, component and error code. +47. FindMigGatherApplyFailure - A9964E6C-A2A8-45FF-B6B5-25E0BD71428E + - Shows errors when the migration Engine fails out on a gather or apply operation. Indicates the Migration Object (file or registry path), the Migration +48. OptionalComponentFailedToGetOCsFromPackage - D012E2A2-99D8-4A8C-BBB2-088B92083D78 + - Indicates the optional component (OC) migration operation failed to enumerate optional components from an OC Package. Outputs the package name and error code. +49. OptionalComponentOpenPackageFailed - 22952520-EC89-4FBD-94E0-B67DF88347F6 + - Indicates the optional component migration operation failed to open an optional component Package. Outputs the package name and error code. +50. OptionalComponentInitCBSSessionFailed - 63340812-9252-45F3-A0F2-B2A4CA5E9317 + - Indicates corruption in the servicing stack on the down-level system. Outputs the error code encountered while trying to initialize the servicing component on the existing OS. +51. DISMproviderFailure - D76EF86F-B3F8-433F-9EBF-B4411F8141F4 + - Triggers when a DISM provider (plug-in) fails in a critical operation. Outputs the file (plug-in name), function called + error code, and error message from the provider. +52. SysPrepLaunchModuleFailure - 7905655C-F295-45F7-8873-81D6F9149BFD + - Indicates a sysPrep plug-in has failed in a critical operation. Indicates the plug-in name, operation name and error code. +53. UserProvidedDriverInjectionFailure - 2247C48A-7EE3-4037-AFAB-95B92DE1D980 + - A driver provided to setup (via command line input) has failed in some way. Outputs the driver install function and error code. +54. PlugInComplianceBlock - D912150B-1302-4860-91B5-527907D08960 + - These are for server upgrades only, will output the compliance block and remediation required. +55. PreReleaseWimMountDriverFound - 31EC76CC-27EC-4ADC-9869-66AABEDB56F0 + - Captures failures due to having an unrecognized wimmount.sys driver registered on the system. +56. WinSetupBootFilterFailure - C073BFC8-5810-4E19-B53B-4280B79E096C + - Detects failures in the kernel mode file operations. +57. WimMountDriverIssue - 565B60DD-5403-4797-AE3E-BC5CB972FBAE + - Detects failures in WimMount.sys registration on the system. +58. DISMImageSessionFailure - 61B7886B-10CD-4C98-A299-B987CB24A11C + - Captures failure information when DISM fails to start an image session successfully. +59. FindEarlyDownlevelError - A4CE4FC9-5E10-4BB1-8ECE-3B29EB9D7C52 + - Detects failures in down-level phase before setup platform is invoked. +60. FindSPFatalError - A4028172-1B09-48F8-AD3B-86CDD7D55852 + - Captures failure information when setup platform encounters a fatal error. + + +## Release notes + +08/08/2019 - SetupDiag v1.6.0.42 is released with 60 rules, as a standalone tool available from the Download Center. + - Log detection performance is improved. What used to take up to a minute should take around 10 seconds or less. + - Added Setup Operation and Setup Phase information to both the results log and the registry information. + - This is the last Operation and Phase that Setup was in when the failure occurred. + - Added detailed Setup Operation and Setup Phase information (and timing) to output log when /verbose is specified. + - Note, if the issue found is a compat block, no Setup Operation or Phase info exists yet and therefore won’t be available. + - Added more info to the Registry output. + - Detailed ‘FailureData’ info where available. Example: “AppName = MyBlockedApplication” or “DiskSpace = 6603” (in MB) + - “Key = Value” data specific to the failure found. + - Added ‘UpgradeStartTime’, ‘UpgradeEndTime’ and ‘UpgradeElapsedTime’ + - Added ‘SetupDiagVersion’, ‘DateTime’ (to indicate when SetupDiag was executed on the system), ‘TargetOSVersion’, ‘HostOSVersion’ and more… + + +06/19/2019 - SetupDiag v1.5.0.0 is released with 60 rules, as a standalone tool available from the Download Center. +- All date and time outputs are updated to localized format per user request. +- Added setup Operation and Phase information to /verbose log. +- Added last Setup Operation and last Setup Phase information to most rules where it make sense (see new output below). +- Performance improvement in searching setupact.logs to determine correct log to parse. +- Added SetupDiag version number to text report (xml and json always had it). +- Added "no match" reports for xml and json per user request. +- Formatted Json output for easy readability. +- Performance improvements when searching for setup logs; this should be much faster now. +- Added 7 new rules: PlugInComplianceBlock, PreReleaseWimMountDriverFound, WinSetupBootFilterFailure, WimMountDriverIssue, DISMImageSessionFailure, FindEarlyDownlevelError, and FindSPFatalError. See the [Rules](#rules) section above for more information. +- Diagnostic information is now output to the registry at **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag** + - The **/AddReg** command was added to toggle registry output. This setting is off by default for offline mode, and on by default for online mode. The command has no effect for online mode and enables registry output for offline mode. + - This registry key is deleted as soon as SetupDiag is run a second time, and replaced with current data, so it’s always up to date. + - This registry key also gets deleted when a new update instance is invoked. + - For an example, see [Sample registry key](#sample-registry-key). + +05/17/2019 - SetupDiag v1.4.1.0 is released with 53 rules, as a standalone tool available from the Download Center. +- This release dds the ability to find and diagnose reset and recovery failures (Push Button Reset). + +12/18/2018 - SetupDiag v1.4.0.0 is released with 53 rules, as a standalone tool available from the Download Center. +- This release includes major improvements in rule processing performance: ~3x faster rule processing performance! + - The FindDownlevelFailure rule is up to 10x faster. +- New rules have been added to analyze failures upgrading to Windows 10 version 1809. +- A new help link is available for resolving servicing stack failures on the down-level OS when the rule match indicates this type of failure. +- Removed the need to specify /Mode parameter. Now if you specify /LogsPath, it automatically assumes offline mode. +- Some functional and output improvements were made for several rules. + +07/16/2018 - SetupDiag v1.3.1 is released with 44 rules, as a standalone tool available from the Download Center. +- This release fixes a problem that can occur when running SetupDiag in online mode on a computer that produces a setupmem.dmp file, but does not have debugger binaries installed. + +07/10/2018 - SetupDiag v1.30 is released with 44 rules, as a standalone tool available from the Download Center. +- Bug fix for an over-matched plug-in rule. The rule will now correctly match only critical (setup failure) plug-in issues. +- New feature: Ability to output logs in JSON and XML format. + - Use "/Format:xml" or "/Format:json" command line parameters to specify the new output format. See [sample logs](#sample-logs) at the bottom of this topic. + - If the “/Format:xml” or “/Format:json” parameter is omitted, the log output format will default to text. +- New Feature: Where possible, specific instructions are now provided in rule output to repair the identified error. For example, instructions are provided to remediate known blocking issues such as uninstalling an incompatible app or freeing up space on the system drive. +- 3 new rules added: AdvancedInstallerFailed, MigrationAbortedDueToPluginFailure, DISMAddPackageFailed. + +05/30/2018 - SetupDiag v1.20 is released with 41 rules, as a standalone tool available from the Download Center. +- Fixed a bug in device install failure detection in online mode. +- Changed SetupDiag to work without an instance of setupact.log. Previously, SetupDiag required at least one setupact.log to operate. This change enables the tool to analyze update failures that occur prior to calling SetupHost. +- Telemetry is refactored to only send the rule name and GUID (or “NoRuleMatched” if no rule is matched) and the Setup360 ReportId. This change assures data privacy during rule processing. + +05/02/2018 - SetupDiag v1.10 is released with 34 rules, as a standalone tool available from the Download Center. +- A performance enhancment has been added to result in faster rule processing. +- Rules output now includes links to support articles, if applicable. +- SetupDiag now provides the path and name of files that it is processing. +- You can now run SetupDiag by simply clicking on it and then examining the output log file. +- An output log file is now always created, whether or not a rule was matched. + +03/30/2018 - SetupDiag v1.00 is released with 26 rules, as a standalone tool available from the Download Center. + +## Sample logs + +### Text log sample + +``` +Matching Profile found: OptionalComponentOpenPackageFailed - 22952520-EC89-4FBD-94E0-B67DF88347F6 +System Information: + Machine Name = Offline + Manufacturer = MSI + Model = MS-7998 + HostOSArchitecture = x64 + FirmwareType = PCAT + BiosReleaseDate = 20160727000000.000000+000 + BiosVendor = BIOS Date: 07/27/16 10:01:46 Ver: V1.70 + BiosVersion = 1.70 + HostOSVersion = 10.0.15063 + HostOSBuildString = 15063.0.amd64fre.rs2_release.170317-1834 + TargetOSBuildString = 10.0.16299.15 (rs3_release.170928-1534) + HostOSLanguageId = 2057 + HostOSEdition = Core + RegisteredAV = Windows Defender, + FilterDrivers = WdFilter,wcifs,WIMMount,luafv,Wof,FileInfo, + UpgradeStartTime = 3/21/2018 9:47:16 PM + UpgradeEndTime = 3/21/2018 10:02:40 PM + UpgradeElapsedTime = 00:15:24 + ReportId = dd4db176-4e3f-4451-aef6-22cf46de8bde + +Error: SetupDiag reports Optional Component installation failed to open OC Package. Package Name: Foundation, Error: 0x8007001F +Recommend you check the "Windows Modules Installer" service (Trusted Installer) is started on the system and set to automatic start, reboot and try the update again. Optionally, you can check the status of optional components on the system (search for Windows Features), uninstall any unneeded optional components, reboot and try the update again. +Error: SetupDiag reports down-level failure, Operation: Finalize, Error: 0x8007001F - 0x50015 +Refer to https://docs.microsoft.com/windows/deployment/upgrade/upgrade-error-codes for error information. +``` + +### XML log sample + +```xml + + + 1.6.0.0 + FindSPFatalError + A4028172-1B09-48F8-AD3B-86CDD7D55852 + + Offline + Gigabyte Technology Co., Ltd. + X470 AORUS ULTRA GAMING + 1033 + UEFI + 20180808000000.000000+000 + F3 + + 10.0.18908 + 18908.1000.amd64fre.rs_prerelease.190524-1658 + 10.0.18912.1001 (rs_prerelease.190601-1739) + + Professional + Windows Defender + + 2019-06-06T21:19:10 + + 2019-06-06T22:21:49 + 0001-01-01T00:00:00 + 0001-01-01T00:00:00 + + 0001-01-01T00:00:00 + 0001-01-01T00:00:00 + + Offline + MgUweCZk90KdwUiZ + F21F8FB6-00FD-4349-84FB-2AC75F389E73 + F21F8FB6-00FD-4349-84FB-2AC75F389E73 + + 2019-06-06 21:47:11, Error SP Error converting install time 5/2/2019 to structure[gle=0x00000057] + +Error: SetupDiag reports Fatal Error. +Last Setup Phase = Downlevel +Last Setup Operation: Gather data, scope: EVERYTHING +Error: 0x00000057 + LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5/2/2019 to structure[gle=0x00000057] + LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5/2/2019 to structure[gle=0x00000057] + +Refer to "https://docs.microsoft.com/windows/desktop/Debug/system-error-codes" for error information. + Err = 0x00000057, LastOperation = Gather data, scope: EVERYTHING, LastPhase = Downlevel + +``` + +### JSON log sample + +``` +{ + "Version":"1.6.0.0", + "ProfileName":"FindSPFatalError", + "ProfileGuid":"A4028172-1B09-48F8-AD3B-86CDD7D55852", + "SystemInfo":{ + "BiosReleaseDate":"20180808000000.000000+000", + "BiosVendor":"F3", + "BiosVersion":"F3", + "CV":"MgUweCZk90KdwUiZ", + "CommercialId":"Offline", + "FilterDrivers":"", + "FinalizeStartTime":"\/Date(-62135568000000-0800)\/", + "FirmwareType":"UEFI", + "HostOSArchitecture":"x64", + "HostOSBuildString":"18908.1000.amd64fre.rs_prerelease.190524-1658", + "HostOSEdition":"Professional", + "HostOSLanguageId":"", + "HostOSVersion":"", + "MachineName":"Offline", + "Manufacturer":"Gigabyte Technology Co., Ltd.", + "Model":"X470 AORUS ULTRA GAMING", + "PostOOBESuccessTime":"\/Date(-62135568000000-0800)\/", + "RegisteredAV":"Windows Defender", + "ReportId":"F21F8FB6-00FD-4349-84FB-2AC75F389E73", + "RollbackElapsedTime":"PT0S", + "RollbackEndTime":"\/Date(-62135568000000-0800)\/", + "RollbackStartTime":"\/Date(-62135568000000-0800)\/", + "SetupReportId":"F21F8FB6-00FD-4349-84FB-2AC75F389E73", + "TargetOSArchitecture":null, + "TargetOSBuildString":"10.0.18912.1001 (rs_prerelease.190601-1739)", + "TotalOfflineTime":"PT0S", + "UpgradeElapsedTime":"PT1H2M39S", + "UpgradeEndTime":"\/Date(1559884909000-0700)\/", + "UpgradeStartTime":"\/Date(1559881150000-0700)\/" + }, + "LogErrorLine":"2019-06-06 21:47:11, Error SP Error converting install time 5\/2\/2019 to structure[ + gle=0x00000057 + ]", + "FailureData":[ + "\u000aError: SetupDiag reports Fatal Error.\u000aLast Setup Phase = Downlevel\u000aLast Setup Operation: Gather data, scope: EVERYTHING\u000aError: 0x00000057", + "LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5\/2\/2019 to structure[ + gle=0x00000057 + ]", + "LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5\/2\/2019 to structure[ + gle=0x00000057 + ]", + "\u000aRefer to \"https:\/\/docs.microsoft.com\/en-us\/windows\/desktop\/Debug\/system-error-codes\" for error information." + ], + "FailureDetails":"Err = 0x00000057, LastOperation = Gather data, scope: EVERYTHING, LastPhase = Downlevel", + "DeviceDriverInfo":null, + "Remediation":[ + + ], + "SetupPhaseInfo":null, + "SetupOperationInfo":null +} +``` + +## Sample registry key + +![Addreg](./../images/addreg.png) + +## Related topics + +[Resolve Windows 10 upgrade errors: Technical information for IT Pros](https://docs.microsoft.com/windows/deployment/upgrade/resolve-windows-10-upgrade-errors) diff --git a/windows/deployment/upgrade/submit-errors.md b/windows/deployment/upgrade/submit-errors.md index 6f6bde4fba..64716a73e7 100644 --- a/windows/deployment/upgrade/submit-errors.md +++ b/windows/deployment/upgrade/submit-errors.md @@ -29,7 +29,7 @@ This topic describes how to submit problems with a Windows 10 upgrade to Microso ## About the Feedback Hub -The Feedback Hub app lets you tell Microsoft about any problems you run in to while using Windows 10 and send suggestions to help us improve your Windows experience. Previously, you could only use the Feedback Hub if you were in the Windows Insider Program. Now anyone can use this tool. You can download the Feedback Hub app from the Microsoft Store [here](https://www.microsoft.com/en-us/store/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0). +The Feedback Hub app lets you tell Microsoft about any problems you run in to while using Windows 10 and send suggestions to help us improve your Windows experience. Previously, you could only use the Feedback Hub if you were in the Windows Insider Program. Now anyone can use this tool. You can download the Feedback Hub app from the Microsoft Store [here](https://www.microsoft.com/store/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0). The Feedback Hub requires Windows 10 or Windows 10 mobile. If you are having problems upgrading from an older version of Windows to Windows 10, you can use the Feedback Hub to submit this information, but you must collect the log files from the legacy operating system and then attach these files to your feedback using a device that is running Windows 10. If you are upgrading to Windows 10 from a previous verion of Windows 10, the Feedback Hub will collect log files automatically. diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md index b252ff670a..c9509188a3 100644 --- a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md +++ b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md @@ -92,6 +92,6 @@ WIM = Windows image (Microsoft) [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx)
                        [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
                        [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +
                        [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
                        [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
                        [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/upgrade-error-codes.md b/windows/deployment/upgrade/upgrade-error-codes.md index f06c6fb87b..0dd0d042c6 100644 --- a/windows/deployment/upgrade/upgrade-error-codes.md +++ b/windows/deployment/upgrade/upgrade-error-codes.md @@ -154,6 +154,6 @@ For example: An extend code of **0x4000D**, represents a problem during phase 4 [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx)
                        [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
                        [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +
                        [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
                        [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
                        [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md b/windows/deployment/upgrade/upgrade-readiness-additional-insights.md index 93d1f63cc0..c6c73aa23e 100644 --- a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md +++ b/windows/deployment/upgrade/upgrade-readiness-additional-insights.md @@ -5,7 +5,8 @@ manager: laurawi ms.author: greglin description: Explains additional features of Upgrade Readiness. ms.prod: w10 -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.topic: article ms.collection: M365-analytics --- @@ -14,44 +15,9 @@ ms.collection: M365-analytics This topic provides information on additional features that are available in Upgrade Readiness to provide insights into your environment. These include: -- [Spectre and Meltdown protections](#spectre-and-meltdown-protection-status): Status of devices with respect to their anti-virus, security update, and firmware updates related to protection from the "Spectre" and "Meltdown" vulnerabilities. - [Site discovery](#site-discovery): An inventory of web sites that are accessed by client computers running Windows 7, Windows 8.1, or Windows 10 using Internet Explorer. - [Office add-ins](#office-add-ins): A list of the Microsoft Office add-ins that are installed on client computers. -## Spectre and Meltdown protection status -Microsoft has published guidance for IT Pros that outlines the steps you can take to improve protection against the hardware vulnerabilities known as "Spectre" and "Meltdown." See [Windows Client Guidance for IT Pros to protect against speculative execution side-channel vulnerabilities](https://go.microsoft.com/fwlink/?linkid=867468) for details about the vulnerabilities and steps you can take. - -Microsoft recommends three steps to help protect against the Spectre and Meltdown vulnerabilities: -- Verify that you are running a supported antivirus application. -- Apply all available Windows operating system updates, including the January 2018 and later Windows security updates. -- Apply any applicable processor firmware (microcode) updates provided by your device manufacturer(s). - -Upgrade Readiness reports on status of your devices in these three areas. - -![Spectre-Meltdown protection blades](../images/spectre-meltdown-prod-closeup.png) - ->[!IMPORTANT] ->To provide these blades with data, ensure that your devices can reach the endpoint **http://adl.windows.com**. (See [Enrolling devices in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started) for more about necessary endpoints and how to whitelist them.) - -### Anti-virus status blade -This blade helps you determine if your devices' anti-virus solution is compatible with the latest Windows operating system updates. It shows the number of devices that have an anti-virus solution with no known issues, issues reported, or an unknown status for a particular Windows security update. In the following example, an anti-virus solution that has no known issues with the January 3, 2018 Windows update is installed on about 2,800 devices. - -![Spectre-Meltdown antivirus blade](../images/AV-status-by-computer.png) - -### Security update status blade -This blade indicates whether a Windows security update that includes Spectre- or Meltdown-related fixes (January 3, 2018 or later) has been installed, as well as whether specific fixes have been disabled. Though protections are enabled by default on devices running Windows (but not Windows Server) operating systems, some IT administrators might choose to disable specific protections. In the following example, about 4,300 devices have a Windows security update that includes Spectre or Meltdown protections installed, and those protections are enabled. - -![Spectre-Meltdown antivirus blade](../images/win-security-update-status-by-computer.png) - ->[!IMPORTANT] ->If you are seeing computers with statuses of either “Unknown – action may be required” or “Installed, but mitigation status unknown,” it is likely that you need to whitelist the **http://adl.windows.com** endpoint. - -### Firmware update status blade -This blade reports the number of devices that have installed a firmware update that includes Spectre or Meltdown protections. The blade might report a large number of blank, “unknown”, or “to be determined” statuses at first. As CPU information is provided by partners, the blade will automatically update with no further action required on your part. - - - - ## Site discovery The IE site discovery feature in Upgrade Readiness provides an inventory of web sites that are accessed by client computers using Internet Explorer on Windows 7, Windows 8.1, and Windows 10. Site discovery does not include sites that are accessed using other Web browsers, such as Microsoft Edge. Site inventory information is provided as optional data related to upgrading to Windows 10 and Internet Explorer 11, and is meant to help prioritize compatibility testing for web applications. You can make more informed decisions about testing based on usage data. diff --git a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md index 1eef483854..8ad77cca4e 100644 --- a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md +++ b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md @@ -1,190 +1,191 @@ ---- -title: Upgrade Readiness deployment script (Windows 10) -ms.reviewer: -manager: laurawi -ms.author: greglin -description: Deployment script for Upgrade Readiness. -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness deployment script - -To automate the steps provided in [Get started with Upgrade Readiness](upgrade-readiness-get-started.md), and to troubleshoot data sharing issues, you can run the [Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409), developed by Microsoft. - ->[!IMPORTANT] ->Upgrade Readiness was previously called Upgrade Analytics. References to Upgrade Analytics in any scripts or online content pertain to the Upgrade Readiness solution. - ->[!IMPORTANT] ->The latest version of the Upgrade Readiness Script is **2.4.4 - 10.10.2018** - -For detailed information about using the Upgrade Readiness (also known as upgrade analytics) deployment script, see the [Upgrade Analytics blog](https://techcommunity.microsoft.com/t5/Windows-Analytics-Blog/New-version-of-the-Upgrade-Analytics-Deployment-Script-available/ba-p/187164?advanced=false&collapse_discussion=true&q=new%20version%20of%20the%20upgrade%20analytics%20deployment%20script%20available&search_type=thread). - -> The following guidance applies to version **2.4.4 - 10.10.2018** of the Upgrade Readiness deployment script. If you are using an older version, download the latest from the [Download Center](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409). - -The Upgrade Readiness deployment script does the following: - -1. Sets commercial ID key + CommercialDataOptIn + RequestAllAppraiserVersions keys. -2. Verifies that user computers can send data to Microsoft. -3. Checks whether the computer has a pending restart.   -4. Verifies that the latest version of KB package 10.0.x is installed (version 10.0.14348 or later is required, but version 10.0.14913 or later is recommended). -5. If enabled, turns on verbose mode for troubleshooting. -6. Initiates the collection of the diagnostic data that Microsoft needs to assess your organization’s upgrade readiness. -7. If enabled, displays the script’s progress in a cmd window, providing you immediate visibility into issues (success or fail for each step) and/or writes to log file. - -## Running the script - ->There should be no performance impact caused by the script. The script is a light wrapper of Windows in-box components that undergo performance testing and optimization to avoid any performance impact. However, typically the script is scheduled to be run outside of working hours. -> ->Do not run the script at each sign-on. It is recommended to run the script once every 30 days. -> ->The length of time the script takes to run on each system depends on the number of apps and drivers, and the type of hardware. Anti-virus software scanning simultaneously can increase the script run time, but the script should require no longer than 10 minutes to run, and typically the time is much shorter. If the script is observed running for an extended period of time, please run the Pilot script, and collect logs to share with Microsoft. Log files are created in the drive that is specified in the RunConfig.bat file. By default this is set to: **%SystemDrive%\UADiagnostics**. - -To run the Upgrade Readiness deployment script: - -1. Download the [Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and extract the .zip file. Inside, there are two folders: **Pilot** and **Deployment**. The **Pilot** folder contains advanced logging that can help troubleshoot issues and is intended to be run from an elevated command prompt. The **Deployment** folder offers a lightweight script intended for broad deployment through ConfigMgr or other software deployment system. We recommend manually running the Pilot version of the script on 5-10 machines to verify that everything is configured correctly. Once you have confirmed that data is flowing successfully, proceed to run the Deployment version throughout your organization. - -2. Edit the following parameters in RunConfig.bat: - - 1. Provide a storage location for log information. You can store log information on a remote file share or a local directory. If the script is blocked from creating the log file for the given path, it creates the log files in the drive with the Windows directory. Example: %SystemDrive%\\UADiagnostics - - 2. Input your commercial ID key. To find your commercial ID, first navigate to the **Solutions** tab for your workspace, and then select the solution. From there, select the **Settings** page, where you can find and copy your commercial ID: - - 3. By default, the script sends log information to both the console and the log file. To change the default behavior, use one of the following options: - - > *logMode = 0 log to console only* - > - > *logMode = 1 log to file and console* - > - > *logMode = 2 log to file only* - -3. To enable Internet Explorer data collection, set AllowIEData to IEDataOptIn. By default, AllowIEData is set to Disable. Then use one of the following options to determine what Internet Explorer data can be collected: - - > *IEOptInLevel = 0 Internet Explorer data collection is disabled* - > - > *IEOptInLevel = 1 Data collection is enabled for sites in the Local intranet + Trusted sites + Machine local zones* - > - > *IEOptInLevel = 2 Data collection is enabled for sites in the Internet + Restricted sites zones* - > - > *IEOptInLevel = 3 Data collection is enabled for all sites* - -4. The deployment script is configured to collect and send diagnostic and debugging data to Microsoft. If you wish to disable sending diagnostic and debugging data to Microsoft, set **AppInsightsOptIn = false**. By default, **AppInsightsOptIn** is set to **true**. - - The data that is sent is the same data that is collected in the text log file that captures the events and error codes while running the script. This file is named in the following format: **UA_yyyy_mm_dd_hh_mm_ss_machineID.txt**. Log files are created in the drive that is specified in the RunConfig.bat file. By default this is set to: **%SystemDrive%\UADiagnostics**. - - This data gives us the ability to determine the status of your machines and to help troubleshoot issues. If you choose to opt-in to and send this data to Microsoft, you must also allow https traffic to be sent to the following wildcard endpoints: - - \*vortex\*.data.microsoft.com
                        - \*settings\*.data.microsoft.com - -5. The deployment script configures insider builds to continue to send the device name to the diagnostic data management service and the analytics portal. If you do not want to have insider builds send the device name sent to analytics and be available in the analytics portal, set **DeviceNAmeOptIn = false**. By default it is true, which preserves the behavior on previous versions of Windows. This setting only applies to insider builds. Note that the device name is also sent to AppInsights, so to ensure the device name is not sent to either place you would need to also set **AppInsightsOptIn = false**. - -6. After you finish editing the parameters in RunConfig.bat, you are ready to run the script. If you are using the Pilot version, run RunConfig.bat from an elevated command prompt. If you are using the Deployment version, use ConfigMgr or other software deployment service to run RunConfig.bat as system. - -## Exit codes - -The deployment script displays the following exit codes to let you know if it was successful, or if an error was encountered. - -| Exit code | Suggested fix | -|-----------|--------------| -| 0 - Success | N/A | -| 1 - Unexpected error occurred while executing the script. | The files in the deployment script are likely corrupted. Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966) from the download center and try again. | -| 2 - Error when logging to console. $logMode = 0. (console only) | Try changing the $logMode value to **1** and try again. $logMode value 1 logs to both console and file. | -| 3 - Error when logging to console and file. $logMode = 1. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. | -| 4 - Error when logging to file. $logMode = 2. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. | -| 5 - Error when logging to console and file. $logMode = unknown. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. | -| 6 - The commercialID parameter is set to unknown. | Modify the runConfig.bat file to set the CommercialID value. The value for parameter in the runconfig.bat file should match the Commercial ID key for your workspace. See [Generate your Commercial ID key](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#generate-your-commercial-id-key) for instructions on generating a Commercial ID key for your workspace. | -| 8 - Failure to create registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection**. The Commercial Id property is set at the following registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the context under which the script in running has access to the registry key. | -| 9 - The script failed to write Commercial Id to registry. -Error creating or updating registry key: **CommercialId** at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the context under which the script in running has access to the registry key. | -| 10 - Error when writing **CommercialDataOptIn** to the registry at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the deployment script is running in a context that has access to the registry key. | -| 11 - Function **SetupCommercialId** failed with an unexpected exception. The **SetupCommercialId** function updates the Commercial Id at the registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the configuration script has access to this location. | -| 12 - Can’t connect to Microsoft - Vortex. Check your network/proxy settings. | **Http Get** on the end points did not return a success exit code. For Windows 10, connectivity is verified by connecting to https://v10.vortex-win.data.microsoft.com/health/keepalive. For previous operating systems, connectivity is verified by connecting to https://vortex-win.data.microsoft.com/health/keepalive. If there is an error verifying connectivity, this will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md) | -| 13 - Can’t connect to Microsoft - setting. | An error occurred connecting to https://settings.data.microsoft.com/qos. This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#enable-data-sharing). Verify that the required endpoints are whitelisted correctly. See Whitelist select endpoints for more details. | -| 14 - Can’t connect to Microsoft - compatexchange. An error occurred connecting to [CompatibilityExchangeService.svc](https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc). | This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md). | -| 15 - Function CheckVortexConnectivity failed with an unexpected exception. | This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md). Check the logs for the exception message and the HResult. | -| 16 - The computer requires a reboot before running the script. | Restart the device to complete the installation of the compatibility update and related updates. Reboot the computer before running the Upgrade Readiness deployment script. | -| 17 - Function **CheckRebootRequired** failed with an unexpected exception. | Restart the device to complete installation of the compatibility update and related updates. Check the logs for the exception message and the HResult. | -|18 - Appraiser KBs not installed or **appraiser.dll** not found. | Either the Appraiser-related updates are not installed, or the **appraiser.dll** file was not found. For more information, see appraiser diagnostic data events and fields information in the [Data collection](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#data-collection-and-privacy) and privacy topic. | -| 19 - Function **CheckAppraiserKB**, which checks the compatibility update KBs, failed with unexpected exception. | Check the logs for the Exception message and HResult. The script will not run further if this error is not fixed. | -| 20 - An error occurred when creating or updating the registry key **RequestAllAppraiserVersions** at **HKLM:\SOFTWARE\Microsoft\WindowsNT \CurrentVersion\AppCompatFlags\Appraiser** | The registry key is required for data collection to work correctly. Verify that the script is running in a context that has access to the registry key. | -| 21 - Function **SetRequestAllAppraiserVersions** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 22 - **RunAppraiser** failed with unexpected exception. | Check the logs for the exception message and HResult. Check the **%windir%\System32** directory for the file **CompatTelRunner.exe**. If the file does not exist, reinstall the required compatibility updates which include this file, and check your organization's Group Policy to verify it does not remove this file. | -| 23 - Error finding system variable **%WINDIR%**. | Verify that this environment variable is configured on the computer. | -| 24 - The script failed when writing **IEDataOptIn** to the registry. An error occurred when creating registry key **IEOptInLevel** at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | This is a required registry key for IE data collection to work correctly. Verify that the deployment script in running in a context that has access to the registry key. Check the logs for the exception message and HResult. | -| 25 - The function **SetIEDataOptIn** failed with unexpected exception. | Check the logs for the exception message and HResult. | -| 27 - The script is not running under **System** account. | The Upgrade Readiness configuration script must be run as **System**. | -| 28 - Could not create log file at the specified **logPath**. | Make sure the deployment script has access to the location specified in the **logPath** parameter. | -| 29 - Connectivity check failed for proxy authentication. | Install cumulative updates on the device and enable the **DisableEnterpriseAuthProxy** authentication proxy setting. The **DisableEnterpriseAuthProxy** setting is enabled by default for Windows 7\. For Windows 8.1 computers, set the **DisableEnterpriseAuthProxy** setting to **0** (not disabled). For more information on authentication proxy support, see [Authentication proxy support added in new version (12.28.16) of the Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?linkid=838688). | -| 30 - Connectivity check failed. Registry key property **DisableEnterpriseAuthProxy** is not enabled. | The **DisableEnterpriseAuthProxy** setting is enabled by default for Windows 7\. For Windows 8.1 computers, set the **DisableEnterpriseAuthProxy** setting to **0** (not disabled). For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688). | -| 31 - There is more than one instance of the Upgrade Readiness data collector running at the same time on this computer. Use Task Manager to check if **CompatTelRunner.exe** is running, and wait until it has completed to rerun the script. The Upgrade Readiness task is scheduled by default to run daily at 0300. | -| 32 - Appraiser version on the machine is outdated. | The configuration script detected a version of the compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Readiness solution. Use the latest version of the [compatibility update](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#deploy-the-compatibility-update-and-related-updates) for Windows 7 SP1/Windows 8.1. | -| 33 - **CompatTelRunner.exe** exited with an exit code | **CompatTelRunner.exe** runs the appraise task on the device. If it fails, it will provide a specific exit code. The script will return exit code 33 when **CompatTelRunner.exe** itself exits with an exit code. Check the logs for more details. Also see the **Note** following this table for additional steps to follow. | -| 34 - Function **CheckProxySettings** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 35 - Function **CheckAuthProxy** failed with an unexpected exception. Check the logs for the exception message and HResult. | -| 36 - Function **CheckAppraiserEndPointsConnectivity** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 37 - **Diagnose_internal.cmd** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 38 - Function **Get-SqmID** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 39 - For Windows 10: AllowTelemetry property is not set to 1 or higher at registry key path **HKLM:\SOFTWARE\Policies\Microsoft \Windows\DataCollection** or **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | For Windows 10 devices, the **AllowTelemetry** property should be set to 1 or greater to enable data collection. The script will return an error if this is not true. For more information, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization). | -| 40 - Function **CheckTelemetryOptIn** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 41 - The script failed to impersonate the currently logged on user. | The script mimics the UTC client to collect upgrade readiness data. When auth proxy is set, the UTC client impersonates the user that is logged on. The script also tries to mimic this, but the process failed. | -| 42 - Function **StartImpersonatingLoggedOnUser** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 43 - Function **EndImpersonatingLoggedOnUser** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 44 - Diagtrack.dll version is old, so Auth Proxy will not work. | Update the device using Windows Update or Windows Server Update Services. | -| 45 - Diagtrack.dll was not found. | Update the device using Windows Update or Windows Server Update Services. | -| 48 - **CommercialID** mentioned in RunConfig.bat should be a GUID. | Copy the commercial ID from your workspace. To find your commercial ID, first navigate to the Solutions tab for your workspace in Azure Portal, and then select the solution. From there, select the **Settings** page, where you can find and copy your commercial ID.| -| 50 - Diagtrack Service is not running. | The Diagtrack service is required to send data to Microsoft. Enable and run the "Connected User Experiences and Telemetry" service. | -| 51 - RunCensus failed with an unexpected exception. | RunCensus explitly runs the process used to collect device information. The method failed with an unexpected exception. The most common cause is incorrect setup of diagnostic data. Check the ExceptionHResult and ExceptionMessage for more details. | -| 52 - DeviceCensus.exe not found on a Windows 10 machine. | On computers running Windows 10, the process devicecensus.exe should be present in the \system32 directory. Error code 52 is returned if the process was not found. Ensure that it exists at the specified location. | -| 53 - There is a different CommercialID present at the GPO path: **HKLM:\SOFTWARE\Policies\Microsoft \Windows\DataCollection**. This will take precedence over the CommercialID provided in the script. | Provide the correct CommercialID at the GPO location. | -| 54 - Microsoft Account Sign In Assistant Service is Disabled. | This service is required for devices running Windows 10. The diagnostic data client relies on the Microsoft Account Sign In Assistant (MSA) to get the Global Device ID for the device. Without the MSA service running, the global device ID will not be generated and sent by the client and Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). | -| 55 - SetDeviceNameOptIn function failed to create registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | The function SetDeviceNameOptIn sets the registry key value which determines whether to send the device name in diagnostic data. The function tries to create the registry key path if it does not already exist. Verify that the account has the correct permissions to change or add registry keys. | -| 56 - SetDeviceNameOptIn function failed to create property AllowDeviceNameInTelemetry at registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | Verify that the account has the correct permissions to change or add registry keys.| -| 57 - SetDeviceNameOptIn function failed to update AllowDeviceNameInTelemetry property to value 1 at registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | Verify that the account has the correct permissions to change or add registry keys. | -| 58 - SetDeviceNameOptIn function failed with unexpected exception | The function SetDeviceNameOptIn failed with an unexpected exception. | -| 59 - CleanupOneSettings failed to delete LastPersistedEventTimeOrFirstBoot property at registry key path: **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\Diagtrack** |The CleanupOneSettings function clears some of the cached values needed by the Appraiser which is the data collector on the monitored device. This helps in the download of the most recent for accurate running of the data collector. Verify that the account has the correct permissions to change or add registry keys. | -| 60 - CleanupOneSettings failed to delete registry key: **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ Diagnostics\Diagtrack\SettingsRequests** | Verify that the account has the correct permissions to change or add registry keys. | -| 61 - CleanupOneSettings failed with an exception | CleanupOneSettings failed with an unexpected exception. | -| 62 - AllowTelemetry property value at registry key path **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** is not of type REG_DWORD. It should be of type REG_DWORD. | Ensure that the **AllowTelemetry** property at path **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** is a REG_DWORD. | -| 63 - Diagnostic data is disabled for the device | If AllowTelemetry equals **0**, devices cannot send diagnostic data. To resolve this, set the **AllowTelemetry** value at **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection**. | -| 64 - AllowTelemetry property value at registry key path **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection** is not of type REG_DWORD. It should be of type REG_DWORD. | Ensure that the **AllowTelemetry** property at **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection** is a REG_DWORD. | -| 65 - Diagnostic data is disabled for the device | If AllowTelemetry equals **0**, devices cannot send diagnostic data. To resolve this, set the **AllowTelemetry** value at **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection**. | -| 66 - All recent data uploads for the Universal Telemetry Client failed. | Review the UtcConnectionReport in WMI in the namespace **root\cimv2\mdm\dmmap** under the **MDM_Win32CompatibilityAppraiser_UniversalTelemetryClient01** class. Only SYSTEM has access to this class. Use [PSExec](https://docs.microsoft.com/sysinternals/downloads/psexec) to execute your WMI utility as SYSTEM. | -| 67 - CheckUtcCsp failed with an exception | There was an error reading the WIM/CIM class **MDM_Win32CompatibilityAppraiser_UniversalTelemetryClient01** in the namespace **root\cimv2\mdm\dmmap**. Review system for WMI errors. | - - - - - - -> [!NOTE] -> **Additional steps to follow if you receive exit code 33** -> -> Check the exit code for any of these messages: -> -> - CompatTelRunner.exe exited with last error code: 0x800703F1 -> - CompatTelRunner.exe exited with last error code: 0x80070005 -> - CompatTelRunner.exe exited with last error code: 0x80080005 ->  -> -> If the exit code includes any of those messages, then run these commands from an elevated command prompt: -> -> 1. Net stop diagtrack -> 2. Net stop pcasvc -> 3. Net stop dps -> 4. Del %windir%\appcompat\programs\amcache.hve -> 5. reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v AmiHivePermissionsCorrect /f -> 6. reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v LogFlags /t REG_DWORD /d 4 /f -> 7. Net start diagtrack -> 8. Net start pcasvc -> 9. Net start dps -> -> Then run the Enterprise Config script (RunConfig.bat) again. -> -> If the script still fails, then send mail to uasupport@microsoft.com including log files from the RunConfig.bat script. These log files are stored on the drive that is specified in the RunConfig.bat file. By default this is set to **%SystemDrive%\UADiagnostics**. The log file is named with the format **UA_yyyy_mm_dd_hh_mm_ss_machineID.txt**. There will be some additional logs generated under your **\\Windows\Temp** directory with the names similar to **AslLog_....txt**. You should send those logs as well. - +--- +title: Upgrade Readiness deployment script (Windows 10) +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Deployment script for Upgrade Readiness. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.topic: article +ms.collection: M365-analytics +--- + +# Upgrade Readiness deployment script + +To automate the steps provided in [Get started with Upgrade Readiness](upgrade-readiness-get-started.md), and to troubleshoot data sharing issues, you can run the [Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409), developed by Microsoft. + +>[!IMPORTANT] +>Upgrade Readiness was previously called Upgrade Analytics. References to Upgrade Analytics in any scripts or online content pertain to the Upgrade Readiness solution. + +>[!IMPORTANT] +>The latest version of the Upgrade Readiness Script is **2.4.4 - 10.10.2018** + +For detailed information about using the Upgrade Readiness (also known as upgrade analytics) deployment script, see the [Upgrade Analytics blog](https://techcommunity.microsoft.com/t5/Windows-Analytics-Blog/New-version-of-the-Upgrade-Analytics-Deployment-Script-available/ba-p/187164?advanced=false&collapse_discussion=true&q=new%20version%20of%20the%20upgrade%20analytics%20deployment%20script%20available&search_type=thread). + +> The following guidance applies to version **2.4.4 - 10.10.2018** of the Upgrade Readiness deployment script. If you are using an older version, download the latest from the [Download Center](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409). + +The Upgrade Readiness deployment script does the following: + +1. Sets commercial ID key + CommercialDataOptIn + RequestAllAppraiserVersions keys. +2. Verifies that user computers can send data to Microsoft. +3. Checks whether the computer has a pending restart.   +4. Verifies that the latest version of KB package 10.0.x is installed (version 10.0.14348 or later is required, but version 10.0.14913 or later is recommended). +5. If enabled, turns on verbose mode for troubleshooting. +6. Initiates the collection of the diagnostic data that Microsoft needs to assess your organization’s upgrade readiness. +7. If enabled, displays the script’s progress in a cmd window, providing you immediate visibility into issues (success or fail for each step) and/or writes to log file. + +## Running the script + +>There should be no performance impact caused by the script. The script is a light wrapper of Windows in-box components that undergo performance testing and optimization to avoid any performance impact. However, typically the script is scheduled to be run outside of working hours. +> +>Do not run the script at each sign-on. It is recommended to run the script once every 30 days. +> +>The length of time the script takes to run on each system depends on the number of apps and drivers, and the type of hardware. Anti-virus software scanning simultaneously can increase the script run time, but the script should require no longer than 10 minutes to run, and typically the time is much shorter. If the script is observed running for an extended period of time, please run the Pilot script, and collect logs to share with Microsoft. Log files are created in the drive that is specified in the RunConfig.bat file. By default this is set to: **%SystemDrive%\UADiagnostics**. + +To run the Upgrade Readiness deployment script: + +1. Download the [Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and extract the .zip file. Inside, there are two folders: **Pilot** and **Deployment**. The **Pilot** folder contains advanced logging that can help troubleshoot issues and is intended to be run from an elevated command prompt. The **Deployment** folder offers a lightweight script intended for broad deployment through ConfigMgr or other software deployment system. We recommend manually running the Pilot version of the script on 5-10 machines to verify that everything is configured correctly. Once you have confirmed that data is flowing successfully, proceed to run the Deployment version throughout your organization. + +2. Edit the following parameters in RunConfig.bat: + + 1. Provide a storage location for log information. You can store log information on a remote file share or a local directory. If the script is blocked from creating the log file for the given path, it creates the log files in the drive with the Windows directory. Example: %SystemDrive%\\UADiagnostics + + 2. Input your commercial ID key. To find your commercial ID, first navigate to the **Solutions** tab for your workspace, and then select the solution. From there, select the **Settings** page, where you can find and copy your commercial ID: + + 3. By default, the script sends log information to both the console and the log file. To change the default behavior, use one of the following options: + + > *logMode = 0 log to console only* + > + > *logMode = 1 log to file and console* + > + > *logMode = 2 log to file only* + +3. To enable Internet Explorer data collection, set AllowIEData to IEDataOptIn. By default, AllowIEData is set to Disable. Then use one of the following options to determine what Internet Explorer data can be collected: + + > *IEOptInLevel = 0 Internet Explorer data collection is disabled* + > + > *IEOptInLevel = 1 Data collection is enabled for sites in the Local intranet + Trusted sites + Machine local zones* + > + > *IEOptInLevel = 2 Data collection is enabled for sites in the Internet + Restricted sites zones* + > + > *IEOptInLevel = 3 Data collection is enabled for all sites* + +4. The deployment script is configured to collect and send diagnostic and debugging data to Microsoft. If you wish to disable sending diagnostic and debugging data to Microsoft, set **AppInsightsOptIn = false**. By default, **AppInsightsOptIn** is set to **true**. + + The data that is sent is the same data that is collected in the text log file that captures the events and error codes while running the script. This file is named in the following format: **UA_yyyy_mm_dd_hh_mm_ss_machineID.txt**. Log files are created in the drive that is specified in the RunConfig.bat file. By default this is set to: **%SystemDrive%\UADiagnostics**. + + This data gives us the ability to determine the status of your machines and to help troubleshoot issues. If you choose to opt-in to and send this data to Microsoft, you must also allow https traffic to be sent to the following wildcard endpoints: + + \*vortex\*.data.microsoft.com
                        + \*settings\*.data.microsoft.com + +5. The deployment script configures insider builds to continue to send the device name to the diagnostic data management service and the analytics portal. If you do not want to have insider builds send the device name sent to analytics and be available in the analytics portal, set **DeviceNAmeOptIn = false**. By default it is true, which preserves the behavior on previous versions of Windows. This setting only applies to insider builds. Note that the device name is also sent to AppInsights, so to ensure the device name is not sent to either place you would need to also set **AppInsightsOptIn = false**. + +6. After you finish editing the parameters in RunConfig.bat, you are ready to run the script. If you are using the Pilot version, run RunConfig.bat from an elevated command prompt. If you are using the Deployment version, use ConfigMgr or other software deployment service to run RunConfig.bat as system. + +## Exit codes + +The deployment script displays the following exit codes to let you know if it was successful, or if an error was encountered. + +| Exit code | Suggested fix | +|-----------|--------------| +| 0 - Success | N/A | +| 1 - Unexpected error occurred while executing the script. | The files in the deployment script are likely corrupted. Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966) from the download center and try again. | +| 2 - Error when logging to console. $logMode = 0. (console only) | Try changing the $logMode value to **1** and try again. $logMode value 1 logs to both console and file. | +| 3 - Error when logging to console and file. $logMode = 1. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. | +| 4 - Error when logging to file. $logMode = 2. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. | +| 5 - Error when logging to console and file. $logMode = unknown. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. | +| 6 - The commercialID parameter is set to unknown. | Modify the runConfig.bat file to set the CommercialID value. The value for parameter in the runconfig.bat file should match the Commercial ID key for your workspace. See [Generate your Commercial ID key](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#generate-your-commercial-id-key) for instructions on generating a Commercial ID key for your workspace. | +| 8 - Failure to create registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection**. The Commercial Id property is set at the following registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the context under which the script in running has access to the registry key. | +| 9 - The script failed to write Commercial Id to registry. +Error creating or updating registry key: **CommercialId** at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the context under which the script in running has access to the registry key. | +| 10 - Error when writing **CommercialDataOptIn** to the registry at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the deployment script is running in a context that has access to the registry key. | +| 11 - Function **SetupCommercialId** failed with an unexpected exception. The **SetupCommercialId** function updates the Commercial Id at the registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the configuration script has access to this location. | +| 12 - Can’t connect to Microsoft - Vortex. Check your network/proxy settings. | **Http Get** on the end points did not return a success exit code. For Windows 10, connectivity is verified by connecting to https://v10.vortex-win.data.microsoft.com/health/keepalive. For previous operating systems, connectivity is verified by connecting to https://vortex-win.data.microsoft.com/health/keepalive. If there is an error verifying connectivity, this will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md) | +| 13 - Can’t connect to Microsoft - setting. | An error occurred connecting to https://settings.data.microsoft.com/qos. This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#enable-data-sharing). Verify that the required endpoints are whitelisted correctly. See Whitelist select endpoints for more details. | +| 14 - Can’t connect to Microsoft - compatexchange. An error occurred connecting to [CompatibilityExchangeService.svc](https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc). | This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md). | +| 15 - Function CheckVortexConnectivity failed with an unexpected exception. | This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md). Check the logs for the exception message and the HResult. | +| 16 - The computer requires a reboot before running the script. | Restart the device to complete the installation of the compatibility update and related updates. Reboot the computer before running the Upgrade Readiness deployment script. | +| 17 - Function **CheckRebootRequired** failed with an unexpected exception. | Restart the device to complete installation of the compatibility update and related updates. Check the logs for the exception message and the HResult. | +|18 - Appraiser KBs not installed or **appraiser.dll** not found. | Either the Appraiser-related updates are not installed, or the **appraiser.dll** file was not found. For more information, see appraiser diagnostic data events and fields information in the [Data collection](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#data-collection-and-privacy) and privacy topic. | +| 19 - Function **CheckAppraiserKB**, which checks the compatibility update KBs, failed with unexpected exception. | Check the logs for the Exception message and HResult. The script will not run further if this error is not fixed. | +| 20 - An error occurred when creating or updating the registry key **RequestAllAppraiserVersions** at **HKLM:\SOFTWARE\Microsoft\WindowsNT \CurrentVersion\AppCompatFlags\Appraiser** | The registry key is required for data collection to work correctly. Verify that the script is running in a context that has access to the registry key. | +| 21 - Function **SetRequestAllAppraiserVersions** failed with an unexpected exception. | Check the logs for the exception message and HResult. | +| 22 - **RunAppraiser** failed with unexpected exception. | Check the logs for the exception message and HResult. Check the **%windir%\System32** directory for the file **CompatTelRunner.exe**. If the file does not exist, reinstall the required compatibility updates which include this file, and check your organization's Group Policy to verify it does not remove this file. | +| 23 - Error finding system variable **%WINDIR%**. | Verify that this environment variable is configured on the computer. | +| 24 - The script failed when writing **IEDataOptIn** to the registry. An error occurred when creating registry key **IEOptInLevel** at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | This is a required registry key for IE data collection to work correctly. Verify that the deployment script in running in a context that has access to the registry key. Check the logs for the exception message and HResult. | +| 25 - The function **SetIEDataOptIn** failed with unexpected exception. | Check the logs for the exception message and HResult. | +| 27 - The script is not running under **System** account. | The Upgrade Readiness configuration script must be run as **System**. | +| 28 - Could not create log file at the specified **logPath**. | Make sure the deployment script has access to the location specified in the **logPath** parameter. | +| 29 - Connectivity check failed for proxy authentication. | Install cumulative updates on the device and enable the **DisableEnterpriseAuthProxy** authentication proxy setting. The **DisableEnterpriseAuthProxy** setting is enabled by default for Windows 7\. For Windows 8.1 computers, set the **DisableEnterpriseAuthProxy** setting to **0** (not disabled). For more information on authentication proxy support, see [Authentication proxy support added in new version (12.28.16) of the Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?linkid=838688). | +| 30 - Connectivity check failed. Registry key property **DisableEnterpriseAuthProxy** is not enabled. | The **DisableEnterpriseAuthProxy** setting is enabled by default for Windows 7\. For Windows 8.1 computers, set the **DisableEnterpriseAuthProxy** setting to **0** (not disabled). For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688). | +| 31 - There is more than one instance of the Upgrade Readiness data collector running at the same time on this computer. Use Task Manager to check if **CompatTelRunner.exe** is running, and wait until it has completed to rerun the script. The Upgrade Readiness task is scheduled by default to run daily at 0300. | +| 32 - Appraiser version on the machine is outdated. | The configuration script detected a version of the compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Readiness solution. Use the latest version of the [compatibility update](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#deploy-the-compatibility-update-and-related-updates) for Windows 7 SP1/Windows 8.1. | +| 33 - **CompatTelRunner.exe** exited with an exit code | **CompatTelRunner.exe** runs the appraise task on the device. If it fails, it will provide a specific exit code. The script will return exit code 33 when **CompatTelRunner.exe** itself exits with an exit code. Check the logs for more details. Also see the **Note** following this table for additional steps to follow. | +| 34 - Function **CheckProxySettings** failed with an unexpected exception. | Check the logs for the exception message and HResult. | +| 35 - Function **CheckAuthProxy** failed with an unexpected exception. Check the logs for the exception message and HResult. | +| 36 - Function **CheckAppraiserEndPointsConnectivity** failed with an unexpected exception. | Check the logs for the exception message and HResult. | +| 37 - **Diagnose_internal.cmd** failed with an unexpected exception. | Check the logs for the exception message and HResult. | +| 38 - Function **Get-SqmID** failed with an unexpected exception. | Check the logs for the exception message and HResult. | +| 39 - For Windows 10: AllowTelemetry property is not set to 1 or higher at registry key path **HKLM:\SOFTWARE\Policies\Microsoft \Windows\DataCollection** or **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | For Windows 10 devices, the **AllowTelemetry** property should be set to 1 or greater to enable data collection. The script will return an error if this is not true. For more information, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization). | +| 40 - Function **CheckTelemetryOptIn** failed with an unexpected exception. | Check the logs for the exception message and HResult. | +| 41 - The script failed to impersonate the currently logged on user. | The script mimics the UTC client to collect upgrade readiness data. When auth proxy is set, the UTC client impersonates the user that is logged on. The script also tries to mimic this, but the process failed. | +| 42 - Function **StartImpersonatingLoggedOnUser** failed with an unexpected exception. | Check the logs for the exception message and HResult. | +| 43 - Function **EndImpersonatingLoggedOnUser** failed with an unexpected exception. | Check the logs for the exception message and HResult. | +| 44 - Diagtrack.dll version is old, so Auth Proxy will not work. | Update the device using Windows Update or Windows Server Update Services. | +| 45 - Diagtrack.dll was not found. | Update the device using Windows Update or Windows Server Update Services. | +| 48 - **CommercialID** mentioned in RunConfig.bat should be a GUID. | Copy the commercial ID from your workspace. To find your commercial ID, first navigate to the Solutions tab for your workspace in Azure Portal, and then select the solution. From there, select the **Settings** page, where you can find and copy your commercial ID.| +| 50 - Diagtrack Service is not running. | The Diagtrack service is required to send data to Microsoft. Enable and run the "Connected User Experiences and Telemetry" service. | +| 51 - RunCensus failed with an unexpected exception. | RunCensus explitly runs the process used to collect device information. The method failed with an unexpected exception. The most common cause is incorrect setup of diagnostic data. Check the ExceptionHResult and ExceptionMessage for more details. | +| 52 - DeviceCensus.exe not found on a Windows 10 machine. | On computers running Windows 10, the process devicecensus.exe should be present in the \system32 directory. Error code 52 is returned if the process was not found. Ensure that it exists at the specified location. | +| 53 - There is a different CommercialID present at the GPO path: **HKLM:\SOFTWARE\Policies\Microsoft \Windows\DataCollection**. This will take precedence over the CommercialID provided in the script. | Provide the correct CommercialID at the GPO location. | +| 54 - Microsoft Account Sign In Assistant Service is Disabled. | This service is required for devices running Windows 10. The diagnostic data client relies on the Microsoft Account Sign In Assistant (MSA) to get the Global Device ID for the device. Without the MSA service running, the global device ID will not be generated and sent by the client and Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). | +| 55 - SetDeviceNameOptIn function failed to create registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | The function SetDeviceNameOptIn sets the registry key value which determines whether to send the device name in diagnostic data. The function tries to create the registry key path if it does not already exist. Verify that the account has the correct permissions to change or add registry keys. | +| 56 - SetDeviceNameOptIn function failed to create property AllowDeviceNameInTelemetry at registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | Verify that the account has the correct permissions to change or add registry keys.| +| 57 - SetDeviceNameOptIn function failed to update AllowDeviceNameInTelemetry property to value 1 at registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | Verify that the account has the correct permissions to change or add registry keys. | +| 58 - SetDeviceNameOptIn function failed with unexpected exception | The function SetDeviceNameOptIn failed with an unexpected exception. | +| 59 - CleanupOneSettings failed to delete LastPersistedEventTimeOrFirstBoot property at registry key path: **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\Diagtrack** |The CleanupOneSettings function clears some of the cached values needed by the Appraiser which is the data collector on the monitored device. This helps in the download of the most recent for accurate running of the data collector. Verify that the account has the correct permissions to change or add registry keys. | +| 60 - CleanupOneSettings failed to delete registry key: **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ Diagnostics\Diagtrack\SettingsRequests** | Verify that the account has the correct permissions to change or add registry keys. | +| 61 - CleanupOneSettings failed with an exception | CleanupOneSettings failed with an unexpected exception. | +| 62 - AllowTelemetry property value at registry key path **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** is not of type REG_DWORD. It should be of type REG_DWORD. | Ensure that the **AllowTelemetry** property at path **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** is a REG_DWORD. | +| 63 - Diagnostic data is disabled for the device | If AllowTelemetry equals **0**, devices cannot send diagnostic data. To resolve this, set the **AllowTelemetry** value at **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection**. | +| 64 - AllowTelemetry property value at registry key path **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection** is not of type REG_DWORD. It should be of type REG_DWORD. | Ensure that the **AllowTelemetry** property at **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection** is a REG_DWORD. | +| 65 - Diagnostic data is disabled for the device | If AllowTelemetry equals **0**, devices cannot send diagnostic data. To resolve this, set the **AllowTelemetry** value at **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection**. | +| 66 - All recent data uploads for the Universal Telemetry Client failed. | Review the UtcConnectionReport in WMI in the namespace **root\cimv2\mdm\dmmap** under the **MDM_Win32CompatibilityAppraiser_UniversalTelemetryClient01** class. Only SYSTEM has access to this class. Use [PSExec](https://docs.microsoft.com/sysinternals/downloads/psexec) to execute your WMI utility as SYSTEM. | +| 67 - CheckUtcCsp failed with an exception | There was an error reading the WIM/CIM class **MDM_Win32CompatibilityAppraiser_UniversalTelemetryClient01** in the namespace **root\cimv2\mdm\dmmap**. Review system for WMI errors. | + + + + + + +> [!NOTE] +> **Additional steps to follow if you receive exit code 33** +> +> Check the exit code for any of these messages: +> +> - CompatTelRunner.exe exited with last error code: 0x800703F1 +> - CompatTelRunner.exe exited with last error code: 0x80070005 +> - CompatTelRunner.exe exited with last error code: 0x80080005 +>  +> +> If the exit code includes any of those messages, then run these commands from an elevated command prompt: +> +> 1. Net stop diagtrack +> 2. Net stop pcasvc +> 3. Net stop dps +> 4. Del %windir%\appcompat\programs\amcache.hve +> 5. reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v AmiHivePermissionsCorrect /f +> 6. reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v LogFlags /t REG_DWORD /d 4 /f +> 7. Net start diagtrack +> 8. Net start pcasvc +> 9. Net start dps +> +> Then run the Enterprise Config script (RunConfig.bat) again. +> +> If the script still fails, then contact support@microsoft.com and share the log files from the RunConfig.bat script. These log files are stored on the drive that is specified in the RunConfig.bat file. By default this is set to **%SystemDrive%\UADiagnostics**. The log file is named with the format **UA_yyyy_mm_dd_hh_mm_ss_machineID.txt**. There will be some additional logs generated under your **\\Windows\Temp** directory with the names similar to **AslLog_....txt**. You should send those logs as well. + diff --git a/windows/deployment/upgrade/upgrade-readiness-requirements.md b/windows/deployment/upgrade/upgrade-readiness-requirements.md index 3078890be7..582f5bb732 100644 --- a/windows/deployment/upgrade/upgrade-readiness-requirements.md +++ b/windows/deployment/upgrade/upgrade-readiness-requirements.md @@ -31,7 +31,7 @@ If you need to update user computers to Windows 7 SP1 or Windows 8.1, use Window > [!NOTE] > Upgrade Readiness is designed to best support in-place upgrades. In-place upgrades do not support migrations from BIOS to UEFI or from 32-bit to 64-bit architecture. If you need to migrate computers in these scenarios, use the wipe-and-reload method. Upgrade Readiness insights are still valuable in this scenario, however, you can ignore in-place upgrade specific guidance. -See [Windows 10 Specifications](https://www.microsoft.com/en-US/windows/windows-10-specifications) for additional information about computer system requirements. +See [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications) for additional information about computer system requirements. ### Windows 10 diff --git a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md b/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md index 671ba50c38..bb0ea00851 100644 --- a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md +++ b/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md @@ -1,63 +1,63 @@ ---- -title: Use Upgrade Readiness to manage Windows upgrades (Windows 10) -ms.reviewer: -manager: laurawi -description: Describes how to use Upgrade Readiness to manage Windows upgrades. -keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics, -ms.localizationpriority: medium -ms.prod: w10 -audience: itpro author: greg-lindsay -ms.author: greglin -ms.topic: article ---- - -# Use Upgrade Readiness to manage Windows upgrades - ->[!IMPORTANT] ->>**The OMS portal has been deprecated, so you need to switch to the [Azure portal](https://portal.azure.com) now.** The two portals offer the same experience, with some key differences. Learn how to use [Windows Analytics in the Azure Portal](../update/windows-analytics-azure-portal.md). Find out more about the [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition), or jump right in and [Get started with Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started). - -You can use Upgrade Readiness to prioritize and work through application and driver issues, assign and track issue resolution status, and identify computers that are ready to upgrade. Upgrade Readiness enables you to deploy Windows with confidence, knowing that you’ve addressed potential blocking issues. - -- Based on diagnostic data from user computers, Upgrade Readiness identifies application and driver compatibility issues that may block Windows upgrades, allowing you to make data-driven decisions about your organization’s upgrade readiness. -- Information is refreshed daily so you can monitor upgrade progress. Any changes your team makes, such as assigning application importance and marking applications as ready to upgrade, are reflected 24 hours after you make them. - -When you are ready to begin the upgrade process, a workflow is provided to guide you through critical high-level tasks. - -![Series of blades showing Upgrade Overview, Step 1: Identify Important Apps, Prioritize Applications, Step 2: Resolve issues, and Review applications with known issues](../images/ua-cg-15.png) - -Each step in the workflow is enumerated using blue tiles. Helpful data is provided on white tiles to help you get started, to monitor your progress, and to complete each step. - ->**Important**: You can use the [Target version](#target-version) setting to evaluate computers that are running a specified version of Windows before starting the Upgrade Readiness workflow. By default, the Target version is configured to the released version of Windows 10 for the Current Branch for Business (CBB). - -The following information and workflow is provided: - -- [Upgrade overview](upgrade-readiness-upgrade-overview.md): Review compatibility and usage information about computers, applications, and drivers. -- [Step 1: Identify important apps](upgrade-readiness-identify-apps.md): Assign importance levels to prioritize your applications. -- [Step 2: Resolve issues](upgrade-readiness-resolve-issues.md): Identify and resolve problems with applications. -- [Step 3: Deploy](upgrade-readiness-deploy-windows.md): Start the upgrade process. - -Also see the following topic for information about additional items that can be affected by the upgrade process: - -- [Additional insights](upgrade-readiness-additional-insights.md): Find out which MS Office add-ins are installed, and review web site activity. - -## Target version - -The target version setting is used to evaluate the number of computers that are already running the default version of Windows 10, or a later version. The target version of Windows 10 is displayed on the upgrade overview tile. See the following example: - -![Upgrade overview showing target version](../images/ur-target-version.png) - -The default target version in Upgrade Readiness is set to the released version of the Current Branch for Business (CBB). CBB can be determined by reviewing [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). The target version setting is used to evaluate the number of computers that are already running this version of Windows, or a later version. - -The number displayed under **Computers upgraded** in the Upgrade Overview blade is the total number of computers that are already running the same or a later version of Windows compared to the target version. It also is used in the evaluation of apps and drivers: Known issues and guidance for the apps and drivers in Upgrade Readiness is based on the target operating system version. - -You now have the ability to change the Windows 10 version you wish to target. The available options currently are: Windows 10 version 1507, Windows 10 version 1511, Windows 10 version 1607, Windows 10 version 1703, Windows 10 version 1709 and Windows 10 version 1803. - -To change the target version setting, click on **Solutions Settings**, which appears at the top when you open you Upgrade Readiness solution: - -![Upgrade Readiness dialog showing gear labeled Solution Settings](../images/ua-cg-08.png) - ->You must be signed in to Upgrade Readiness as an administrator to view settings. - -On the **Upgrade Readiness Settings** page, choose one of the options in the drop down box and click **Save**. The changes in the target version setting are reflected in evaluations when a new snapshot is uploaded to your workspace. - -![Upgrade Readiness Settings dialog showing gear labeled Save and arrow labeled Cancel](../images/ur-settings.png) +--- +title: Use Upgrade Readiness to manage Windows upgrades (Windows 10) +ms.reviewer: +manager: laurawi +description: Describes how to use Upgrade Readiness to manage Windows upgrades. +keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics, +ms.localizationpriority: medium +ms.prod: w10 +audience: itpro +author: jaimeo +ms.author: jaimeo +ms.topic: article +--- + +# Use Upgrade Readiness to manage Windows upgrades + +>[!IMPORTANT] +>>**The OMS portal has been deprecated, so you need to switch to the [Azure portal](https://portal.azure.com) now.** The two portals offer the same experience, with some key differences. Learn how to use [Windows Analytics in the Azure Portal](../update/windows-analytics-azure-portal.md). Find out more about the [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition), or jump right in and [Get started with Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started). + +You can use Upgrade Readiness to prioritize and work through application and driver issues, assign and track issue resolution status, and identify computers that are ready to upgrade. Upgrade Readiness enables you to deploy Windows with confidence, knowing that you’ve addressed potential blocking issues. + +- Based on diagnostic data from user computers, Upgrade Readiness identifies application and driver compatibility issues that may block Windows upgrades, allowing you to make data-driven decisions about your organization’s upgrade readiness. +- Information is refreshed daily so you can monitor upgrade progress. Any changes your team makes, such as assigning application importance and marking applications as ready to upgrade, are reflected 24 hours after you make them. + +When you are ready to begin the upgrade process, a workflow is provided to guide you through critical high-level tasks. + +![Series of blades showing Upgrade Overview, Step 1: Identify Important Apps, Prioritize Applications, Step 2: Resolve issues, and Review applications with known issues](../images/ua-cg-15.png) + +Blue tiles enumerate each step in the workflow. White tiles show data to help you get started, to monitor your progress, and to complete each step. +>**Important**: You can use the [Target version](#target-version) setting to evaluate computers that are running a specified version of Windows before starting the Upgrade Readiness workflow. By default, the Target version is configured to the released version of Windows 10 for the Semi-Annual Channel. + +The following information and workflow is provided: + +- [Upgrade overview](upgrade-readiness-upgrade-overview.md): Review compatibility and usage information about computers, applications, and drivers. +- [Step 1: Identify important apps](upgrade-readiness-identify-apps.md): Assign importance levels to prioritize your applications. +- [Step 2: Resolve issues](upgrade-readiness-resolve-issues.md): Identify and resolve problems with applications. +- [Step 3: Deploy](upgrade-readiness-deploy-windows.md): Start the upgrade process. + +Also see the following topic for information about additional items that can be affected by the upgrade process: + +- [Additional insights](upgrade-readiness-additional-insights.md): Find out which MS Office add-ins are installed, and review web site activity. + +## Target version + +The target version setting is used to evaluate the number of computers that are already running the default version of Windows 10, or a later version. The target version of Windows 10 is displayed on the upgrade overview tile. See the following example: + +![Upgrade overview showing target version](../images/ur-target-version.png) + +The default target version in Upgrade Readiness is set to the released version of the Semi-Annual Channel. Check [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx) to learn the current version in the Semi-Annual Channel. The target version setting is used to evaluate the number of computers that are already running this version of Windows, or a later version. + +The number displayed under **Computers upgraded** in the Upgrade Overview blade is the total number of computers that are already running the same or a later version of Windows compared to the target version. It also is used in the evaluation of apps and drivers: Known issues and guidance for the apps and drivers in Upgrade Readiness is based on the target operating system version. + +You can change the Windows 10 version you want to target. All currently supported versions of Windows 10 are available options. + +To change the target version setting, click on **Solutions Settings**, which appears at the top when you open you Upgrade Readiness solution: + +![Upgrade Readiness dialog showing gear labeled Solution Settings](../images/ua-cg-08.png) + +>You must be signed in to Upgrade Readiness as an administrator to view settings. + +On the **Upgrade Readiness Settings** page, choose one of the options in the drop down box and click **Save**. The changes in the target version setting are reflected in evaluations when a new snapshot is uploaded to your workspace. + +![Upgrade Readiness Settings dialog showing gear labeled Save and arrow labeled Cancel](../images/ur-settings.png) diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index 72345c3d54..d683bd63b3 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -138,7 +138,7 @@ Downgrading from Enterprise - Upgrade edition: **Enterprise** - Valid downgrade paths: **Pro, Pro for Workstations, Pro Education, Education** -You can move directly from Enterprise to any valid destination edition. In this example, downgrading to Pro for Workstations, Pro Education, or Education requires an additional activation key to supersede the firmware-embedded Pro key. In all cases, you must comply with [Microsoft License Terms](https://www.microsoft.com/useterms). If you are a volume license customer, refer to the [Microsoft Volume Licensing Reference Guide](https://www.microsoft.com/en-us/download/details.aspx?id=11091). +You can move directly from Enterprise to any valid destination edition. In this example, downgrading to Pro for Workstations, Pro Education, or Education requires an additional activation key to supersede the firmware-embedded Pro key. In all cases, you must comply with [Microsoft License Terms](https://www.microsoft.com/useterms). If you are a volume license customer, refer to the [Microsoft Volume Licensing Reference Guide](https://www.microsoft.com/download/details.aspx?id=11091). ### Supported Windows 10 downgrade paths diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md index cf9e600103..c5cc2c3ba1 100644 --- a/windows/deployment/upgrade/windows-10-upgrade-paths.md +++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md @@ -1,283 +1,284 @@ ---- -title: Windows 10 upgrade paths (Windows 10) -ms.reviewer: -manager: laurawi -ms.author: greglin -description: You can upgrade to Windows 10 from a previous version of Windows if the upgrade path is supported. -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.localizationpriority: medium -ms.pagetype: mobile -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows 10 upgrade paths -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -## Upgrade paths - -This topic provides a summary of available upgrade paths to Windows 10. You can upgrade to Windows 10 from Windows 7 or a later operating system. This includes upgrading from one release of Windows 10 to later release of Windows 10. Migrating from one edition of Windows 10 to a different edition of the same release is also supported. For more information about migrating to a different edition of Windows 10, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md). - -> **Windows 10 version upgrade**: You can directly upgrade a supported version of Windows 10 to a newer version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information. -> -> **Windows 10 LTSC/LTSB**: Due to [naming changes](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes), product versions that display Windows 10 LTSB will be replaced with Windows 10 LTSC in subsequent feature updates. The term LTSC is used here to refer to all long term servicing versions. -> -> In-place upgrade from Windows 7, Windows 8.1, or [Windows 10 semi-annual channel](https://docs.microsoft.com/windows/release-information/) to Windows 10 LTSC is not supported. **Note**: Windows 10 LTSC 2015 did not block this upgrade path. This was corrected in the Windows 10 LTSC 2016 release, which will now only allow data-only and clean install options. You can upgrade from Windows 10 LTSC to Windows 10 semi-annual channel, provided that you upgrade to the same or a newer build version. For example, Windows 10 Enterprise 2016 LTSB can be upgraded to Windows 10 Enterprise version 1607 or later. Upgrade is supported using the in-place upgrade process (using Windows setup). -> -> **Windows N/KN**: Windows "N" and "KN" SKUs (editions without media-related functionality) follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process. -> -> **Windows 8.0**: You cannot upgrade directly from Windows 8.0 to Windows 10. To upgrade from Windows 8.0, you must first install the [Windows 8.1 update](https://support.microsoft.com/help/15356/windows-8-install-update-kb-2919355). - -✔ = Full upgrade is supported including personal data, settings, and applications.
                        -D = Edition downgrade; personal data is maintained, applications and settings are removed. - -
                        - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                              Windows 10 HomeWindows 10 ProWindows 10 Pro EducationWindows 10 EducationWindows 10 EnterpriseWindows 10 MobileWindows 10 Mobile Enterprise
                        Windows 7
                        Starter✔✔✔✔
                        Home Basic✔✔✔✔
                        Home Premium✔✔✔✔
                        ProfessionalD✔✔✔✔
                        UltimateD✔✔✔✔
                        Enterprise✔✔
                        Windows 8.1
                        (Core)✔✔✔✔
                        Connected✔✔✔✔
                        ProD✔✔✔✔
                        Pro StudentD✔✔✔✔
                        Pro WMCD✔✔✔✔
                        Enterprise✔✔
                        Embedded Industry✔
                        Windows RT
                        Windows Phone 8.1✔
                        Windows 10
                        Home✔✔✔
                        ProD✔✔✔
                        EducationD
                        Enterprise✔
                        Mobile✔
                        Mobile EnterpriseD
                        - - -## Related Topics - -[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
                        -[Windows upgrade and migration considerations](windows-upgrade-and-migration-considerations.md)
                        -[Windows 10 edition upgrade](windows-10-edition-upgrades.md) - - - - - +--- +title: Windows 10 upgrade paths (Windows 10) +ms.reviewer: +manager: laurawi +ms.author: greglin +description: You can upgrade to Windows 10 from a previous version of Windows if the upgrade path is supported. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.localizationpriority: medium +ms.pagetype: mobile +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows 10 upgrade paths +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +## Upgrade paths + +This topic provides a summary of available upgrade paths to Windows 10. You can upgrade to Windows 10 from Windows 7 or a later operating system. This includes upgrading from one release of Windows 10 to later release of Windows 10. Migrating from one edition of Windows 10 to a different edition of the same release is also supported. For more information about migrating to a different edition of Windows 10, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md). + +> **Windows 10 version upgrade**: You can directly upgrade any semi-annual channel version of Windows 10 to a newer, supported semi-annual channel version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information. +> +> **Windows 10 LTSC/LTSB**: Due to [naming changes](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes), product versions that display Windows 10 LTSB will be replaced with Windows 10 LTSC in subsequent feature updates. The term LTSC is used here to refer to all long term servicing versions. +> +> In-place upgrade from Windows 7, Windows 8.1, or [Windows 10 semi-annual channel](https://docs.microsoft.com/windows/release-information/) to Windows 10 LTSC is not supported. **Note**: Windows 10 LTSC 2015 did not block this upgrade path. This was corrected in the Windows 10 LTSC 2016 release, which will now only allow data-only and clean install options. You can upgrade from Windows 10 LTSC to Windows 10 semi-annual channel, provided that you upgrade to the same or a newer build version. For example, Windows 10 Enterprise 2016 LTSB can be upgraded to Windows 10 Enterprise version 1607 or later. Upgrade is supported using the in-place upgrade process (using Windows setup). You will need to use the Product Key switch if you want to keep your apps. If you don't use the switch the option 'Keep personal files and apps' will be grayed out. The command line would be **setup.exe /pkey xxxxx-xxxxx-xxxxx-xxxxx-xxxxx**, using your relevant Windows 10 SAC product key. For example, if using a KMS, the command line would be **setup.exe /pkey NPPR9-FWDCX-D2C8J-H872K-2YT43**. +> +> **Windows N/KN**: Windows "N" and "KN" SKUs (editions without media-related functionality) follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process. +> +> **Windows 8.0**: You cannot upgrade directly from Windows 8.0 to Windows 10. To upgrade from Windows 8.0, you must first install the [Windows 8.1 update](https://support.microsoft.com/help/15356/windows-8-install-update-kb-2919355). + +✔ = Full upgrade is supported including personal data, settings, and applications.
                        +D = Edition downgrade; personal data is maintained, applications and settings are removed. + +
                        + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows 10 HomeWindows 10 ProWindows 10 Pro EducationWindows 10 EducationWindows 10 EnterpriseWindows 10 MobileWindows 10 Mobile Enterprise
                        Windows 7
                        Starter✔✔✔✔
                        Home Basic✔✔✔✔
                        Home Premium✔✔✔✔
                        ProfessionalD✔✔✔✔
                        UltimateD✔✔✔✔
                        Enterprise✔✔
                        Windows 8.1
                        (Core)✔✔✔✔
                        Connected✔✔✔✔
                        ProD✔✔✔✔
                        Pro StudentD✔✔✔✔
                        Pro WMCD✔✔✔✔
                        Enterprise✔✔
                        Embedded Industry✔
                        Windows RT
                        Windows Phone 8.1✔
                        Windows 10
                        Home✔✔✔
                        ProD✔✔✔
                        EducationD
                        Enterprise✔
                        Mobile✔
                        Mobile EnterpriseD
                        + + +## Related Topics + +[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
                        +[Windows upgrade and migration considerations](windows-upgrade-and-migration-considerations.md)
                        +[Windows 10 edition upgrade](windows-10-edition-upgrades.md) + + + + + diff --git a/windows/deployment/upgrade/windows-error-reporting.md b/windows/deployment/upgrade/windows-error-reporting.md index f0f918ef4a..77f1ae38b0 100644 --- a/windows/deployment/upgrade/windows-error-reporting.md +++ b/windows/deployment/upgrade/windows-error-reporting.md @@ -68,6 +68,6 @@ The event will also contain links to log files that can be used to perform a det [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -[Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/usmt/offline-migration-reference.md b/windows/deployment/usmt/offline-migration-reference.md index 8e45d24439..2eab7ea7b8 100644 --- a/windows/deployment/usmt/offline-migration-reference.md +++ b/windows/deployment/usmt/offline-migration-reference.md @@ -1,268 +1,269 @@ ---- -title: Offline Migration Reference (Windows 10) -description: Offline Migration Reference -ms.assetid: f347547c-d601-4c3e-8f2d-0138edeacfda -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Offline Migration Reference - - -Offline migration enables the ScanState tool to run inside a different Windows® operating system than the Windows operating system from which ScanState is gathering files and settings. There are two primary offline scenarios: - -- **Windows PE.** The ScanState tool can be run from within Windows PE, gathering files and settings from the offline Windows operating system on that machine. - -- **Windows.old.** The ScanState tool can now gather files and settings from the Windows.old directory that is created during Windows installation on a partition that contains a previous installation of Windows. For example, the ScanState tool can run in Windows 10, gathering files from a previous Windows 7or Windows 8 installation contained in the Windows.old directory. - -When you use User State Migration Tool (USMT) 10.0 to gather and restore user state, offline migration reduces the cost of deployment by: - -- **Reducing complexity.** In computer-refresh scenarios, migrations from the Windows.old directory reduce complexity by eliminating the need for the ScanState tool to be run before the operating system is deployed. Also, migrations from the Windows.old directory enable ScanState and LoadState to be run successively. - -- **Improving performance.** When USMT runs in an offline Windows Preinstallation Environment (WinPE) environment, it has better access to the hardware resources. This may increase performance on older machines with limited hardware resources and numerous installed software applications. - -- **New recovery scenario.** In scenarios where a machine no longer restarts properly, it might be possible to gather user state with the ScanState tool from within WinPE. - -## In This Topic - - -- [What Will Migrate Offline?](#bkmk-whatwillmigrate) - -- [What Offline Environments are Supported?](#bkmk-offlineenvironments) - -- [User-Group Membership and Profile Control](#bkmk-usergroupmembership) - -- [Command-Line Options](#bkmk-commandlineoptions) - -- [Environment Variables](#bkmk-environmentvariables) - -- [Offline.xml Elements](#bkmk-offlinexml) - -## What Will Migrate Offline? - - -The following user data and settings migrate offline, similar to an online migration: - -- Data and registry keys specified in MigXML - -- User accounts - -- Application settings - -- Limited set of operating-system settings - -- EFS files - -- Internet Explorer® Favorites - -For exceptions to what you can migrate offline, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) - -## What Offline Environments are Supported? - - -The following table defines the supported combination of online and offline operating systems in USMT. - - ---- - - - - - - - - - - - - - - - - -
                        Running Operating SystemOffline Operating System

                        WinPE 5.0 or greater, with the MSXML library

                        Windows Vista, Windows 7, Windows 8, Windows 10

                        Windows 7, Windows 8, Windows 10

                        Windows.old directory

                        - - - -**Note**   -It is possible to run the ScanState tool while the drive remains encrypted by suspending Windows BitLocker Drive Encryption before booting into WinPE. For more information, see [this Microsoft site](https://go.microsoft.com/fwlink/p/?LinkId=190314). - - - -## User-Group Membership and Profile Control - - -User-group membership is not preserved during offline migrations. You must configure a **<ProfileControl>** section in the Config.xml file to specify the groups that the migrated users should be made members of. The following example places all migrated users into the Users group: - -``` syntax - - - - - - - * - - - - - - -``` - -For information about the format of a Config.xml file, see [Config.xml File](usmt-configxml-file.md). - -## Command-Line Options - - -An offline migration can either be enabled by using a configuration file on the command line, or by using one of the following command line options: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
                        ComponentOptionDescription

                        ScanState.exe

                        /offline:<path to offline.xml>

                        This command-line option enables the offline-migration mode and requires a path to an Offline.xml configuration file.

                        ScanState.exe

                        /offlineWinDir:<Windows directory>

                        This command-line option enables the offline-migration mode and starts the migration from the location specified. It is only for use in WinPE offline scenarios where the migration is occurring from a Windows directory.

                        ScanState.exe

                        /OfflineWinOld:<Windows.old directory>

                        This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.

                        - - - -You can use only one of the **/offline**,**/offlineWinDir** , or **/OfflineWinOld** command-line options at a time; USMT does not support using more than one together. - -## Environment Variables - - -The following system environment variables are necessary in the scenarios outlined below. - - ----- - - - - - - - - - - - - - - - - - - - -
                        VariableValueScenario

                        USMT_WORKING_DIR

                        Full path to a working directory

                        Required when USMT binaries are located on read-only media, which does not support the creation of log files or temporary storage. To set the system environment variable, at a command prompt type the following:

                        -
                        Set USMT_WORKING_DIR=[path to working directory]

                        MIG_OFFLINE_PLATFORM_ARCH

                        32 or 64

                        While operating offline, this environment variable defines the architecture of the offline system, if the system does not match the WinPE and Scanstate.exe architecture. This environment variable enables the 32-bit ScanState application to gather data from a computer with 64-bit architecture, or the 64-bit ScanState application to gather data from a computer with 32-bit architecture. This is required when auto-detection of the offline architecture doesn’t function properly, for example, when the source system is running a 64-bit version of Windows XP. For example, to set this system environment variable for a 32-bit architecture, at a command prompt type the following:

                        -
                        Set MIG_OFFLINE_PLATFORM_ARCH=32
                        - - - -## Offline.xml Elements - - -Use an offline.xml file when running the ScanState tool on a computer that has multiple Windows directories. The offline.xml file specifies which directories to scan for windows files. An offline.xml file can be used with the /offline option as an alternative to specifying a single Windows directory path with the /offlineDir option. - -### <offline> - -This element contains other elements that define how an offline migration is to be performed. - -Syntax: <offline> </offline> - -### <winDir> - -This element is a required child of **<offline>** and contains information about how the offline volume can be selected. The migration will be performed from the first element of **<winDir>** that contains a valid Windows system volume. - -Syntax: < winDir > </ winDir > - -### <path> - -This element is a required child of **<winDir>** and contains a file path pointing to a valid Windows directory. Relative paths are interpreted from the ScanState tool’s working directory. - -Syntax: <path> c:\\windows </path> - --or- - -Syntax, when used with the **<mappings>** element: <path> C:\\, D:\\ </path> - -### <mappings> - -This element is an optional child of **<offline>**. When specified, the **<mappings>** element will override the automatically detected WinPE drive mappings. Each child **<path>** element will provide a mapping from one system volume to another. Additionally, mappings between folders can be provided, since an entire volume can be mounted to a specific folder. - -Syntax: <mappings> </mappings> - -### <failOnMultipleWinDir> - -This element is an optional child of **<offline>**. The **<failOnMultipleWinDir>** element allows the user to specify that the migration should fail when USMT detects that there are multiple instances of Windows installed on the source machine. When the **<failOnMultipleWinDir>** element isn’t present, the default behavior is that the migration does not fail. - -Syntax: <failOnMultipleWinDir>1</failOnMultipleWinDir> or Syntax: <failOnMultipleWinDir>0</failOnMultipleWinDir> - -### Offline .xml Example - -The following XML example illustrates some of the elements discussed earlier in this topic. - -``` syntax - - - C:\Windows - D:\Windows - E:\ - - 1 - -``` - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md) - - - - - - - - - +--- +title: Offline Migration Reference (Windows 10) +description: Offline Migration Reference +ms.assetid: f347547c-d601-4c3e-8f2d-0138edeacfda +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Offline Migration Reference + + +Offline migration enables the ScanState tool to run inside a different Windows® operating system than the Windows operating system from which ScanState is gathering files and settings. There are two primary offline scenarios: + +- **Windows PE.** The ScanState tool can be run from within Windows PE, gathering files and settings from the offline Windows operating system on that machine. + +- **Windows.old.** The ScanState tool can now gather files and settings from the Windows.old directory that is created during Windows installation on a partition that contains a previous installation of Windows. For example, the ScanState tool can run in Windows 10, gathering files from a previous Windows 7or Windows 8 installation contained in the Windows.old directory. + +When you use User State Migration Tool (USMT) 10.0 to gather and restore user state, offline migration reduces the cost of deployment by: + +- **Reducing complexity.** In computer-refresh scenarios, migrations from the Windows.old directory reduce complexity by eliminating the need for the ScanState tool to be run before the operating system is deployed. Also, migrations from the Windows.old directory enable ScanState and LoadState to be run successively. + +- **Improving performance.** When USMT runs in an offline Windows Preinstallation Environment (WinPE) environment, it has better access to the hardware resources. This may increase performance on older machines with limited hardware resources and numerous installed software applications. + +- **New recovery scenario.** In scenarios where a machine no longer restarts properly, it might be possible to gather user state with the ScanState tool from within WinPE. + +## In This Topic + + +- [What Will Migrate Offline?](#bkmk-whatwillmigrate) + +- [What Offline Environments are Supported?](#bkmk-offlineenvironments) + +- [User-Group Membership and Profile Control](#bkmk-usergroupmembership) + +- [Command-Line Options](#bkmk-commandlineoptions) + +- [Environment Variables](#bkmk-environmentvariables) + +- [Offline.xml Elements](#bkmk-offlinexml) + +## What Will Migrate Offline? + + +The following user data and settings migrate offline, similar to an online migration: + +- Data and registry keys specified in MigXML + +- User accounts + +- Application settings + +- Limited set of operating-system settings + +- EFS files + +- Internet Explorer® Favorites + +For exceptions to what you can migrate offline, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) + +## What Offline Environments are Supported? + + +The following table defines the supported combination of online and offline operating systems in USMT. + + ++++ + + + + + + + + + + + + + + + + +
                        Running Operating SystemOffline Operating System

                        WinPE 5.0 or greater, with the MSXML library

                        Windows Vista, Windows 7, Windows 8, Windows 10

                        Windows 7, Windows 8, Windows 10

                        Windows.old directory

                        + + + +**Note**   +It is possible to run the ScanState tool while the drive remains encrypted by suspending Windows BitLocker Drive Encryption before booting into WinPE. For more information, see [this Microsoft site](https://go.microsoft.com/fwlink/p/?LinkId=190314). + + + +## User-Group Membership and Profile Control + + +User-group membership is not preserved during offline migrations. You must configure a **<ProfileControl>** section in the Config.xml file to specify the groups that the migrated users should be made members of. The following example places all migrated users into the Users group: + +``` xml + + + + + + + * + + + + + + +``` + +For information about the format of a Config.xml file, see [Config.xml File](usmt-configxml-file.md). + +## Command-Line Options + + +An offline migration can either be enabled by using a configuration file on the command line, or by using one of the following command line options: + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +
                        ComponentOptionDescription

                        ScanState.exe

                        /offline:<path to offline.xml>

                        This command-line option enables the offline-migration mode and requires a path to an Offline.xml configuration file.

                        ScanState.exe

                        /offlineWinDir:<Windows directory>

                        This command-line option enables the offline-migration mode and starts the migration from the location specified. It is only for use in WinPE offline scenarios where the migration is occurring from a Windows directory.

                        ScanState.exe

                        /OfflineWinOld:<Windows.old directory>

                        This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.

                        + + + +You can use only one of the **/offline**,**/offlineWinDir** , or **/OfflineWinOld** command-line options at a time; USMT does not support using more than one together. + +## Environment Variables + + +The following system environment variables are necessary in the scenarios outlined below. + + +++++ + + + + + + + + + + + + + + + + + + + +
                        VariableValueScenario

                        USMT_WORKING_DIR

                        Full path to a working directory

                        Required when USMT binaries are located on read-only media, which does not support the creation of log files or temporary storage. To set the system environment variable, at a command prompt type the following:

                        +
                        Set USMT_WORKING_DIR=[path to working directory]

                        MIG_OFFLINE_PLATFORM_ARCH

                        32 or 64

                        While operating offline, this environment variable defines the architecture of the offline system, if the system does not match the WinPE and Scanstate.exe architecture. This environment variable enables the 32-bit ScanState application to gather data from a computer with 64-bit architecture, or the 64-bit ScanState application to gather data from a computer with 32-bit architecture. This is required when auto-detection of the offline architecture doesn’t function properly, for example, when the source system is running a 64-bit version of Windows XP. For example, to set this system environment variable for a 32-bit architecture, at a command prompt type the following:

                        +
                        Set MIG_OFFLINE_PLATFORM_ARCH=32
                        + + + +## Offline.xml Elements + + +Use an offline.xml file when running the ScanState tool on a computer that has multiple Windows directories. The offline.xml file specifies which directories to scan for windows files. An offline.xml file can be used with the /offline option as an alternative to specifying a single Windows directory path with the /offlineDir option. + +### <offline> + +This element contains other elements that define how an offline migration is to be performed. + +Syntax: <offline> </offline> + +### <winDir> + +This element is a required child of **<offline>** and contains information about how the offline volume can be selected. The migration will be performed from the first element of **<winDir>** that contains a valid Windows system volume. + +Syntax: < winDir > </ winDir > + +### <path> + +This element is a required child of **<winDir>** and contains a file path pointing to a valid Windows directory. Relative paths are interpreted from the ScanState tool’s working directory. + +Syntax: <path> c:\\windows </path> + +-or- + +Syntax, when used with the **<mappings>** element: <path> C:\\, D:\\ </path> + +### <mappings> + +This element is an optional child of **<offline>**. When specified, the **<mappings>** element will override the automatically detected WinPE drive mappings. Each child **<path>** element will provide a mapping from one system volume to another. Additionally, mappings between folders can be provided, since an entire volume can be mounted to a specific folder. + +Syntax: <mappings> </mappings> + +### <failOnMultipleWinDir> + +This element is an optional child of **<offline>**. The **<failOnMultipleWinDir>** element allows the user to specify that the migration should fail when USMT detects that there are multiple instances of Windows installed on the source machine. When the **<failOnMultipleWinDir>** element isn’t present, the default behavior is that the migration does not fail. + +Syntax: <failOnMultipleWinDir>1</failOnMultipleWinDir> or Syntax: <failOnMultipleWinDir>0</failOnMultipleWinDir> + +### Offline .xml Example + +The following XML example illustrates some of the elements discussed earlier in this topic. + +``` xml + + + C:\Windows + D:\Windows + E:\ + + 1 + +``` + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md) + + + + + + + + + diff --git a/windows/deployment/usmt/understanding-migration-xml-files.md b/windows/deployment/usmt/understanding-migration-xml-files.md index 6b8d904b03..bc484bd496 100644 --- a/windows/deployment/usmt/understanding-migration-xml-files.md +++ b/windows/deployment/usmt/understanding-migration-xml-files.md @@ -1,541 +1,542 @@ ---- -title: Understanding Migration XML Files (Windows 10) -description: Understanding Migration XML Files -ms.assetid: d3d1fe89-085c-4da8-9657-fd54b8bfc4b7 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Understanding Migration XML Files - - -You can modify the behavior of a basic User State Migration Tool (USMT)10.0 migration by using XML files; these files provide instructions on where and how the USMT tools should gather and apply files and settings. USMT includes three XML files that you can use to customize a basic migration: the MigDocs.xml and MigUser.xml files, which modify how files are discovered on the source computer, and the MigApps.xml file, which is required in order to migrate supported application settings. You can also create and edit custom XML files and a Config.xml file to further customize your migration. - -This topic provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file. The MigDocs.xml file uses the new **GenerateDocPatterns** function available in USMT to automatically find user documents on a source computer. - -## In This Topic - - -[Overview of the Config.xml file](#bkmk-config) - -[Overview of the MigApp.xml file](#bkmk-migapp) - -[Overview of the MigDocs.xml file](#bkmk-migdocs) - -[Overview of the MigUser.xml file](#bkmk-miguser) - -[Using multiple XML files](#bkmk-multiple) - -[XML rules for migrating user files](#bkmk-userfiles) - -[The GenerateDocPatterns function](#bkmk-generate) - -[Understanding the system and user context](#bkmk-context) - -[Sample migration rules for customized versions of XML files](#bkmk-samples) - -[Exclude rules usage examples](#bkmk-exclude) - -[Include rules usage examples](#bkmk-include) - -[Next Steps](#bkmk-next) - -## Overview of the Config.xml file - - -The Config.xml file is the configuration file created by the `/genconfig` option of the ScanState tool; it can be used to modify which operating-system components are migrated by USMT. The Config.xml file can be used in conjunction with other XML files, such as in the following example: `scanstate /i:migapps.xml /i:migdocs.xml /genconfig:c:\myFolder\config.xml`. When used this way, the Config.xml file tightly controls aspects of the migration, including user profiles, data, and settings, without modifying or creating other XML files. For more information about the Config.xml file, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [Config.xml File](usmt-configxml-file.md). - -**Note**   -When modifying the XML elements in the Config.xml file, you should edit an element and set the **migrate** property to **no**, rather than deleting the element from the file. If you delete the element instead of setting the property, the component may still be migrated by rules in other XML files. - - - -## Overview of the MigApp.xml file - - -The MigApp.xml file installed with USMT includes instructions to migrate the settings for the applications listed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md). You must include the MigApp.xml file when using the ScanState and LoadState tools, by using the `/i` option in order to migrate application settings. The MigDocs.xml and MigUser.xml files do not migrate application settings. You can create a custom XML file to include additional applications. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md). - -**Important**   -The MigApps.xml file will only detect and migrate .pst files that are linked to Microsoft Office Outlook. See the [Sample migration rules for customized versions of XML files](#bkmk-samples) section of this document for more information about migrating .pst files that are not linked to Outlook. - - - -## Overview of the MigDocs.xml file - - -The MigDocs.xml file uses the new **GenerateDocPatterns** helper function to create instructions for USMT to migrate files from the source computer, based on the location of the files. You can use the MigDocs.xml file with the ScanState and LoadState tools to perform a more targeted migration than using USMT without XML instructions. - -The default MigDocs.xml file migrates the following: - -- All files on the root of the drive except %WINDIR%, %PROGRAMFILES%, %PROGRAMDATA%, or %USERS%. - -- All folders in the root directory of all fixed drives. For example: c:\\data\_mail\\\*\[\*\] - -- All files from the root of the Profiles folder, except for files in the system profile. For example: c:\\users\\name\[mail.pst\] - -- All folders from the root of the Profiles folder, except for the system-profile folders. For example: c:\\users\\name\\new folder\\\*\[\*\] - -- Standard shared folders: - - - CSIDL\_COMMON\_DESKTOPDIRECTORY - - - CSIDL\_COMMON\_FAVORITES - - - CSIDL\_COMMON\_DOCUMENTS - - - CSIDL\_COMMON\_MUSIC - - - CSIDL\_COMMON\_PICTURES - - - CSIDL\_COMMON\_VIDEO - - - FOLDERID\_PublicDownloads - -- Standard user-profile folders for each user: - - - CSIDL\_MYDOCUMENTS - - - CSIDL\_MYPICTURES - - - FOLDERID\_OriginalImages - - - CSIDL\_MYMUSIC - - - CSIDL\_MYVIDEO - - - CSIDL\_FAVORITES - - - CSIDL\_DESKTOP - - - CSIDL\_QUICKLAUNCH - - - FOLDERID\_Contacts - - - FOLDERID\_Libraries - - - FOLDERID\_Downloads - - - FOLDERID\_SavedGames - - - FOLDERID\_RecordedTV - -The default MigDocs.xml file will not migrate the following: - -- Files tagged with both the **hidden** and **system** attributes. - -- Files and folders on removable drives. - -- Data from the %WINDIR%, %PROGRAMDATA%, and %PROGRAMFILES% folders. - -- Folders that contain installed applications. - -You can also use the **/genmigxml** option with the ScanState tool to review and modify what files will be migrated. - -## Overview of the MigUser.xml file - - -The MigUser.xml file includes instructions for USMT to migrate user files based on file name extensions. You can use the MigUser.xml file with the ScanState and LoadState tools to perform a more targeted migration than using USMT without XML instructions. The MigUser.xml file will gather all files from the standard user-profile folders, as well as any files on the computer with the specified file name extensions. - -The default MigUser.xml file migrates the following: - -- All files from the standard user-profile folders which are described as: - - - CSIDL\_MYVIDEO - - - CSIDL\_MYMUSIC - - - CSIDL\_DESKTOP - - - CSIDL\_STARTMENU - - - CSIDL\_PERSONAL - - - CSIDL\_MYPICTURES - - - CSIDL\_FAVORITES - - - CSIDL\_QUICK LAUNCH - -- Files with the following extensions: - - .qdf, .qsd, .qel, .qph, .doc\*, .dot\*, .rtf, .mcw, .wps, .scd, .wri, .wpd, .xl\*, .csv, .iqy, .dqy, .oqy, .rqy, .wk\*, .wq1, .slk, .dif, .ppt\*, .pps\*, .pot\*, .sh3, .ch3, .pre, .ppa, .txt, .pst, .one\*, .vl\*, .vsd, .mpp, .or6, .accdb, .mdb, .pub - -The default MigUser.xml file does not migrate the following: - -- Files tagged with both the **hidden** and **system** attributes. - -- Files and folders on removable drives, - -- Data from the %WINDIR%, %PROGRAMFILES%, %PROGRAMDATA% folders. - -- ACLS for files in folders outside the user profile. - -You can make a copy of the MigUser.xml file and modify it to include or exclude standard user-profile folders and file name extensions. If you know all of the extensions for the files you want to migrate from the source computer, use the MigUser.xml file to move all of your relevant data, regardless of the location of the files. However, this may result in a migration that contains more files than intended. For example, if you choose to migrate all .jpg files, you may migrate image files such as thumbnails and logos from legacy applications that are installed on the source computer. - -**Note**   -Each file name extension you include in the rules within the MigUser.xml file increases the amount of time needed for the ScanState tool to gather the files for the migration. If you are migrating more than three hundred file types, you may experience a slow migration. For more information about other ways to organize the migration of your data, see the [Using multiple XML files](#bkmk-multiple) section of this document. - - - -## Using multiple XML files - - -You can use multiple XML files with the ScanState and LoadState tools. Each of the default XML files included with or generated by USMT is configured for a specific component of the migration. You can also use custom XML files to supplement these default files with additional migration rules. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                        XML migration fileModifies the following components:

                        Config.xml file

                        Operating-system components such as desktop wallpaper and background theme.

                        -

                        You can also overload config.xml to include some application and document settings by generating the config.xml file with the other default XML files. For more information, see Customize USMT XML Files and Config.xml File.

                        MigApps.xml file

                        Applications settings.

                        MigUser.xml or MigDocs.xml files

                        User files and profile settings.

                        Custom XML files

                        Application settings, user profile settings, or user files, beyond the rules contained in the other XML files.

                        - - - -For example, you can use all of the XML migration file types for a single migration, as in the following example: - -``` syntax -Scanstate /config:c:\myFolder\config.xml /i:migapps.xml /i:migdocs.xml /i:customrules.xml -``` - -### XML rules for migrating user files - -**Important**   -You should not use the MigUser.xml and MigDocs.xml files together in the same command. Using both XML files can result in duplication of some migrated files. This occurs when conflicting target-location instructions are given in each XML file. The target file will be stored once during the migration, but will be applied by each XML file to a different location on the destination computer. - - - -If your data set is unknown or if many files are stored outside of the standard user-profile folders, the MigDocs.xml is a better choice than the MigUser.xml file, because the MigDocs.xml file will gather a broader scope of data. The MigDocs.xml file migrates folders of data based on location. The MigUser.xml file migrates only the files with the specified file name extensions. - -If you want more control over the migration, you can create custom XML files. See the [Creating and editing a custom ,xml file](#bkmk-createxml) section of this document. - -## Creating and editing a custom XML file - - -You can use the **/genmigxml** command-line option to determine which files will be included in your migration. The **/genmigxml** option creates a file in a location you specify, so that you can review the XML rules and make modifications as necessary. - -**Note**   -If you reinstall USMT, the default migration XML files will be overwritten and any customizations you make directly to these files will be lost. Consider creating separate XML files for your custom migration rules and saving them in a secure location. - - - -To generate the XML migration rules file for a source computer: - -1. Click **Start**, click **All Programs**, click **Accessories**, right-click **Command Prompt**, and then click **Run as**. - -2. Select an account with administrator privileges, supply a password, and then click **OK**. - -3. At the command prompt, type: - - ``` syntax - cd /d - scanstate.exe /genmigxml: - ``` - - Where *<USMTpath>* is the location on your source computer where you have saved the USMT files and tools, and *<filepath.xml>* is the full path to a file where you can save the report. For example, type: - - ``` syntax - cd /d c:\USMT - scanstate.exe /genmigxml:"C:\Documents and Settings\USMT Tester\Desktop\genMig.xml" - ``` - -### The GenerateDocPatterns function - -The MigDocs.xml file calls the **GenerateDocPatterns** function, which takes three Boolean values. You can change the settings to modify the way the MigDocs.xml file generates the XML rules for migration. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingValueDefault Value

                        ScanProgramFiles

                        The ScanProgramFiles argument is valid only when the GenerateDocPatterns function is called in a system context. This argument determines whether or not to scan the Program Files directory to gather registered file name extensions for known applications.

                        -

                        For example, when set to TRUE, the function discovers and migrates .doc files under the Microsoft Office directory, because .doc is a file name extension registered to a Microsoft Office application. The GenerateDocPatterns function generates this inclusion pattern for .doc files:

                        -
                        <pattern type="File">C:\Program Files\Microsoft Office[.doc]</pattern>
                        -

                        If a child folder of an included folder contains an installed application, ScanProgramFiles will also create an exclusion rule for the child folder. All folders under the application folder will be scanned recursively for registered file name extensions.

                        False

                        IncludePatterns

                        The IncludePatterns argument determines whether to generate exclude or include patterns in the XML. When this argument is set to TRUE, the GenerateDocPatterns function generates include patterns and the function must be added under the <include> element. Changing this argument to FALSE generates exclude patterns and the function must be added under the <exclude> element.

                        True

                        SystemDrive

                        The SystemDrive argument determines whether to generate patterns for all fixed drives or only for the system drive. Changing this argument to TRUE restricts all patterns to the system drive.

                        False

                        - - - -**Usage:** - -``` syntax -MigXmlHelper.GenerateDocPatterns ("", "", "") -``` - -To create include data patterns for only the system drive: - -``` syntax - - - - - -``` - -To create an include rule to gather files for registered extensions from the %PROGRAMFILES% directory: - -``` syntax - - - - - -``` - -To create exclude data patterns: - -``` syntax - - - - - -``` - -### Understanding the system and user context - -The migration XML files contain two <component> elements with different **context** settings. The system context applies to files on the computer that are not stored in the User Profiles directory, while the user context applies to files that are particular to an individual user. - -**System context** - -The system context includes rules for data outside of the User Profiles directory. For example, when called in a system context in the MigDocs.xml file, the **GenerateDocPatterns** function creates patterns for all common shell folders, files in the root directory of hard drives, and folders located at the root of hard drives. The following folders are included: - -- CSIDL\_COMMON\_DESKTOPDIRECTORY - -- CSIDL\_COMMON\_FAVORITES - -- CSIDL\_COMMON\_DOCUMENTS - -- CSIDL\_COMMON\_MUSIC - -- CSIDL\_COMMON\_PICTURES - -- CSIDL\_COMMON\_VIDEO - -- FOLDERID\_PublicDownloads - -**User context** - -The user context includes rules for data in the User Profiles directory. When called in a user context in the MigDocs.xml file, the **GenerateDocPatterns** function creates patterns for all user shell folders, files located at the root of the profile, and folders located at the root of the profile. The following folders are included: - -- CSIDL\_MYDOCUMENTS - -- CSIDL\_MYPICTURES - -- FOLDERID\_OriginalImages - -- CSIDL\_MYMUSIC - -- CSIDL\_MYVIDEO - -- CSIDL\_FAVORITES - -- CSIDL\_DESKTOP - -- CSIDL\_QUICKLAUNCH - -- FOLDERID\_Contacts - -- FOLDERID\_Libraries - -- FOLDERID\_Downloads - -- FOLDERID\_SavedGames - -- FOLDERID\_RecordedTV - -**Note**   -Rules contained in a component that is assigned the user context will be run for each user profile on the computer. Files that are scanned multiple times by the MigDocs.xml files will only be copied to the migration store once; however, a large number of rules in the user context can slow down the migration. Use the system context when it is applicable. - - - -### Sample migration rules for customized versions of XML files - -**Note**   -For best practices and requirements for customized XML files in USMT, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [General Conventions](usmt-general-conventions.md). - - - -### Exclude rules usage examples - -In the examples below, the source computer has a .txt file called "new text document" in a directory called "new folder". The default MigDocs.xml behavior migrates the new text document.txt file and all files contained in the "new folder" directory. The rules generated by the function are: - - ---- - - - - - - - - - - -

                        Rule 1

                        <pattern type="File">d:\new folder[new text document.txt]</pattern>

                        Rule 2

                        <pattern type="File">d:\new folder[]</pattern>
                        - - - -To exclude the new text document.txt file as well as any .txt files in “new folder”, you can do the following: - -**Example 1: Exclude all .txt files in a folder** - -To exclude Rule 1, there needs to be an exact match of the file name. However, for Rule 2, you can create a pattern to exclude files by using the file name extension. - -``` syntax - - - D:\Newfolder\[new text document.txt] - D:\New folder\*[*.txt] - - -``` - -**Example 2: Use the UnconditionalExclude element to give a rule precedence over include rules** - -If you do not know the file name or location of the file, but you do know the file name extension, you can use the **GenerateDrivePatterns** function. However, the rule will be less specific than the default include rule generated by the MigDocs.xml file, so it will not have precedence. You must use the <UnconditionalExclude> element to give this rule precedence over the default include rule. For more information about the order of precedence for XML migration rules, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - -``` syntax - - - - - -``` - -**Example 3 : Use a UserandSystem context component to run rules in both contexts** - -If you want the <UnconditionalExclude> element to apply to both the system and user context, you can create a third component using the **UserandSystem** context. Rules in this component will be run in both contexts. - -``` syntax - - MigDocExcludes - - - - - - - - - - -``` - -For more examples of exclude rules that you can use in custom migration XML files, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md). - -### Include rules usage examples - -The application data directory is the most common location that you would need to add an include rule for. The **GenerateDocPatterns** function excludes this location by default. If your company uses an application that saves important data to this location, you can create include rules to migrate the data. For example, the default location for .pst files is: `%CSIDL_LOCAL_APPDATA%\Microsoft\Outlook`. The Migapp.xml file contains migration rules to move only those .pst files that are linked to Microsoft Outlook. To include .pst files that are not linked, you can do the following: - -**Example 1: Include a file name extension in a known user folder** - -This rule will include .pst files that are located in the default location, but are not linked to Microsoft Outlook. Use the user context to run this rule for each user on the computer. - -``` syntax - - - %CSIDL_LOCAL_APPDATA%\Microsoft\Outlook\*[*.pst] - - -``` - -**Example 2: Include a file name extension in Program Files** - -For locations outside the user profile, such as the Program Files folder, you can add the rule to the system context component. - -``` syntax - - - %CSIDL_PROGRAM_FILES%\*[*.pst] - - -``` - -For more examples of include rules that you can use in custom migration XML files, see [Include Files and Settings](usmt-include-files-and-settings.md). - -**Note**   -For more information about the order of precedence for XML migration rules, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - - - -## Next steps - - -You can include additional rules for the migration in the MigDocs.xml file or other XML migration files. For example, you can use the <locationModify> element to move files from the folder where they were gathered to a different folder, when they are applied to the destination computer. - -You can use an XML schema (MigXML.xsd) file to validate the syntax of your customized XML files. For more information, see [USMT Resources](usmt-resources.md). - -## Related topics - - -[Exclude Files and Settings](usmt-exclude-files-and-settings.md) - -[Include Files and Settings](usmt-include-files-and-settings.md) - - - - - - - - - +--- +title: Understanding Migration XML Files (Windows 10) +description: Understanding Migration XML Files +ms.assetid: d3d1fe89-085c-4da8-9657-fd54b8bfc4b7 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Understanding Migration XML Files + + +You can modify the behavior of a basic User State Migration Tool (USMT)10.0 migration by using XML files; these files provide instructions on where and how the USMT tools should gather and apply files and settings. USMT includes three XML files that you can use to customize a basic migration: the MigDocs.xml and MigUser.xml files, which modify how files are discovered on the source computer, and the MigApps.xml file, which is required in order to migrate supported application settings. You can also create and edit custom XML files and a Config.xml file to further customize your migration. + +This topic provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file. The MigDocs.xml file uses the new **GenerateDocPatterns** function available in USMT to automatically find user documents on a source computer. + +## In This Topic + + +[Overview of the Config.xml file](#bkmk-config) + +[Overview of the MigApp.xml file](#bkmk-migapp) + +[Overview of the MigDocs.xml file](#bkmk-migdocs) + +[Overview of the MigUser.xml file](#bkmk-miguser) + +[Using multiple XML files](#bkmk-multiple) + +[XML rules for migrating user files](#bkmk-userfiles) + +[The GenerateDocPatterns function](#bkmk-generate) + +[Understanding the system and user context](#bkmk-context) + +[Sample migration rules for customized versions of XML files](#bkmk-samples) + +[Exclude rules usage examples](#bkmk-exclude) + +[Include rules usage examples](#bkmk-include) + +[Next Steps](#bkmk-next) + +## Overview of the Config.xml file + + +The Config.xml file is the configuration file created by the `/genconfig` option of the ScanState tool; it can be used to modify which operating-system components are migrated by USMT. The Config.xml file can be used in conjunction with other XML files, such as in the following example: `scanstate /i:migapps.xml /i:migdocs.xml /genconfig:c:\myFolder\config.xml`. When used this way, the Config.xml file tightly controls aspects of the migration, including user profiles, data, and settings, without modifying or creating other XML files. For more information about the Config.xml file, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [Config.xml File](usmt-configxml-file.md). + +**Note**   +When modifying the XML elements in the Config.xml file, you should edit an element and set the **migrate** property to **no**, rather than deleting the element from the file. If you delete the element instead of setting the property, the component may still be migrated by rules in other XML files. + + + +## Overview of the MigApp.xml file + + +The MigApp.xml file installed with USMT includes instructions to migrate the settings for the applications listed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md). You must include the MigApp.xml file when using the ScanState and LoadState tools, by using the `/i` option in order to migrate application settings. The MigDocs.xml and MigUser.xml files do not migrate application settings. You can create a custom XML file to include additional applications. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md). + +**Important**   +The MigApps.xml file will only detect and migrate .pst files that are linked to Microsoft Office Outlook. See the [Sample migration rules for customized versions of XML files](#bkmk-samples) section of this document for more information about migrating .pst files that are not linked to Outlook. + + + +## Overview of the MigDocs.xml file + + +The MigDocs.xml file uses the new **GenerateDocPatterns** helper function to create instructions for USMT to migrate files from the source computer, based on the location of the files. You can use the MigDocs.xml file with the ScanState and LoadState tools to perform a more targeted migration than using USMT without XML instructions. + +The default MigDocs.xml file migrates the following: + +- All files on the root of the drive except %WINDIR%, %PROGRAMFILES%, %PROGRAMDATA%, or %USERS%. + +- All folders in the root directory of all fixed drives. For example: c:\\data\_mail\\\*\[\*\] + +- All files from the root of the Profiles folder, except for files in the system profile. For example: c:\\users\\name\[mail.pst\] + +- All folders from the root of the Profiles folder, except for the system-profile folders. For example: c:\\users\\name\\new folder\\\*\[\*\] + +- Standard shared folders: + + - CSIDL\_COMMON\_DESKTOPDIRECTORY + + - CSIDL\_COMMON\_FAVORITES + + - CSIDL\_COMMON\_DOCUMENTS + + - CSIDL\_COMMON\_MUSIC + + - CSIDL\_COMMON\_PICTURES + + - CSIDL\_COMMON\_VIDEO + + - FOLDERID\_PublicDownloads + +- Standard user-profile folders for each user: + + - CSIDL\_MYDOCUMENTS + + - CSIDL\_MYPICTURES + + - FOLDERID\_OriginalImages + + - CSIDL\_MYMUSIC + + - CSIDL\_MYVIDEO + + - CSIDL\_FAVORITES + + - CSIDL\_DESKTOP + + - CSIDL\_QUICKLAUNCH + + - FOLDERID\_Contacts + + - FOLDERID\_Libraries + + - FOLDERID\_Downloads + + - FOLDERID\_SavedGames + + - FOLDERID\_RecordedTV + +The default MigDocs.xml file will not migrate the following: + +- Files tagged with both the **hidden** and **system** attributes. + +- Files and folders on removable drives. + +- Data from the %WINDIR%, %PROGRAMDATA%, and %PROGRAMFILES% folders. + +- Folders that contain installed applications. + +You can also use the **/genmigxml** option with the ScanState tool to review and modify what files will be migrated. + +## Overview of the MigUser.xml file + + +The MigUser.xml file includes instructions for USMT to migrate user files based on file name extensions. You can use the MigUser.xml file with the ScanState and LoadState tools to perform a more targeted migration than using USMT without XML instructions. The MigUser.xml file will gather all files from the standard user-profile folders, as well as any files on the computer with the specified file name extensions. + +The default MigUser.xml file migrates the following: + +- All files from the standard user-profile folders which are described as: + + - CSIDL\_MYVIDEO + + - CSIDL\_MYMUSIC + + - CSIDL\_DESKTOP + + - CSIDL\_STARTMENU + + - CSIDL\_PERSONAL + + - CSIDL\_MYPICTURES + + - CSIDL\_FAVORITES + + - CSIDL\_QUICK LAUNCH + +- Files with the following extensions: + + .qdf, .qsd, .qel, .qph, .doc\*, .dot\*, .rtf, .mcw, .wps, .scd, .wri, .wpd, .xl\*, .csv, .iqy, .dqy, .oqy, .rqy, .wk\*, .wq1, .slk, .dif, .ppt\*, .pps\*, .pot\*, .sh3, .ch3, .pre, .ppa, .txt, .pst, .one\*, .vl\*, .vsd, .mpp, .or6, .accdb, .mdb, .pub + +The default MigUser.xml file does not migrate the following: + +- Files tagged with both the **hidden** and **system** attributes. + +- Files and folders on removable drives, + +- Data from the %WINDIR%, %PROGRAMFILES%, %PROGRAMDATA% folders. + +- ACLS for files in folders outside the user profile. + +You can make a copy of the MigUser.xml file and modify it to include or exclude standard user-profile folders and file name extensions. If you know all of the extensions for the files you want to migrate from the source computer, use the MigUser.xml file to move all of your relevant data, regardless of the location of the files. However, this may result in a migration that contains more files than intended. For example, if you choose to migrate all .jpg files, you may migrate image files such as thumbnails and logos from legacy applications that are installed on the source computer. + +**Note**   +Each file name extension you include in the rules within the MigUser.xml file increases the amount of time needed for the ScanState tool to gather the files for the migration. If you are migrating more than three hundred file types, you may experience a slow migration. For more information about other ways to organize the migration of your data, see the [Using multiple XML files](#bkmk-multiple) section of this document. + + + +## Using multiple XML files + + +You can use multiple XML files with the ScanState and LoadState tools. Each of the default XML files included with or generated by USMT is configured for a specific component of the migration. You can also use custom XML files to supplement these default files with additional migration rules. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
                        XML migration fileModifies the following components:

                        Config.xml file

                        Operating-system components such as desktop wallpaper and background theme.

                        +

                        You can also overload config.xml to include some application and document settings by generating the config.xml file with the other default XML files. For more information, see Customize USMT XML Files and Config.xml File.

                        MigApps.xml file

                        Applications settings.

                        MigUser.xml or MigDocs.xml files

                        User files and profile settings.

                        Custom XML files

                        Application settings, user profile settings, or user files, beyond the rules contained in the other XML files.

                        + + + +For example, you can use all of the XML migration file types for a single migration, as in the following example: + +``` +Scanstate /config:c:\myFolder\config.xml /i:migapps.xml /i:migdocs.xml /i:customrules.xml +``` + +### XML rules for migrating user files + +**Important**   +You should not use the MigUser.xml and MigDocs.xml files together in the same command. Using both XML files can result in duplication of some migrated files. This occurs when conflicting target-location instructions are given in each XML file. The target file will be stored once during the migration, but will be applied by each XML file to a different location on the destination computer. + + + +If your data set is unknown or if many files are stored outside of the standard user-profile folders, the MigDocs.xml is a better choice than the MigUser.xml file, because the MigDocs.xml file will gather a broader scope of data. The MigDocs.xml file migrates folders of data based on location. The MigUser.xml file migrates only the files with the specified file name extensions. + +If you want more control over the migration, you can create custom XML files. See the [Creating and editing a custom ,xml file](#bkmk-createxml) section of this document. + +## Creating and editing a custom XML file + + +You can use the **/genmigxml** command-line option to determine which files will be included in your migration. The **/genmigxml** option creates a file in a location you specify, so that you can review the XML rules and make modifications as necessary. + +**Note**   +If you reinstall USMT, the default migration XML files will be overwritten and any customizations you make directly to these files will be lost. Consider creating separate XML files for your custom migration rules and saving them in a secure location. + + + +To generate the XML migration rules file for a source computer: + +1. Click **Start**, click **All Programs**, click **Accessories**, right-click **Command Prompt**, and then click **Run as**. + +2. Select an account with administrator privileges, supply a password, and then click **OK**. + +3. At the command prompt, type: + + ``` + cd /d + scanstate.exe /genmigxml: + ``` + + Where *<USMTpath>* is the location on your source computer where you have saved the USMT files and tools, and *<filepath.xml>* is the full path to a file where you can save the report. For example, type: + + ``` + cd /d c:\USMT + scanstate.exe /genmigxml:"C:\Documents and Settings\USMT Tester\Desktop\genMig.xml" + ``` + +### The GenerateDocPatterns function + +The MigDocs.xml file calls the **GenerateDocPatterns** function, which takes three Boolean values. You can change the settings to modify the way the MigDocs.xml file generates the XML rules for migration. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingValueDefault Value

                        ScanProgramFiles

                        The ScanProgramFiles argument is valid only when the GenerateDocPatterns function is called in a system context. This argument determines whether or not to scan the Program Files directory to gather registered file name extensions for known applications.

                        +

                        For example, when set to TRUE, the function discovers and migrates .doc files under the Microsoft Office directory, because .doc is a file name extension registered to a Microsoft Office application. The GenerateDocPatterns function generates this inclusion pattern for .doc files:

                        +
                        <pattern type="File">C:\Program Files\Microsoft Office[.doc]</pattern>
                        +

                        If a child folder of an included folder contains an installed application, ScanProgramFiles will also create an exclusion rule for the child folder. All folders under the application folder will be scanned recursively for registered file name extensions.

                        False

                        IncludePatterns

                        The IncludePatterns argument determines whether to generate exclude or include patterns in the XML. When this argument is set to TRUE, the GenerateDocPatterns function generates include patterns and the function must be added under the <include> element. Changing this argument to FALSE generates exclude patterns and the function must be added under the <exclude> element.

                        True

                        SystemDrive

                        The SystemDrive argument determines whether to generate patterns for all fixed drives or only for the system drive. Changing this argument to TRUE restricts all patterns to the system drive.

                        False

                        + + + +**Usage:** + +``` +MigXmlHelper.GenerateDocPatterns ("", "", "") +``` + +To create include data patterns for only the system drive: + +``` xml + + + + + +``` + +To create an include rule to gather files for registered extensions from the %PROGRAMFILES% directory: + +``` xml + + + + + +``` + +To create exclude data patterns: + +``` xml + + + + + +``` + +### Understanding the system and user context + +The migration XML files contain two <component> elements with different **context** settings. The system context applies to files on the computer that are not stored in the User Profiles directory, while the user context applies to files that are particular to an individual user. + +**System context** + +The system context includes rules for data outside of the User Profiles directory. For example, when called in a system context in the MigDocs.xml file, the **GenerateDocPatterns** function creates patterns for all common shell folders, files in the root directory of hard drives, and folders located at the root of hard drives. The following folders are included: + +- CSIDL\_COMMON\_DESKTOPDIRECTORY + +- CSIDL\_COMMON\_FAVORITES + +- CSIDL\_COMMON\_DOCUMENTS + +- CSIDL\_COMMON\_MUSIC + +- CSIDL\_COMMON\_PICTURES + +- CSIDL\_COMMON\_VIDEO + +- FOLDERID\_PublicDownloads + +**User context** + +The user context includes rules for data in the User Profiles directory. When called in a user context in the MigDocs.xml file, the **GenerateDocPatterns** function creates patterns for all user shell folders, files located at the root of the profile, and folders located at the root of the profile. The following folders are included: + +- CSIDL\_MYDOCUMENTS + +- CSIDL\_MYPICTURES + +- FOLDERID\_OriginalImages + +- CSIDL\_MYMUSIC + +- CSIDL\_MYVIDEO + +- CSIDL\_FAVORITES + +- CSIDL\_DESKTOP + +- CSIDL\_QUICKLAUNCH + +- FOLDERID\_Contacts + +- FOLDERID\_Libraries + +- FOLDERID\_Downloads + +- FOLDERID\_SavedGames + +- FOLDERID\_RecordedTV + +**Note**   +Rules contained in a component that is assigned the user context will be run for each user profile on the computer. Files that are scanned multiple times by the MigDocs.xml files will only be copied to the migration store once; however, a large number of rules in the user context can slow down the migration. Use the system context when it is applicable. + + + +### Sample migration rules for customized versions of XML files + +**Note**   +For best practices and requirements for customized XML files in USMT, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [General Conventions](usmt-general-conventions.md). + + + +### Exclude rules usage examples + +In the examples below, the source computer has a .txt file called "new text document" in a directory called "new folder". The default MigDocs.xml behavior migrates the new text document.txt file and all files contained in the "new folder" directory. The rules generated by the function are: + + ++++ + + + + + + + + + + +

                        Rule 1

                        <pattern type="File">d:\new folder[new text document.txt]</pattern>

                        Rule 2

                        <pattern type="File">d:\new folder[]</pattern>
                        + + + +To exclude the new text document.txt file as well as any .txt files in “new folder”, you can do the following: + +**Example 1: Exclude all .txt files in a folder** + +To exclude Rule 1, there needs to be an exact match of the file name. However, for Rule 2, you can create a pattern to exclude files by using the file name extension. + +``` xml + + + D:\Newfolder\[new text document.txt] + D:\New folder\*[*.txt] + + +``` + +**Example 2: Use the UnconditionalExclude element to give a rule precedence over include rules** + +If you do not know the file name or location of the file, but you do know the file name extension, you can use the **GenerateDrivePatterns** function. However, the rule will be less specific than the default include rule generated by the MigDocs.xml file, so it will not have precedence. You must use the <UnconditionalExclude> element to give this rule precedence over the default include rule. For more information about the order of precedence for XML migration rules, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + +``` xml + + + + + +``` + +**Example 3 : Use a UserandSystem context component to run rules in both contexts** + +If you want the <UnconditionalExclude> element to apply to both the system and user context, you can create a third component using the **UserandSystem** context. Rules in this component will be run in both contexts. + +``` xml + + MigDocExcludes + + + + + + + + + + +``` + +For more examples of exclude rules that you can use in custom migration XML files, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md). + +### Include rules usage examples + +The application data directory is the most common location that you would need to add an include rule for. The **GenerateDocPatterns** function excludes this location by default. If your company uses an application that saves important data to this location, you can create include rules to migrate the data. For example, the default location for .pst files is: `%CSIDL_LOCAL_APPDATA%\Microsoft\Outlook`. The Migapp.xml file contains migration rules to move only those .pst files that are linked to Microsoft Outlook. To include .pst files that are not linked, you can do the following: + +**Example 1: Include a file name extension in a known user folder** + +This rule will include .pst files that are located in the default location, but are not linked to Microsoft Outlook. Use the user context to run this rule for each user on the computer. + +``` xml + + + %CSIDL_LOCAL_APPDATA%\Microsoft\Outlook\*[*.pst] + + +``` + +**Example 2: Include a file name extension in Program Files** + +For locations outside the user profile, such as the Program Files folder, you can add the rule to the system context component. + +``` xml + + + %CSIDL_PROGRAM_FILES%\*[*.pst] + + +``` + +For more examples of include rules that you can use in custom migration XML files, see [Include Files and Settings](usmt-include-files-and-settings.md). + +**Note**   +For more information about the order of precedence for XML migration rules, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + + + +## Next steps + + +You can include additional rules for the migration in the MigDocs.xml file or other XML migration files. For example, you can use the <locationModify> element to move files from the folder where they were gathered to a different folder, when they are applied to the destination computer. + +You can use an XML schema (MigXML.xsd) file to validate the syntax of your customized XML files. For more information, see [USMT Resources](usmt-resources.md). + +## Related topics + + +[Exclude Files and Settings](usmt-exclude-files-and-settings.md) + +[Include Files and Settings](usmt-include-files-and-settings.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-best-practices.md b/windows/deployment/usmt/usmt-best-practices.md index 3e694996e9..48782e0bdc 100644 --- a/windows/deployment/usmt/usmt-best-practices.md +++ b/windows/deployment/usmt/usmt-best-practices.md @@ -1,158 +1,159 @@ ---- -title: USMT Best Practices (Windows 10) -description: USMT Best Practices -ms.assetid: e3cb1e78-4230-4eae-b179-e6e9160542d2 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# USMT Best Practices - - -This topic discusses general and security-related best practices when using User State Migration Tool (USMT) 10.0. - -## General Best Practices - - -- **Install applications before running the LoadState tool** - - Though it is not always essential, it is best practice to install all applications on the destination computer before restoring the user state. This helps ensure that migrated settings are preserved. - -- **Do not use MigUser.xml and MigDocs.xml together** - - If you use both .xml files, some migrated files may be duplicated if conflicting instructions are given about target locations. You can use the **/genmigxml** command-line option to determine which files will be included in your migration, and to determine if any modifications are necessary. For more information, see [Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md). - -- **Use MigDocs.xml for a better migration experience** - - If your data set is unknown or if many files are stored outside of the standard user-profile folders, the MigDocs.xml file is a better choice than the MigUser.xml file, because the MigDocs.xml file will gather a broader scope of data. The MigDocs.xml file migrates folders of data based on location, and on registered file type by querying the registry for registered application extensions. The MigUser.xml file migrates only the files with the specified file extensions. - -- **Close all applications before running either the ScanState or LoadState tools** - - Although using the **/vsc** switch can allow the migration of many files that are open with another application it is a best practice to close all applications in order to ensure all files and settings migrate. Without the **/vsc** or **/c** switch USMT will fail when it cannot migrate a file or setting. When you use the **/c** option USMT will ignore any files or settings that it cannot migrate and log an error each time. - -- **Log off after you run the LoadState** - - Some settings, such as fonts, wallpaper, and screensaver settings, will not take effect until the next time the user logs on. For this reason, you should log off after you run the LoadState tool. - -- **Managed environment** - - To create a managed environment, you can move all of the end user’s documents into My Documents (%CSIDL\_PERSONAL%). We recommend that you migrate files into the smallest-possible number of folders on the destination computer. This will help you to clean up files on the destination computer, if the LoadState command fails before completion. - -- **Chkdsk.exe** - - We recommend that you run Chkdsk.exe before running the ScanState and LoadState tools. Chkdsk.exe creates a status report for a hard disk drive and lists and corrects common errors. For more information about the Chkdsk.exe tool, see [Chkdsk](https://go.microsoft.com/fwlink/p/?LinkId=140244). - -- **Migrate in groups** - - If you decide to perform the migration while users are using the network, it is best to migrate user accounts in groups. To minimize the impact on network performance, determine the size of the groups based on the size of each user account. Migrating in phases also allows you to make sure each phase is successful before starting the next phase. Using this method, you can make any necessary modifications to your plan between groups. - -## Security Best Practices - - -As the authorized administrator, it is your responsibility to protect the privacy of the users and maintain security during and after the migration. In particular, you must consider the following issues: - -- **Encrypting File System (EFS)** - - Take extreme caution when migrating encrypted files, because the end user does not need to be logged on to capture the user state. By default, USMT fails if an encrypted file is found. For more information about EFS best practices, see this article in the [Microsoft Knowledge Base](https://go.microsoft.com/fwlink/p/?linkid=163). For specific instructions about EFS best practices, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md). - - **Important**   - If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration. - - - -- **Encrypt the store** - - Consider using the **/encrypt** option with the ScanState command and the **/decrypt** option with the LoadState command. However, use extreme caution with this set of options, because anyone who has access to the ScanState command-line script also has access to the encryption key. - -- **Virus Scan** - - We recommend that you scan both the source and destination computers for viruses before running USMT. In addition, you should scan the destination computer image. To help protect data from viruses, we strongly recommend running an antivirus utility before migration. - -- **Maintain security of the file server and the deployment server** - - We recommend that you manage the security of the file and deployment servers. It is important to make sure that the file server where you save the store is secure. You must also secure the deployment server, to ensure that the user data that is in the log files is not exposed. We also recommend that you only transmit data over a secure Internet connection, such as a virtual private network. For more information about network security, see [Microsoft Security Compliance Manager](https://go.microsoft.com/fwlink/p/?LinkId=215657). - -- **Password Migration** - - To ensure the privacy of the end users, USMT does not migrate passwords, including those for applications such as Windows Live™ Mail, Microsoft Internet Explorer®, as well as Remote Access Service (RAS) connections and mapped network drives. It is important to make sure that end users know their passwords. - -- **Local Account Creation** - - Before you migrate local accounts, see the Migrating Local Accounts section in the [Identify Users](usmt-identify-users.md) topic. - -## XML File Best Practices - - -- **Specify the same set of mig\*.xml files in both the ScanState and the LoadState tools** - - If you used a particular set of mig\*.xml files in the ScanState tool, either called through the "/auto" option, or individually through the "/i" option, then you should use same option to call the exact same mig\*.xml files in the LoadState tool. - -- **The <CustomFileName> in the migration urlid should match the name of the file** - - Although it is not a requirement, it is good practice for <CustomFileName> to match the name of the file. For example, the following is from the MigApp.xml file: - - ``` syntax - - - ``` - -- **Use the XML Schema (MigXML.xsd) when authoring .xml files to validate syntax** - - The MigXML.xsd schema file should not be included on the command line or in any of the .xml files. - -- **Use the default migration XML files as models** - - To create a custom .xml file, you can use the migration .xml files as models to create your own. If you need to migrate user data files, model your custom .xml file on MigUser.xml. To migrate application settings, model your custom .xml file on the MigApp.xml file. - -- **Consider the impact on performance when using the <context> parameter** - - Your migration performance can be affected when you use the <context> element with the <component> element; for example, as in when you want to encapsulate logical units of file- or path-based <include> and <exclude> rules. - - In the **User** context, a rule is processed one time for each user on the system. - - In the **System** context, a rule is processed one time for the system. - - In the **UserAndSystem** context, a rule is processed one time for each user on the system and one time for the system. - - **Note**   - The number of times a rule is processed does not affect the number of times a file is migrated. The USMT migration engine ensures that each file migrates only once. - - - -- **We recommend that you create a separate .xml file instead of adding your .xml code to one of the existing migration .xml files** - - For example, if you have code that migrates the settings for an application, you should not just add the code to the MigApp.xml file. - -- **You should not create custom .xml files to alter the operating system settings that are migrated** - - These settings are migrated by manifests and you cannot modify those files. If you want to exclude certain operating system settings from the migration, you should create and modify a Config.xml file. - -- **You can use the asterisk (\*) wildcard character in any migration XML file that you create** - - **Note**   - The question mark is not valid as a wildcard character in USMT .xml files. - - - -## Related topics - - -[Migration Store Encryption](usmt-migration-store-encryption.md) - -[Plan Your Migration](usmt-plan-your-migration.md) - - - - - - - - - +--- +title: USMT Best Practices (Windows 10) +description: USMT Best Practices +ms.assetid: e3cb1e78-4230-4eae-b179-e6e9160542d2 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# USMT Best Practices + + +This topic discusses general and security-related best practices when using User State Migration Tool (USMT) 10.0. + +## General Best Practices + + +- **Install applications before running the LoadState tool** + + Though it is not always essential, it is best practice to install all applications on the destination computer before restoring the user state. This helps ensure that migrated settings are preserved. + +- **Do not use MigUser.xml and MigDocs.xml together** + + If you use both .xml files, some migrated files may be duplicated if conflicting instructions are given about target locations. You can use the **/genmigxml** command-line option to determine which files will be included in your migration, and to determine if any modifications are necessary. For more information, see [Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md). + +- **Use MigDocs.xml for a better migration experience** + + If your data set is unknown or if many files are stored outside of the standard user-profile folders, the MigDocs.xml file is a better choice than the MigUser.xml file, because the MigDocs.xml file will gather a broader scope of data. The MigDocs.xml file migrates folders of data based on location, and on registered file type by querying the registry for registered application extensions. The MigUser.xml file migrates only the files with the specified file extensions. + +- **Close all applications before running either the ScanState or LoadState tools** + + Although using the **/vsc** switch can allow the migration of many files that are open with another application it is a best practice to close all applications in order to ensure all files and settings migrate. Without the **/vsc** or **/c** switch USMT will fail when it cannot migrate a file or setting. When you use the **/c** option USMT will ignore any files or settings that it cannot migrate and log an error each time. + +- **Log off after you run the LoadState** + + Some settings, such as fonts, wallpaper, and screensaver settings, will not take effect until the next time the user logs on. For this reason, you should log off after you run the LoadState tool. + +- **Managed environment** + + To create a managed environment, you can move all of the end user’s documents into My Documents (%CSIDL\_PERSONAL%). We recommend that you migrate files into the smallest-possible number of folders on the destination computer. This will help you to clean up files on the destination computer, if the LoadState command fails before completion. + +- **Chkdsk.exe** + + We recommend that you run Chkdsk.exe before running the ScanState and LoadState tools. Chkdsk.exe creates a status report for a hard disk drive and lists and corrects common errors. For more information about the Chkdsk.exe tool, see [Chkdsk](https://go.microsoft.com/fwlink/p/?LinkId=140244). + +- **Migrate in groups** + + If you decide to perform the migration while users are using the network, it is best to migrate user accounts in groups. To minimize the impact on network performance, determine the size of the groups based on the size of each user account. Migrating in phases also allows you to make sure each phase is successful before starting the next phase. Using this method, you can make any necessary modifications to your plan between groups. + +## Security Best Practices + + +As the authorized administrator, it is your responsibility to protect the privacy of the users and maintain security during and after the migration. In particular, you must consider the following issues: + +- **Encrypting File System (EFS)** + + Take extreme caution when migrating encrypted files, because the end user does not need to be logged on to capture the user state. By default, USMT fails if an encrypted file is found. For more information about EFS best practices, see this article in the [Microsoft Knowledge Base](https://go.microsoft.com/fwlink/p/?linkid=163). For specific instructions about EFS best practices, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md). + + **Important**   + If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration. + + + +- **Encrypt the store** + + Consider using the **/encrypt** option with the ScanState command and the **/decrypt** option with the LoadState command. However, use extreme caution with this set of options, because anyone who has access to the ScanState command-line script also has access to the encryption key. + +- **Virus Scan** + + We recommend that you scan both the source and destination computers for viruses before running USMT. In addition, you should scan the destination computer image. To help protect data from viruses, we strongly recommend running an antivirus utility before migration. + +- **Maintain security of the file server and the deployment server** + + We recommend that you manage the security of the file and deployment servers. It is important to make sure that the file server where you save the store is secure. You must also secure the deployment server, to ensure that the user data that is in the log files is not exposed. We also recommend that you only transmit data over a secure Internet connection, such as a virtual private network. For more information about network security, see [Microsoft Security Compliance Manager](https://go.microsoft.com/fwlink/p/?LinkId=215657). + +- **Password Migration** + + To ensure the privacy of the end users, USMT does not migrate passwords, including those for applications such as Windows Live™ Mail, Microsoft Internet Explorer®, as well as Remote Access Service (RAS) connections and mapped network drives. It is important to make sure that end users know their passwords. + +- **Local Account Creation** + + Before you migrate local accounts, see the Migrating Local Accounts section in the [Identify Users](usmt-identify-users.md) topic. + +## XML File Best Practices + + +- **Specify the same set of mig\*.xml files in both the ScanState and the LoadState tools** + + If you used a particular set of mig\*.xml files in the ScanState tool, either called through the "/auto" option, or individually through the "/i" option, then you should use same option to call the exact same mig\*.xml files in the LoadState tool. + +- **The <CustomFileName> in the migration urlid should match the name of the file** + + Although it is not a requirement, it is good practice for <CustomFileName> to match the name of the file. For example, the following is from the MigApp.xml file: + + ``` xml + + + ``` + +- **Use the XML Schema (MigXML.xsd) when authoring .xml files to validate syntax** + + The MigXML.xsd schema file should not be included on the command line or in any of the .xml files. + +- **Use the default migration XML files as models** + + To create a custom .xml file, you can use the migration .xml files as models to create your own. If you need to migrate user data files, model your custom .xml file on MigUser.xml. To migrate application settings, model your custom .xml file on the MigApp.xml file. + +- **Consider the impact on performance when using the <context> parameter** + + Your migration performance can be affected when you use the <context> element with the <component> element; for example, as in when you want to encapsulate logical units of file- or path-based <include> and <exclude> rules. + + In the **User** context, a rule is processed one time for each user on the system. + + In the **System** context, a rule is processed one time for the system. + + In the **UserAndSystem** context, a rule is processed one time for each user on the system and one time for the system. + + **Note**   + The number of times a rule is processed does not affect the number of times a file is migrated. The USMT migration engine ensures that each file migrates only once. + + + +- **We recommend that you create a separate .xml file instead of adding your .xml code to one of the existing migration .xml files** + + For example, if you have code that migrates the settings for an application, you should not just add the code to the MigApp.xml file. + +- **You should not create custom .xml files to alter the operating system settings that are migrated** + + These settings are migrated by manifests and you cannot modify those files. If you want to exclude certain operating system settings from the migration, you should create and modify a Config.xml file. + +- **You can use the asterisk (\*) wildcard character in any migration XML file that you create** + + **Note**   + The question mark is not valid as a wildcard character in USMT .xml files. + + + +## Related topics + + +[Migration Store Encryption](usmt-migration-store-encryption.md) + +[Plan Your Migration](usmt-plan-your-migration.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-configxml-file.md b/windows/deployment/usmt/usmt-configxml-file.md index bdb613b683..db0aad8633 100644 --- a/windows/deployment/usmt/usmt-configxml-file.md +++ b/windows/deployment/usmt/usmt-configxml-file.md @@ -1,589 +1,590 @@ ---- -title: Config.xml File (Windows 10) -description: Config.xml File -ms.assetid: 9dc98e76-5155-4641-bcb3-81915db538e8 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Config.xml File - - -## Config.xml File - - -The Config.xml file is an optional User State Migration Tool (USMT) 10.0 file that you can create using the **/genconfig** option with the ScanState.exe tool. If you want to include all of the default components, and do not want to change the default store-creation or profile-migration behavior, you do not need to create a Config.xml file. - -However, if you are satisfied with the default migration behavior defined in the MigApp.xml, MigUser.xml and MigDocs.xml files, but you want to exclude certain components, you can create and modify a Config.xml file and leave the other .xml files unchanged. For example, you must create and modify the Config.xml file if you want to exclude any of the operating-system settings that are migrated. It is necessary to create and modify this file if you want to change any of the default store-creation or profile-migration behavior. - -The Config.xml file has a different format than the other migration .xml files, because it does not contain any migration rules. It contains only a list of the operating-system components, applications, user documents that can be migrated, as well as user-profile policy and error-control policy. For this reason, excluding components using the Config.xml file is easier than modifying the migration .xml files, because you do not need to be familiar with the migration rules and syntax. However, you cannot use wildcard characters in this file. - -For more information about using the Config.xml file with other migration files, such as the MigDocs.xml and MigApps.xml files, see [Understanding Migration XML Files](understanding-migration-xml-files.md). - -**Note**   -To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. - - - -## In This Topic - - -In USMT there are new migration policies that can be configured in the Config.xml file. For example, you can configure additional **<ErrorControl>**, **<ProfileControl>**, and **<HardLinkStoreControl>** options. The following elements and parameters are for use in the Config.xml file only. - -[<Policies>](#bkmk-policies) - -[<ErrorControl>](#bkmk-errorcontrol) - -[<fatal>](#bkmk-fatal) - -[<fileError>](#bkmk-fileerror) - -[<nonfatal>](#bkmk-nonfatal) - -[<registryError>](#bkmk-registryerror) - -[<HardLinkStoreControl>](#bkmk-hardlinkstorecontrol) - -[<fileLocked>](#bkmk-filelock) - -[<createHardLink>](#bkmk-createhardlink) - -[<errorHardLink>](#bkmk-errorhardlink) - -[<ProfileControl>](#bkmk-profilecontrol) - -[<localGroups>](#bkmk-localgroups) - -[<mappings>](#bkmk-mappings) - -[<changeGroup>](#bkmk-changegrou) - -[<include>](#bkmk-include) - -[<exclude>](#bkmk-exclude) - -[Sample Config.xml File](#bkmk-sampleconfigxjmlfile) - -## <Policies> - - -The **<Policies>** element contains elements that describe the policies that USMT follows while creating a migration store. Valid children of the **<Policies>** element are **<ErrorControl>** and **<HardLinkStoreControl>**. The **<Policies>** element is a child of **<Configuration>**. - -Syntax: ` ` - -## <ErrorControl> - - -The **<ErrorControl>** element is an optional element you can configure in the Config.xml file. The configurable **<ErrorControl>** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, you can specify a path using the (\*) wildcard character. - -- **Number of occurrences**: Once for each component - -- **Parent elements**: The **<Policies>** element - -- **Child elements**: The **<fileError>** and **<registryError>** element - -Syntax: `` - -The following example specifies that all locked files, regardless of their location (including files in C:\\Users), should be ignored. However, the migration fails if any file in C:\\Users cannot be accessed because of any other reason. In the example below, the **<ErrorControl>** element ignores any problems in migrating registry keys that match the supplied pattern, and it resolves them to an **Access denied** error. - -Additionally, the order in the **<ErrorControl>** section implies priority. In this example, the first **<nonFatal>** tag takes precedence over the second **<fatal>** tag. This precedence is applied, regardless of how many tags are listed. - -``` syntax - - - * [*] - C:\Users\* [*] - - - HKCU\SOFTWARE\Microsoft\* [*] - - -``` - -**Important**   -The configurable **<ErrorControl>** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, you can specify a path using the (\*) wildcard character. - - - -### <fatal> - -The **<fatal>** element is not required. - -- **Number of occurrences**: Once for each component - -- **Parent elements**: **<fileError>** and **<registryError>** - -- **Child elements**: None. - -Syntax: ``*<pattern>*`` - - ----- - - - - - - - - - - - - - - -
                        ParameterRequiredValue

                        errorCode

                        No

                        "any" or "specify system error message here"

                        - - - -You use the **<fatal>** element to specify that errors matching a specific pattern should cause USMT to halt the migration. - -## <fileError> - - -The **<fileError>** element is not required. - -- **Number of occurrences**: Once for each component - -- **Parent elements**: **<ErrorControl>** - -- **Child elements**: **<nonFatal>** and **<fatal>** - -Syntax: `` - -You use the **<fileError>** element to represent the behavior associated with file errors. - -## <nonFatal> - - -The **<nonFatal>** element is not required. - -- **Number of occurrences**: Once for each component - -- **Parent elements**: The **<fileError>** and **<registryError>** elements. - -- **Child elements**: None. - -Syntax: ``*<pattern>*`` - - ----- - - - - - - - - - - - - - - -
                        ParameterRequiredValue

                        <errorCode>

                        No

                        "any" or "specify system error message here". If system error messages are not specified, the default behavior applies the parameter to all system error messages.

                        - - - -You use the **<nonFatal>** element to specify that errors matching a specific pattern should not cause USMT to halt the migration. - -## <registryError> - - -The <registryError>element is not required. - -- **Number of occurrences**: Once for each component - -- **Parent elements**: **<ErrorControl>** - -- **Child elements**: **<nonfatal>** and **<fatal>** - -Syntax: `` - - ----- - - - - - - - - - - - - - - -
                        ParameterRequiredValue

                        <errorCode>

                        No

                        "any" or "specify system error message here". If system error messages are not specified, the default behavior applies the parameter to all system error messages.

                        - - - -You use the **<registryError>** element to specify that errors matching a specific pattern should not cause USMT to halt the migration. - -## <HardLinkStoreControl> - - -The **<HardLinkStoreControl>** element contains elements that describe how to handle files during the creation of a hard-link migration store. Its only valid child is **<fileLocked>**. - -Syntax: ` ` - -- **Number of occurrences**: Once for each component - -- **Parent elements**: **<Policies>** - -- **Child elements**: **<fileLocked>** - -Syntax: `` - -The **<HardLinkStoreControl>** sample code below specifies that hard links can be created to locked files only if the locked file resides somewhere under C:\\Users\\. Otherwise, a file-access error occurs when a locked file is encountered that cannot be copied, even though is technically possible for the link to be created. - -**Important**   -The **<ErrorControl>** section can be configured to conditionally ignore file access errors, based on the file’s location. - - - -``` syntax - - - - C:\Users\* - C:\* - - - - […] - - -``` - -## <fileLocked> - - -The **<fileLocked>** element contains elements that describe how to handle files that are locked for editing. The rules defined by the **<fileLocked>** element are processed in the order in which they appear in the XML file. - -Syntax: `` - -## <createHardLink> - - -The **<createHardLink>** element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application. - -Syntax: ``*<pattern>*`` - -## <errorHardLink> - - -The **<errorHardLink>** element defines a standard MigXML pattern that describes file paths where hard links should not be created if the file is locked for editing by another application. USMT will attempt to copy files under these paths into the migration store. However, if that is not possible, **Error\_Locked** is thrown. This is a standard Windows application programming interface (API) error that can be captured by the **<ErrorControl>** section to either cause USMT to skip the file or abort the migration. - -Syntax: ``*<pattern>*`` - -## <ProfileControl> - - -This element is used to contain other elements that establish rules for migrating profiles, users, and policies around local group membership during the migration. **<ProfileMigration>** is a child of **<Configuration>**. - -Syntax: <`ProfileControl> ` - -## <localGroups> - - -This element is used to contain other elements that establish rules for how to migrate local groups. **<localGroups>** is a child of **<ProfileControl>**. - -Syntax: ` ` - -## <mappings> - - -This element is used to contain other elements that establish mappings between groups. - -Syntax: ` ` - -## <changeGroup> - - -This element describes the source and destination groups for a local group membership change during the migration. It is a child of **<localGroups>**. The following parameters are defined: - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
                        ParameterRequiredValue

                        From

                        Yes

                        A valid local group on the source machine that contains users selected for migration on the command line.

                        To

                        Yes

                        A local group that the users are to be moved to during the migration.

                        appliesTo

                        Yes

                        nonmigratedUsers, migratedUsers, AllUsers. This value defines which users the change group operation should apply to.

                        - - - -The valid and required children of **<changeGroup>** are **<include>** and **<exclude>**. Although both can be children at the same time, only one is required. - -Syntax: ` ` - -## <include> - - -This element specifies that its required child, *<pattern>*, should be included in the migration. - -Syntax: ```` - -## <exclude> - - -This element specifies that its required child, *<pattern>*, should be excluded from the migration. - -Syntax: ``` ` - -## Sample Config.xml File - - -Refer to the following sample Config.xml file for additional details about items you can choose to exclude from a migration. - -```xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - - - - - - - - - +--- +title: Config.xml File (Windows 10) +description: Config.xml File +ms.assetid: 9dc98e76-5155-4641-bcb3-81915db538e8 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Config.xml File + + +## Config.xml File + + +The Config.xml file is an optional User State Migration Tool (USMT) 10.0 file that you can create using the **/genconfig** option with the ScanState.exe tool. If you want to include all of the default components, and do not want to change the default store-creation or profile-migration behavior, you do not need to create a Config.xml file. + +However, if you are satisfied with the default migration behavior defined in the MigApp.xml, MigUser.xml and MigDocs.xml files, but you want to exclude certain components, you can create and modify a Config.xml file and leave the other .xml files unchanged. For example, you must create and modify the Config.xml file if you want to exclude any of the operating-system settings that are migrated. It is necessary to create and modify this file if you want to change any of the default store-creation or profile-migration behavior. + +The Config.xml file has a different format than the other migration .xml files, because it does not contain any migration rules. It contains only a list of the operating-system components, applications, user documents that can be migrated, as well as user-profile policy and error-control policy. For this reason, excluding components using the Config.xml file is easier than modifying the migration .xml files, because you do not need to be familiar with the migration rules and syntax. However, you cannot use wildcard characters in this file. + +For more information about using the Config.xml file with other migration files, such as the MigDocs.xml and MigApps.xml files, see [Understanding Migration XML Files](understanding-migration-xml-files.md). + +**Note**   +To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. + + + +## In This Topic + + +In USMT there are new migration policies that can be configured in the Config.xml file. For example, you can configure additional **<ErrorControl>**, **<ProfileControl>**, and **<HardLinkStoreControl>** options. The following elements and parameters are for use in the Config.xml file only. + +[<Policies>](#bkmk-policies) + +[<ErrorControl>](#bkmk-errorcontrol) + +[<fatal>](#bkmk-fatal) + +[<fileError>](#bkmk-fileerror) + +[<nonfatal>](#bkmk-nonfatal) + +[<registryError>](#bkmk-registryerror) + +[<HardLinkStoreControl>](#bkmk-hardlinkstorecontrol) + +[<fileLocked>](#bkmk-filelock) + +[<createHardLink>](#bkmk-createhardlink) + +[<errorHardLink>](#bkmk-errorhardlink) + +[<ProfileControl>](#bkmk-profilecontrol) + +[<localGroups>](#bkmk-localgroups) + +[<mappings>](#bkmk-mappings) + +[<changeGroup>](#bkmk-changegrou) + +[<include>](#bkmk-include) + +[<exclude>](#bkmk-exclude) + +[Sample Config.xml File](#bkmk-sampleconfigxjmlfile) + +## <Policies> + + +The **<Policies>** element contains elements that describe the policies that USMT follows while creating a migration store. Valid children of the **<Policies>** element are **<ErrorControl>** and **<HardLinkStoreControl>**. The **<Policies>** element is a child of **<Configuration>**. + +Syntax: ` ` + +## <ErrorControl> + + +The **<ErrorControl>** element is an optional element you can configure in the Config.xml file. The configurable **<ErrorControl>** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, you can specify a path using the (\*) wildcard character. + +- **Number of occurrences**: Once for each component + +- **Parent elements**: The **<Policies>** element + +- **Child elements**: The **<fileError>** and **<registryError>** element + +Syntax: `` + +The following example specifies that all locked files, regardless of their location (including files in C:\\Users), should be ignored. However, the migration fails if any file in C:\\Users cannot be accessed because of any other reason. In the example below, the **<ErrorControl>** element ignores any problems in migrating registry keys that match the supplied pattern, and it resolves them to an **Access denied** error. + +Additionally, the order in the **<ErrorControl>** section implies priority. In this example, the first **<nonFatal>** tag takes precedence over the second **<fatal>** tag. This precedence is applied, regardless of how many tags are listed. + +``` xml + + + * [*] + C:\Users\* [*] + + + HKCU\SOFTWARE\Microsoft\* [*] + + +``` + +**Important**   +The configurable **<ErrorControl>** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, you can specify a path using the (\*) wildcard character. + + + +### <fatal> + +The **<fatal>** element is not required. + +- **Number of occurrences**: Once for each component + +- **Parent elements**: **<fileError>** and **<registryError>** + +- **Child elements**: None. + +Syntax: ``*<pattern>*`` + + +++++ + + + + + + + + + + + + + + +
                        ParameterRequiredValue

                        errorCode

                        No

                        "any" or "specify system error message here"

                        + + + +You use the **<fatal>** element to specify that errors matching a specific pattern should cause USMT to halt the migration. + +## <fileError> + + +The **<fileError>** element is not required. + +- **Number of occurrences**: Once for each component + +- **Parent elements**: **<ErrorControl>** + +- **Child elements**: **<nonFatal>** and **<fatal>** + +Syntax: `` + +You use the **<fileError>** element to represent the behavior associated with file errors. + +## <nonFatal> + + +The **<nonFatal>** element is not required. + +- **Number of occurrences**: Once for each component + +- **Parent elements**: The **<fileError>** and **<registryError>** elements. + +- **Child elements**: None. + +Syntax: ``*<pattern>*`` + + +++++ + + + + + + + + + + + + + + +
                        ParameterRequiredValue

                        <errorCode>

                        No

                        "any" or "specify system error message here". If system error messages are not specified, the default behavior applies the parameter to all system error messages.

                        + + + +You use the **<nonFatal>** element to specify that errors matching a specific pattern should not cause USMT to halt the migration. + +## <registryError> + + +The <registryError>element is not required. + +- **Number of occurrences**: Once for each component + +- **Parent elements**: **<ErrorControl>** + +- **Child elements**: **<nonfatal>** and **<fatal>** + +Syntax: `` + + +++++ + + + + + + + + + + + + + + +
                        ParameterRequiredValue

                        <errorCode>

                        No

                        "any" or "specify system error message here". If system error messages are not specified, the default behavior applies the parameter to all system error messages.

                        + + + +You use the **<registryError>** element to specify that errors matching a specific pattern should not cause USMT to halt the migration. + +## <HardLinkStoreControl> + + +The **<HardLinkStoreControl>** element contains elements that describe how to handle files during the creation of a hard-link migration store. Its only valid child is **<fileLocked>**. + +Syntax: ` ` + +- **Number of occurrences**: Once for each component + +- **Parent elements**: **<Policies>** + +- **Child elements**: **<fileLocked>** + +Syntax: `` + +The **<HardLinkStoreControl>** sample code below specifies that hard links can be created to locked files only if the locked file resides somewhere under C:\\Users\\. Otherwise, a file-access error occurs when a locked file is encountered that cannot be copied, even though is technically possible for the link to be created. + +**Important**   +The **<ErrorControl>** section can be configured to conditionally ignore file access errors, based on the file’s location. + + + +``` xml + + + + C:\Users\* + C:\* + + + + […] + + +``` + +## <fileLocked> + + +The **<fileLocked>** element contains elements that describe how to handle files that are locked for editing. The rules defined by the **<fileLocked>** element are processed in the order in which they appear in the XML file. + +Syntax: `` + +## <createHardLink> + + +The **<createHardLink>** element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application. + +Syntax: ``*<pattern>*`` + +## <errorHardLink> + + +The **<errorHardLink>** element defines a standard MigXML pattern that describes file paths where hard links should not be created if the file is locked for editing by another application. USMT will attempt to copy files under these paths into the migration store. However, if that is not possible, **Error\_Locked** is thrown. This is a standard Windows application programming interface (API) error that can be captured by the **<ErrorControl>** section to either cause USMT to skip the file or abort the migration. + +Syntax: ``*<pattern>*`` + +## <ProfileControl> + + +This element is used to contain other elements that establish rules for migrating profiles, users, and policies around local group membership during the migration. **<ProfileMigration>** is a child of **<Configuration>**. + +Syntax: <`ProfileControl> ` + +## <localGroups> + + +This element is used to contain other elements that establish rules for how to migrate local groups. **<localGroups>** is a child of **<ProfileControl>**. + +Syntax: ` ` + +## <mappings> + + +This element is used to contain other elements that establish mappings between groups. + +Syntax: ` ` + +## <changeGroup> + + +This element describes the source and destination groups for a local group membership change during the migration. It is a child of **<localGroups>**. The following parameters are defined: + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +
                        ParameterRequiredValue

                        From

                        Yes

                        A valid local group on the source machine that contains users selected for migration on the command line.

                        To

                        Yes

                        A local group that the users are to be moved to during the migration.

                        appliesTo

                        Yes

                        nonmigratedUsers, migratedUsers, AllUsers. This value defines which users the change group operation should apply to.

                        + + + +The valid and required children of **<changeGroup>** are **<include>** and **<exclude>**. Although both can be children at the same time, only one is required. + +Syntax: ` ` + +## <include> + + +This element specifies that its required child, *<pattern>*, should be included in the migration. + +Syntax: ```` + +## <exclude> + + +This element specifies that its required child, *<pattern>*, should be excluded from the migration. + +Syntax: ``` ` + +## Sample Config.xml File + + +Refer to the following sample Config.xml file for additional details about items you can choose to exclude from a migration. + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-conflicts-and-precedence.md b/windows/deployment/usmt/usmt-conflicts-and-precedence.md index ecba40336b..5b40bd3e9d 100644 --- a/windows/deployment/usmt/usmt-conflicts-and-precedence.md +++ b/windows/deployment/usmt/usmt-conflicts-and-precedence.md @@ -1,464 +1,465 @@ ---- -title: Conflicts and Precedence (Windows 10) -description: Conflicts and Precedence -ms.assetid: 0e2691a8-ff1e-4424-879b-4d5a2f8a113a -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Conflicts and Precedence - - -When you include, exclude, and reroute files and settings, it is important to know how User State Migration Tool (USMT) 10.0 deals with conflicts and precedence. When working with USMT, the following are the most important conflicts and precedence guidelines to keep in mind. - -- **If there are conflicting rules within a component, the most specific rule is applied.** However, the <unconditionalExclude> rule is an exception because it takes precedence over all others. Directory names take precedence over file extensions. For examples, see [What happens when there are conflicting include and exclude rules?](#bkmk1) and the first example in [Include and exclude precedence examples](#precexamples)****later in this topic. - -- **Only rules inside the same component can affect each other, depending on specificity.** Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. - -- **If the rules are equally specific, <exclude> takes precedence over <include>.** For example, if you use the <exclude> rule to exclude a file and use the <include> rule to include the same file, the file will be excluded. - -- **The ordering of components does not matter.** It does not matter which components are listed in which .xml file, because each component is processed independently of the other components across all of the .xml files. - -- **The ordering of the <include> and <exclude> rules within a component does not matter.** - -- **You can use the <unconditionalExclude> element to globally exclude data.** This element excludes objects, regardless of any other <include> rules that are in the .xml files. For example, you can use the <unconditionalExclude> element to exclude all MP3 files on the computer or to exclude all files from C:\\UserData. - -## In This Topic - - -**General** - -- [What is the relationship between rules that are located within different components?](#bkmk2) - -- [How does precedence work with the Config.xml file?](#bkmk3) - -- [How does USMT process each component in an .xml file with multiple components?](#bkmk4) - -- [How are rules processed?](#bkmk5) - -- [How does USMT combine all of the .xml files that I specify on the command line?](#bkmk6) - -**The <include> and <exclude> rules** - -- [What happens when there are conflicting include and exclude rules?](#bkmk1) - -- [<include> and <exclude> precedence examples](#precexamples) - -**File collisions** - -- [What is the default behavior when there are file collisions?](#collisions) - -- [How does the <merge> rule work when there are file collisions?](#bkmk11) - -## General - - -### What is the relationship between rules that are located within different components? - -Only rules inside the same component can affect each other, depending on specificity, except for the <unconditionalExclude> rule. Rules that are in different components do not affect each other. If there is an <include> rule in one component and an identical <exclude> rule in another component, the data will be migrated because the two rules are independent of each other. - -If you have an <include> rule in one component and a <locationModify> rule in another component for the same file, the file will be migrated in both places. That is, it will be included based on the <include> rule, and it will be migrated based on the <locationModify> rule. - -The following .xml file migrates all files from C:\\Userdocs, including .mp3 files, because the <exclude> rule is specified in a separate component. - -``` syntax - - -User Documents - - - - - C:\Userdocs\* [*.mp3] - - - - - - - - User documents to include - - - - - C:\Userdocs\ [*] - - - - - - -``` - -### How does precedence work with the Config.xml file? - -Specifying `migrate="no"` in the Config.xml file is the same as deleting the corresponding component from the migration .xml file. However, if you set `migrate="no"` for My Documents, but you have a rule similar to the one shown below in a migration .xml file (which includes all of the .doc files from My Documents), then only the .doc files will be migrated, and all other files will be excluded. - -``` syntax - - - %CSIDL_PERSONAL%\* [*.doc] - - -``` - -### How does USMT process each component in an .xml file with multiple components? - -The ordering of components does not matter. Each component is processed independently of other components. For example, if you have an <include> rule in one component and a <locationModify> rule in another component for the same file, the file will be migrated in both places. That is, it will be included based on the <include> rule, and it will be migrated based on the <locationModify> rule. - -### How are rules processed? - -There are two broad categories of rules. - -- **Rules that affect the behavior of both the ScanState and LoadState tools**. For example, the <include>, <exclude>, and <unconditionalExclude> rules are processed for each component in the .xml files. For each component, USMT creates an include list and an exclude list. Some of the rules in the component might be discarded due to specificity, but all of the remaining rules are processed. For each <include> rule, USMT iterates through the elements to see if any of the locations need to be excluded. USMT enumerates all of the objects and creates a list of objects it is going to collect for each user. Once the list is complete, each of the objects is stored or migrated to the destination computer. - -- **Rules that affect the behavior of only the LoadState tool**. For example, the <locationModify>, <contentModify>, and <destinationCleanup> rules do not affect ScanState. They are processed only with LoadState. First, the LoadState tool determines the content and location of each component based on the <locationModify>and <contentModify> rules. Then, LoadState processes all of the <destinationCleanup> rules and deletes data from the destination computer. Lastly, LoadState applies the components to the computer. - -### How does USMT combine all of the .xml files that I specify on the command line? - -USMT does not distinguish the .xml files based on their name or content. It processes each component within the files separately. USMT supports multiple .xml files only to make it easier to maintain and organize the components within them. Because USMT uses a urlid to distinguish each component from the others, be sure that each .xml file that you specify on the command line has a unique migration urlid. - -## The <include> and <exclude> rules - - -### What happens when there are conflicting <include> and <exclude> rules? - -If there are conflicting rules within a component, the most specific rule is applied, except with the <unconditionalExclude> rule, which takes precedence over all other rules. If the rules are equally specific, then the data will be not be migrated. For example if you exclude a file, and include the same file, the file will not be migrated. If there are conflicting rules within different components, the rules do not affect each other because each component is processed independently. - -In the following example, mp3 files will not be excluded from the migration. This is because directory names take precedence over the file extensions. - -``` syntax - - - C:\Data\* [*] - - - - - C:\* [*.mp3] - - -``` - -### <include> and <exclude> rules precedence examples - -These examples explain how USMT deals with <include> and <exclude> rules. When the rules are in different components, the resulting behavior will be the same regardless of whether the components are in the same or in different migration .xml files. - -- [Including and excluding files](#filesex) - -- [Including and excluding registry objects](#regex) - -### Including and excluding files - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        If you have the following code in the same componentResulting behaviorExplanation
                          -

                        • Include rule: <pattern type="File">C:\Dir1* []</pattern>

                          • -

                        • Exclude rule: <pattern type="File">C:* [.txt]</pattern>

                          • -

                        Migrates all files and subfolders in Dir1 (including all .txt files in C:).

                        The <exclude> rule does not affect the migration because the <include> rule is more specific.

                          -

                        • Include rule: <pattern type="File">C:\Dir1* []</pattern>

                          • -

                        • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                          • -

                        Migrates all files and subfolders in C:\Dir1, except the .txt files in C:\Dir1\Dir2 and its subfolders.

                        Both rules are processed as intended.

                          -

                        • Include rule: <pattern type="File">C:\Dir1* []</pattern>

                          • -

                        • Exclude rule: <pattern type="File">C:\Dir1\ * [.txt]</pattern>

                          • -

                        Migrates all files and subfolders in C:\Dir1, except the .txt files in C:\Dir1 and its subfolders.

                        Both rules are processed as intended.

                          -

                        • Include rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                          • -

                        • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                          • -

                        Nothing will be migrated.

                        The rules are equally specific, so the <exclude> rule takes precedence over the <include> rule.

                          -

                        • Include rule: C:\Dir1* [.txt]

                          • -

                        • Exclude rule: C:\Dir1\Dir2* []

                          • -

                        Migrates the .txt files in Dir1 and the .txt files from subfolders other than Dir2.

                        -

                        No files are migrated from Dir2 or its subfolders.

                        Both rules are processed as intended.

                          -

                        • Include rule: C:\Dir1\Dir2* []

                          • -

                        • Exclude rule: C:\Dir1* [.txt]

                          • -

                        Migrates all files and subfolders of Dir2, except the .txt files from Dir1 and any subfolders of Dir1 (including Dir2).

                        Both rules are processed as intended.

                        - - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
                        If you have the following code in different componentsResulting behaviorExplanation

                        Component 1:

                        -
                          -

                        • Include rule: <pattern type="File">C:\Dir1* []</pattern>

                          • -

                        • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                          • -
                        -

                        Component 2:

                        -
                          -

                        • Include rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                          • -

                        • Exclude rule: <pattern type="File">C:\Dir1* []</pattern>

                          • -

                        Migrates all files and subfolders of C:\Dir1\ (including C:\Dir1\Dir2).

                        Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. Therefore, in this example, although some .txt files were excluded when Component 1 was processed, they were included when Component 2 was processed.

                        Component 1:

                        -
                          -

                        • Include rule: C:\Dir1\Dir2* []

                          • -
                        -

                        Component 2:

                        -
                          -

                        • Exclude rule: C:\Dir1* [.txt]

                          • -

                        Migrates all files and subfolders from Dir2 except the .txt files in C:\Dir1 and its subfolders.

                        Both rules are processed as intended.

                        Component 1:

                        -
                          -

                        • Exclude rule: C:\Dir1\Dir2* []

                          • -
                        -

                        Component 2:

                        -
                          -

                        • Include rule: C:\Dir1* [.txt]

                          • -

                        Migrates all .txt files in Dir1 and any subfolders.

                        Component 1 does not contain an <include> rule, so the <exclude> rule is not processed.

                        - - - -### Including and excluding registry objects - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
                        If you have the following code in the same componentResulting behaviorExplanation
                          -

                        • Include rule: HKLM\Software\Microsoft\Command Processor* []

                          • -

                        • Exclude Rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                          • -

                        Migrates all keys in HKLM\Software\Microsoft\Command Processor except DefaultColor.

                        Both rules are processed as intended.

                          -

                        • Include rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                          • -

                        • Exclude Rule: HKLM\Software\Microsoft\Command Processor* []

                          • -

                        Migrates only DefaultColor in HKLM\Software\Microsoft\Command Processor.

                        DefaultColor is migrated because the <include> rule is more specific than the <exclude> rule.

                          -

                        • Include rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                          • -

                        • Exclude rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                          • -

                        Does not migrate DefaultColor.

                        The rules are equally specific, so the <exclude> rule takes precedence over the <include> rule.

                        - - - - ----- - - - - - - - - - - - - - - -
                        If you have the following code in different componentsResulting behaviorExplanation

                        Component 1:

                        -
                          -

                        • Include rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                          • -

                        • Exclude rule: HKLM\Software\Microsoft\Command Processor* []

                          • -
                        -

                        Component 2:

                        -
                          -

                        • Include rule: HKLM\Software\Microsoft\Command Processor* []

                          • -

                        • Exclude rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                          • -

                        Migrates all the keys/values under HKLM\Software\Microsoft\Command Processor.

                        Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. Therefore, in this example, the objects that were excluded when Component 1 was processed were included when Component 2 was processed.

                        - - - -## File collisions - - -### What is the default behavior when there are file collisions? - -If there is not a <merge> rule, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally: for example, OriginalFileName(1).OriginalExtension, OriginalFileName(2).OriginalExtension, and so on. - -### How does the <merge> rule work when there are file collisions? - -When a collision is detected, USMT will select the most specific <merge> rule and apply it to resolve the conflict. For example, if you have a <merge> rule for C:\\\* \[\*\] set to **sourcePriority()** and another <merge> rule for C:\\subfolder\\\* \[\*\] set to **destinationPriority()** , then USMT uses the destinationPriority() rule because it is the most specific. - -### Example scenario - -The source computer contains the following files: - -- C:\\Data\\SampleA.txt - -- C:\\Data\\SampleB.txt - -- C:\\Data\\Folder\\SampleB.txt - -The destination computer contains the following files: - -- C:\\Data\\SampleB.txt - -- C:\\Data\\Folder\\SampleB.txt - -You have a custom .xml file that contains the following code: - -``` syntax - - - c:\data\* [*] - - -``` - -For this example, the following table describes the resulting behavior if you add the code in the first column to your custom .xml file. - - ---- - - - - - - - - - - - - - - - - - - - - -
                        If you specify the following codeResulting behavior
                        <merge script="MigXmlHelper.DestinationPriority()"> 
-   <objectSet> 
-      <pattern type="File">c:\data* []</pattern> 
-   </objectSet> 
-</merge>

                        During ScanState, all the files will be added to the store.

                        -

                        During LoadState, only C:\Data\SampleA.txt will be restored.

                        <merge script="MigXmlHelper.SourcePriority()"> 
-   <objectSet> 
-      <pattern type="File">c:\data* []</pattern> 
-   </objectSet> 
-</merge>

                        During ScanState, all the files will be added to the store.

                        -

                        During LoadState, all the files will be restored, overwriting the existing files on the destination computer.

                        <merge script="MigXmlHelper.SourcePriority()"> 
-   <objectSet> 
-      <pattern type="File">c:\data\ [*]</pattern> 
-   </objectSet> 
-</merge>

                        During ScanState, all the files will be added to the store.

                        -

                        During LoadState, the following will occur:

                        -
                          -

                        • C:\Data\SampleA.txt will be restored.

                          • -

                        • C:\Data\SampleB.txt will be restored, overwriting the existing file on the destination computer.

                          • -

                        • C:\Data\Folder\SampleB.txt will not be restored.

                          • -
                        - - - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - - - - - - - - - +--- +title: Conflicts and Precedence (Windows 10) +description: Conflicts and Precedence +ms.assetid: 0e2691a8-ff1e-4424-879b-4d5a2f8a113a +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Conflicts and Precedence + + +When you include, exclude, and reroute files and settings, it is important to know how User State Migration Tool (USMT) 10.0 deals with conflicts and precedence. When working with USMT, the following are the most important conflicts and precedence guidelines to keep in mind. + +- **If there are conflicting rules within a component, the most specific rule is applied.** However, the <unconditionalExclude> rule is an exception because it takes precedence over all others. Directory names take precedence over file extensions. For examples, see [What happens when there are conflicting include and exclude rules?](#bkmk1) and the first example in [Include and exclude precedence examples](#precexamples)****later in this topic. + +- **Only rules inside the same component can affect each other, depending on specificity.** Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. + +- **If the rules are equally specific, <exclude> takes precedence over <include>.** For example, if you use the <exclude> rule to exclude a file and use the <include> rule to include the same file, the file will be excluded. + +- **The ordering of components does not matter.** It does not matter which components are listed in which .xml file, because each component is processed independently of the other components across all of the .xml files. + +- **The ordering of the <include> and <exclude> rules within a component does not matter.** + +- **You can use the <unconditionalExclude> element to globally exclude data.** This element excludes objects, regardless of any other <include> rules that are in the .xml files. For example, you can use the <unconditionalExclude> element to exclude all MP3 files on the computer or to exclude all files from C:\\UserData. + +## In This Topic + + +**General** + +- [What is the relationship between rules that are located within different components?](#bkmk2) + +- [How does precedence work with the Config.xml file?](#bkmk3) + +- [How does USMT process each component in an .xml file with multiple components?](#bkmk4) + +- [How are rules processed?](#bkmk5) + +- [How does USMT combine all of the .xml files that I specify on the command line?](#bkmk6) + +**The <include> and <exclude> rules** + +- [What happens when there are conflicting include and exclude rules?](#bkmk1) + +- [<include> and <exclude> precedence examples](#precexamples) + +**File collisions** + +- [What is the default behavior when there are file collisions?](#collisions) + +- [How does the <merge> rule work when there are file collisions?](#bkmk11) + +## General + + +### What is the relationship between rules that are located within different components? + +Only rules inside the same component can affect each other, depending on specificity, except for the <unconditionalExclude> rule. Rules that are in different components do not affect each other. If there is an <include> rule in one component and an identical <exclude> rule in another component, the data will be migrated because the two rules are independent of each other. + +If you have an <include> rule in one component and a <locationModify> rule in another component for the same file, the file will be migrated in both places. That is, it will be included based on the <include> rule, and it will be migrated based on the <locationModify> rule. + +The following .xml file migrates all files from C:\\Userdocs, including .mp3 files, because the <exclude> rule is specified in a separate component. + +``` xml + + +User Documents + + + + + C:\Userdocs\* [*.mp3] + + + + + + + + User documents to include + + + + + C:\Userdocs\ [*] + + + + + + +``` + +### How does precedence work with the Config.xml file? + +Specifying `migrate="no"` in the Config.xml file is the same as deleting the corresponding component from the migration .xml file. However, if you set `migrate="no"` for My Documents, but you have a rule similar to the one shown below in a migration .xml file (which includes all of the .doc files from My Documents), then only the .doc files will be migrated, and all other files will be excluded. + +``` xml + + + %CSIDL_PERSONAL%\* [*.doc] + + +``` + +### How does USMT process each component in an .xml file with multiple components? + +The ordering of components does not matter. Each component is processed independently of other components. For example, if you have an <include> rule in one component and a <locationModify> rule in another component for the same file, the file will be migrated in both places. That is, it will be included based on the <include> rule, and it will be migrated based on the <locationModify> rule. + +### How are rules processed? + +There are two broad categories of rules. + +- **Rules that affect the behavior of both the ScanState and LoadState tools**. For example, the <include>, <exclude>, and <unconditionalExclude> rules are processed for each component in the .xml files. For each component, USMT creates an include list and an exclude list. Some of the rules in the component might be discarded due to specificity, but all of the remaining rules are processed. For each <include> rule, USMT iterates through the elements to see if any of the locations need to be excluded. USMT enumerates all of the objects and creates a list of objects it is going to collect for each user. Once the list is complete, each of the objects is stored or migrated to the destination computer. + +- **Rules that affect the behavior of only the LoadState tool**. For example, the <locationModify>, <contentModify>, and <destinationCleanup> rules do not affect ScanState. They are processed only with LoadState. First, the LoadState tool determines the content and location of each component based on the <locationModify>and <contentModify> rules. Then, LoadState processes all of the <destinationCleanup> rules and deletes data from the destination computer. Lastly, LoadState applies the components to the computer. + +### How does USMT combine all of the .xml files that I specify on the command line? + +USMT does not distinguish the .xml files based on their name or content. It processes each component within the files separately. USMT supports multiple .xml files only to make it easier to maintain and organize the components within them. Because USMT uses a urlid to distinguish each component from the others, be sure that each .xml file that you specify on the command line has a unique migration urlid. + +## The <include> and <exclude> rules + + +### What happens when there are conflicting <include> and <exclude> rules? + +If there are conflicting rules within a component, the most specific rule is applied, except with the <unconditionalExclude> rule, which takes precedence over all other rules. If the rules are equally specific, then the data will be not be migrated. For example if you exclude a file, and include the same file, the file will not be migrated. If there are conflicting rules within different components, the rules do not affect each other because each component is processed independently. + +In the following example, mp3 files will not be excluded from the migration. This is because directory names take precedence over the file extensions. + +``` xml + + + C:\Data\* [*] + + + + + C:\* [*.mp3] + + +``` + +### <include> and <exclude> rules precedence examples + +These examples explain how USMT deals with <include> and <exclude> rules. When the rules are in different components, the resulting behavior will be the same regardless of whether the components are in the same or in different migration .xml files. + +- [Including and excluding files](#filesex) + +- [Including and excluding registry objects](#regex) + +### Including and excluding files + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        If you have the following code in the same componentResulting behaviorExplanation
                          +

                        • Include rule: <pattern type="File">C:\Dir1* []</pattern>

                          • +

                        • Exclude rule: <pattern type="File">C:* [.txt]</pattern>

                          • +

                        Migrates all files and subfolders in Dir1 (including all .txt files in C:).

                        The <exclude> rule does not affect the migration because the <include> rule is more specific.

                          +

                        • Include rule: <pattern type="File">C:\Dir1* []</pattern>

                          • +

                        • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                          • +

                        Migrates all files and subfolders in C:\Dir1, except the .txt files in C:\Dir1\Dir2 and its subfolders.

                        Both rules are processed as intended.

                          +

                        • Include rule: <pattern type="File">C:\Dir1* []</pattern>

                          • +

                        • Exclude rule: <pattern type="File">C:\Dir1\ * [.txt]</pattern>

                          • +

                        Migrates all files and subfolders in C:\Dir1, except the .txt files in C:\Dir1 and its subfolders.

                        Both rules are processed as intended.

                          +

                        • Include rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                          • +

                        • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                          • +

                        Nothing will be migrated.

                        The rules are equally specific, so the <exclude> rule takes precedence over the <include> rule.

                          +

                        • Include rule: C:\Dir1* [.txt]

                          • +

                        • Exclude rule: C:\Dir1\Dir2* []

                          • +

                        Migrates the .txt files in Dir1 and the .txt files from subfolders other than Dir2.

                        +

                        No files are migrated from Dir2 or its subfolders.

                        Both rules are processed as intended.

                          +

                        • Include rule: C:\Dir1\Dir2* []

                          • +

                        • Exclude rule: C:\Dir1* [.txt]

                          • +

                        Migrates all files and subfolders of Dir2, except the .txt files from Dir1 and any subfolders of Dir1 (including Dir2).

                        Both rules are processed as intended.

                        + + + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +
                        If you have the following code in different componentsResulting behaviorExplanation

                        Component 1:

                        +
                          +

                        • Include rule: <pattern type="File">C:\Dir1* []</pattern>

                          • +

                        • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                          • +
                        +

                        Component 2:

                        +
                          +

                        • Include rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                          • +

                        • Exclude rule: <pattern type="File">C:\Dir1* []</pattern>

                          • +

                        Migrates all files and subfolders of C:\Dir1\ (including C:\Dir1\Dir2).

                        Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. Therefore, in this example, although some .txt files were excluded when Component 1 was processed, they were included when Component 2 was processed.

                        Component 1:

                        +
                          +

                        • Include rule: C:\Dir1\Dir2* []

                          • +
                        +

                        Component 2:

                        +
                          +

                        • Exclude rule: C:\Dir1* [.txt]

                          • +

                        Migrates all files and subfolders from Dir2 except the .txt files in C:\Dir1 and its subfolders.

                        Both rules are processed as intended.

                        Component 1:

                        +
                          +

                        • Exclude rule: C:\Dir1\Dir2* []

                          • +
                        +

                        Component 2:

                        +
                          +

                        • Include rule: C:\Dir1* [.txt]

                          • +

                        Migrates all .txt files in Dir1 and any subfolders.

                        Component 1 does not contain an <include> rule, so the <exclude> rule is not processed.

                        + + + +### Including and excluding registry objects + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +
                        If you have the following code in the same componentResulting behaviorExplanation
                          +

                        • Include rule: HKLM\Software\Microsoft\Command Processor* []

                          • +

                        • Exclude Rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                          • +

                        Migrates all keys in HKLM\Software\Microsoft\Command Processor except DefaultColor.

                        Both rules are processed as intended.

                          +

                        • Include rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                          • +

                        • Exclude Rule: HKLM\Software\Microsoft\Command Processor* []

                          • +

                        Migrates only DefaultColor in HKLM\Software\Microsoft\Command Processor.

                        DefaultColor is migrated because the <include> rule is more specific than the <exclude> rule.

                          +

                        • Include rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                          • +

                        • Exclude rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                          • +

                        Does not migrate DefaultColor.

                        The rules are equally specific, so the <exclude> rule takes precedence over the <include> rule.

                        + + + + +++++ + + + + + + + + + + + + + + +
                        If you have the following code in different componentsResulting behaviorExplanation

                        Component 1:

                        +
                          +

                        • Include rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                          • +

                        • Exclude rule: HKLM\Software\Microsoft\Command Processor* []

                          • +
                        +

                        Component 2:

                        +
                          +

                        • Include rule: HKLM\Software\Microsoft\Command Processor* []

                          • +

                        • Exclude rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                          • +

                        Migrates all the keys/values under HKLM\Software\Microsoft\Command Processor.

                        Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. Therefore, in this example, the objects that were excluded when Component 1 was processed were included when Component 2 was processed.

                        + + + +## File collisions + + +### What is the default behavior when there are file collisions? + +If there is not a <merge> rule, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally: for example, OriginalFileName(1).OriginalExtension, OriginalFileName(2).OriginalExtension, and so on. + +### How does the <merge> rule work when there are file collisions? + +When a collision is detected, USMT will select the most specific <merge> rule and apply it to resolve the conflict. For example, if you have a <merge> rule for C:\\\* \[\*\] set to **sourcePriority()** and another <merge> rule for C:\\subfolder\\\* \[\*\] set to **destinationPriority()** , then USMT uses the destinationPriority() rule because it is the most specific. + +### Example scenario + +The source computer contains the following files: + +- C:\\Data\\SampleA.txt + +- C:\\Data\\SampleB.txt + +- C:\\Data\\Folder\\SampleB.txt + +The destination computer contains the following files: + +- C:\\Data\\SampleB.txt + +- C:\\Data\\Folder\\SampleB.txt + +You have a custom .xml file that contains the following code: + +``` xml + + + c:\data\* [*] + + +``` + +For this example, the following table describes the resulting behavior if you add the code in the first column to your custom .xml file. + + ++++ + + + + + + + + + + + + + + + + + + + + +
                        If you specify the following codeResulting behavior
                        <merge script="MigXmlHelper.DestinationPriority()"> 
+   <objectSet> 
+      <pattern type="File">c:\data* []</pattern> 
+   </objectSet> 
+</merge>

                        During ScanState, all the files will be added to the store.

                        +

                        During LoadState, only C:\Data\SampleA.txt will be restored.

                        <merge script="MigXmlHelper.SourcePriority()"> 
+   <objectSet> 
+      <pattern type="File">c:\data* []</pattern> 
+   </objectSet> 
+</merge>

                        During ScanState, all the files will be added to the store.

                        +

                        During LoadState, all the files will be restored, overwriting the existing files on the destination computer.

                        <merge script="MigXmlHelper.SourcePriority()"> 
+   <objectSet> 
+      <pattern type="File">c:\data\ [*]</pattern> 
+   </objectSet> 
+</merge>

                        During ScanState, all the files will be added to the store.

                        +

                        During LoadState, the following will occur:

                        +
                          +

                        • C:\Data\SampleA.txt will be restored.

                          • +

                        • C:\Data\SampleB.txt will be restored, overwriting the existing file on the destination computer.

                          • +

                        • C:\Data\Folder\SampleB.txt will not be restored.

                          • +
                        + + + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-custom-xml-examples.md b/windows/deployment/usmt/usmt-custom-xml-examples.md index af14caacd3..66f4f18511 100644 --- a/windows/deployment/usmt/usmt-custom-xml-examples.md +++ b/windows/deployment/usmt/usmt-custom-xml-examples.md @@ -1,317 +1,318 @@ ---- -title: Custom XML Examples (Windows 10) -description: Custom XML Examples -ms.assetid: 48f441d9-6c66-43ef-91e9-7c78cde6fcc0 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Custom XML Examples - - -**Note**   -Because the tables in this topic are wide, you may need to adjust the width of its window. - - - -## In This Topic: - - -- [Example 1: Migrating an Unsupported Application](#example) - -- [Example 2: Migrating the My Videos Folder](#example2) - -- [Example 3: Migrating Files and Registry Keys](#example3) - -- [Example 4: Migrating Specific Folders from Various Locations](#example4) - -## Example 1: Migrating an Unsupported Application - - -The following is a template for the sections that you need to migrate your application. The template is not functional on its own, but you can use it to write your own .xml file. - -``` syntax - - - - Some Application - - - - - - value - - - - - - - - - - - - MigXMLHelper.DoesObjectExist("Registry","HKLM\Software\MyApp [win32_version]") - - - - - MigXMLHelper.DoesFileVersionMatch("%MyAppExePath%","ProductVersion","8.*") - MigXMLHelper.DoesFileVersionMatch("%MyAppExePath%","ProductVersion","9.*") - - - - - - - - - HKCU\Software\MyApp\Toolbar\* [*] - HKCU\Software\MyApp\ListView\* [*] - HKCU\Software\MyApp [ShowTips] - - - - - - - HKCU\Software\MyApp\Toolbar\* [*] - HKCU\Software\MyApp\ListView\* [*] - HKCU\Software\MyApp [ShowTips] - - - - - - - HKCU\Software\MyApp [Display] - - - - - - -``` - -## Example 2: Migrating the My Videos Folder - - -The following is a custom .xml file named CustomFile.xml that migrates My Videos for all users, if the folder exists on the source computer. - - ---- - - - - - - - - - - - - - - - - - - - - -
                        CodeBehavior
                        <condition>MigXmlHelper.DoesObjectExist("File","%CSIDL_MYVIDEO%")</condition>

                        Verifies that My Videos exists on the source computer.

                        <include filter='MigXmlHelper.IgnoreIrrelevantLinks()'>

                        Filters out the shortcuts in My Videos that do not resolve on the destination computer. This has no effect on files that are not shortcuts. For example, if there is a shortcut in My Videos on the source computer that points to C:\Folder1, that shortcut will be migrated only if C:\Folder1 exists on the destination computer. However, all other files, such as .mp3 files, migrate without any filtering.

                        <pattern type="File">%CSIDL_MYVIDEO%* [*]</pattern>

                        Migrates My Videos for all users.

                        - - - -```xml - - - - My Video - - - - MigXmlHelper.DoesObjectExist("File","%CSIDL_MYVIDEO%") - - - - - - %CSIDL_MYVIDEO%\* [*] - - - - - - -``` - -## Example 3: Migrating Files and Registry Keys - - -This table describes the behavior in the following example .xml file. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                        CodeBehavior
                        <pattern type="File">%ProgramFiles%\USMTTestFolder* [USMTTestFile.txt]</pattern>

                        Migrates all instances of the file Usmttestfile.txt from all sub-directories under %ProgramFiles%\USMTTestFolder.

                        <pattern type="File">%ProgramFiles%\USMTDIRTestFolder* []</pattern>

                        Migrates the whole directory under %ProgramFiles%\USMTDIRTestFolder.

                        <pattern type="Registry">HKCU\Software\USMTTESTKEY* [MyKey]</pattern>

                        Migrates all instances of MyKey under HKCU\Software\USMTTESTKEY.

                        <pattern type="Registry">HKLM\Software\USMTTESTKEY* []</pattern>

                        Migrates the entire registry hive under HKLM\Software\USMTTESTKEY.

                        - - - -``` syntax - - - File Migration Test - - - - - %ProgramFiles%\USMTTestFolder\* [USMTTestFile.txt] - %ProgramFiles%\USMTDIRTestFolder\* [*] - - - - - - - Registry Migration Test - - - - - HKCU\Software\USMTTESTKEY\* [MyKey] - HKLM\Software\USMTTESTKEY\* [*] - - - - - - -``` - -## Example 4: Migrating Specific Folders from Various Locations - - -The behavior for this custom .xml file is described within the <`displayName`> tags in the code. - -``` syntax - - - - Component to migrate all Engineering Drafts subfolders without documents in this folder - - - - - C:\EngineeringDrafts\* [*] - - - - - C:\EngineeringDrafts\ [*] - - - - - - - - Component to migrate all user documents except Sample.doc - - - - - C:\UserDocuments\* [*] - - - - - C:\UserDocuments\ [Sample.doc] - - - - - - - - Component to migrate all Requests folders on any drive on the computer - - - - - - - - - - - - - - Component to migrate all Presentations folder from any location on the C: drive - - - - - C:\*\Presentations\* [*] - C:\Presentations\* [*] - - - - - - -``` - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - -[Customize USMT XML Files](usmt-customize-xml-files.md) - - - - - - - - - +--- +title: Custom XML Examples (Windows 10) +description: Custom XML Examples +ms.assetid: 48f441d9-6c66-43ef-91e9-7c78cde6fcc0 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Custom XML Examples + + +**Note**   +Because the tables in this topic are wide, you may need to adjust the width of its window. + + + +## In This Topic: + + +- [Example 1: Migrating an Unsupported Application](#example) + +- [Example 2: Migrating the My Videos Folder](#example2) + +- [Example 3: Migrating Files and Registry Keys](#example3) + +- [Example 4: Migrating Specific Folders from Various Locations](#example4) + +## Example 1: Migrating an Unsupported Application + + +The following is a template for the sections that you need to migrate your application. The template is not functional on its own, but you can use it to write your own .xml file. + +``` xml + + + + Some Application + + + + + + value + + + + + + + + + + + + MigXMLHelper.DoesObjectExist("Registry","HKLM\Software\MyApp [win32_version]") + + + + + MigXMLHelper.DoesFileVersionMatch("%MyAppExePath%","ProductVersion","8.*") + MigXMLHelper.DoesFileVersionMatch("%MyAppExePath%","ProductVersion","9.*") + + + + + + + + + HKCU\Software\MyApp\Toolbar\* [*] + HKCU\Software\MyApp\ListView\* [*] + HKCU\Software\MyApp [ShowTips] + + + + + + + HKCU\Software\MyApp\Toolbar\* [*] + HKCU\Software\MyApp\ListView\* [*] + HKCU\Software\MyApp [ShowTips] + + + + + + + HKCU\Software\MyApp [Display] + + + + + + +``` + +## Example 2: Migrating the My Videos Folder + + +The following is a custom .xml file named CustomFile.xml that migrates My Videos for all users, if the folder exists on the source computer. + + ++++ + + + + + + + + + + + + + + + + + + + + +
                        CodeBehavior
                        <condition>MigXmlHelper.DoesObjectExist("File","%CSIDL_MYVIDEO%")</condition>

                        Verifies that My Videos exists on the source computer.

                        <include filter='MigXmlHelper.IgnoreIrrelevantLinks()'>

                        Filters out the shortcuts in My Videos that do not resolve on the destination computer. This has no effect on files that are not shortcuts. For example, if there is a shortcut in My Videos on the source computer that points to C:\Folder1, that shortcut will be migrated only if C:\Folder1 exists on the destination computer. However, all other files, such as .mp3 files, migrate without any filtering.

                        <pattern type="File">%CSIDL_MYVIDEO%* [*]</pattern>

                        Migrates My Videos for all users.

                        + + + +```xml + + + + My Video + + + + MigXmlHelper.DoesObjectExist("File","%CSIDL_MYVIDEO%") + + + + + + %CSIDL_MYVIDEO%\* [*] + + + + + + +``` + +## Example 3: Migrating Files and Registry Keys + + +This table describes the behavior in the following example .xml file. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
                        CodeBehavior
                        <pattern type="File">%ProgramFiles%\USMTTestFolder* [USMTTestFile.txt]</pattern>

                        Migrates all instances of the file Usmttestfile.txt from all sub-directories under %ProgramFiles%\USMTTestFolder.

                        <pattern type="File">%ProgramFiles%\USMTDIRTestFolder* []</pattern>

                        Migrates the whole directory under %ProgramFiles%\USMTDIRTestFolder.

                        <pattern type="Registry">HKCU\Software\USMTTESTKEY* [MyKey]</pattern>

                        Migrates all instances of MyKey under HKCU\Software\USMTTESTKEY.

                        <pattern type="Registry">HKLM\Software\USMTTESTKEY* []</pattern>

                        Migrates the entire registry hive under HKLM\Software\USMTTESTKEY.

                        + + + +``` xml + + + File Migration Test + + + + + %ProgramFiles%\USMTTestFolder\* [USMTTestFile.txt] + %ProgramFiles%\USMTDIRTestFolder\* [*] + + + + + + + Registry Migration Test + + + + + HKCU\Software\USMTTESTKEY\* [MyKey] + HKLM\Software\USMTTESTKEY\* [*] + + + + + + +``` + +## Example 4: Migrating Specific Folders from Various Locations + + +The behavior for this custom .xml file is described within the <`displayName`> tags in the code. + +``` xml + + + + Component to migrate all Engineering Drafts subfolders without documents in this folder + + + + + C:\EngineeringDrafts\* [*] + + + + + C:\EngineeringDrafts\ [*] + + + + + + + + Component to migrate all user documents except Sample.doc + + + + + C:\UserDocuments\* [*] + + + + + C:\UserDocuments\ [Sample.doc] + + + + + + + + Component to migrate all Requests folders on any drive on the computer + + + + + + + + + + + + + + Component to migrate all Presentations folder from any location on the C: drive + + + + + C:\*\Presentations\* [*] + C:\Presentations\* [*] + + + + + + +``` + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + +[Customize USMT XML Files](usmt-customize-xml-files.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-hard-link-migration-store.md b/windows/deployment/usmt/usmt-hard-link-migration-store.md index a3d0fe1b02..4b2d8385c2 100644 --- a/windows/deployment/usmt/usmt-hard-link-migration-store.md +++ b/windows/deployment/usmt/usmt-hard-link-migration-store.md @@ -1,235 +1,236 @@ ---- -title: Hard-Link Migration Store (Windows 10) -description: Hard-Link Migration Store -ms.assetid: b0598418-4607-4952-bfa3-b6e4aaa2c574 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Hard-Link Migration Store - - -A *hard-link migration store* enables you to perform an in-place migration where all user state is maintained on the computer while the old operating system is removed and the new operating system is installed; this is why it is best suited for the computer-refresh scenario. Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization, reduces deployment costs and enables entirely new migration scenarios. - -## In This Topic - - -[When to Use a Hard-Link Migration](#bkmk-when) - -[Understanding a Hard-Link Migration](#bkmk-understandhardlinkmig) - -[Scenario](#bkmk-scenario) - -[Hard-Link Migration Store Details](#bkmk-hardlinkstoredetails) - -[Hard Disk Space](#bkmk-harddiskspace) - -[Hard-Link Store Size Estimation](#bkmk-hardlinkstoresizeest) - -[Migration Store Path on Multiple Volumes](#bkmk-migstoremultvolumes) - -[Location Modifications](#bkmk-locationmodify) - -[Migrating Encrypting File System (EFS) Certificates and Files](#bkmk-efs) - -[Migrating Locked Files With the Hard-Link Migration Store](#bkmk-miglockedfiles) - -[XML Elements in the Config.xml File](#bkmk-xmlelementsinconfig) - -## When to Use a Hard-Link Migration - - -You can use a hard-link migration store when your planned migration meets both of the following criteria: - -- You are upgrading the operating system on existing hardware rather than migrating to new computers. - -- You are upgrading the operating system on the same volume of the computer. - -You cannot use a hard-link migration store if your planned migration includes any of the following: - -- You are migrating data from one computer to a second computer. - -- You are migrating data from one volume on a computer to another volume, for example from C: to D:. - -- You are formatting or repartitioning the disk outside of Windows Setup, or specifying a disk format or repartition during Windows Setup that will remove the migration store. - -## Understanding a Hard-Link Migration - - -The hard-link migration store is created using the command-line option, **/hardlink**, and is equivalent to other migration-store types. However, it differs in that hard links are utilized to keep files stored on the source computer during the migration. Keeping the files in place on the source computer eliminates the redundant work of duplicating files. It also enables the performance benefits and reduction in disk utilization that define this scenario. - -When you create a hard link, you give an existing file an additional path. For instance, you could create a hard link to c:\\file1.txt called c:\\hard link\\myFile.txt. These are two paths to the same file. If you open c:\\file1.txt, make changes, and save the file, you will see those changes when you open c:\\hard link\\myFile.txt. If you delete c:\\file1.txt, the file still exists on your computer as c:\\hardlink\\myFile.txt. You must delete both references to the file in order to delete the file. - -**Note**   -A hard link can only be created for a file on the same volume. If you copy a hard-link migration store to another drive or external device, the files, and not the links, are copied, as in a non-compressed migration-store scenario. - - - -For more information about hard links, please see [Hard Links and Junctions](https://go.microsoft.com/fwlink/p/?LinkId=132934) - -In most aspects, a hard-link migration store is identical to an uncompressed migration store. It is located where specified by the Scanstate command-line tool and you can view the contents of the store by using Windows® Explorer. Once created, it can be deleted or copied to another location without changing user state. Restoring a hard-link migration store is similar to restoring any other migration store; however, as with creating the store, the same hard-link functionality is used to keep files in-place. - -As a best practice, we recommend that you delete the hard-link migration store after you confirm that the Loadstate tool has successfully migrated the files. Since Loadstate has created new paths to the files on your new installation of a Windows operating system, deleting the hard links in the migration store will only delete one path to the files and will not delete the actual files or the paths to them from your new operating system. - -**Important**   -Using the **/c** option will force the Loadstate tool to continue applying files when non-fatal errors occur. If you use the **/c** option, you should verify that no errors are reported in the logs before deleting the hard-link migration store in order to avoid data loss. - - - -Keeping the hard-link migration store can result in additional disk space being consumed or problems with some applications for the following reasons: - -- Applications reporting file-system statistics, for example, space used and free space, might incorrectly report these statistics while the hard-link migration store is present. The file may be reported twice because of the two paths that reference that file. - -- A hard link may lose its connection to the original file. Some applications save changes to a file by creating a temporary file and then renaming the original to a backup filename. The path that was not used to open the file in this application will continue to refer to the unmodified file. The unmodified file that is not in use is taking up additional disk space. You should create the hard-link migration store just before you perform the migration, and not use applications once the store is created, in order to make sure you are migrating the latest versions of all files. - -- Editing the file by using different paths simultaneously may result in data corruption. - -**Important**   -The read-only file attribute on migrated files is lost when the hard-link migration store is deleted. This is due to a limitation in NTFS file system hard links. - - - -## Hard-Link Migration Scenario - - -For example, a company has decided to deploy Windows 10 on all of their computers. Each employee will keep the same computer, but the operating system on each computer will be updated. - -1. An administrator runs the ScanState command-line tool on each computer, specifying the **/hardlink** command-line option. The ScanState tool saves the user state to a hard-link migration store on each computer, improving performance by reducing file duplication, except in certain specific instances. - - **Note**   - As a best practice, we recommend that you do not create your hard-link migration store until just before you perform the migration in order to migrate the latest versions of your files. You should not use your software applications on the computer after creating the migration store until you have finished migrating your files with Loadstate. - - - -2. On each computer, an administrator installs the company's standard operating environment (SOE), which includes Windows 7 and other applications the company currently uses. - -3. An administrator runs the LoadState command-line tool on each computer. The LoadState tool restores user state back on each computer. - -## Hard-Link Migration Store Details - - -This section provides details about hard-link migration stores. - -### Hard Disk Space - -The **/hardlink** command-line option proceeds with creating the migration store only if there is 250 megabytes (MB) of free space on the hard disk. Provided that every volume involved in the migration is formatted as NTFS, 250 MB should be enough space to ensure success for almost every hard-link migration, regardless on the size of the migration. - -### Hard-Link Store Size Estimation - -It is not necessary to estimate the size of a hard-link migration store. Estimating the size of a migration store is only useful in scenarios where the migration store is very large, and on NTFS volumes the hard-link migration store will require much less incremental space than other store options. The only case where the local store can be quite large is when non-NTFS file systems exist on the system and contain data being migrated. Since NTFS has been the default file system format for Windows XP and newer operating systems, this situation is unusual. - -### Migration Store Path on Multiple Volumes - -Separate hard-link migration stores are created on each NTFS volume that contain data being migrated. In this scenario, the primary migration-store location will be specified on the command line, and should be the operating-system volume. Migration stores with identical names and directory names will be created on every volume containing data being migrated. For example: - -`Scanstate /hardlink c:\USMTMIG […]` - -Running this command on a system that contains the operating system on the C: drive and the user data on the D: drive will generate migration stores in the following locations, assuming that both drives are NTFS: - -C:\\USMTMIG\\ - -D:\\USMTMIG\\ - -The drive you specify on the command line for the hard-link migration store is important, because it defines where the *master migration store* should be placed. The *master migration store* is the location where data migrating from non-NTFS volumes is stored. This volume must have enough space to contain all of the data that comes from non-NTFS volumes. As in other scenarios, if a migration store already exists at the specified path, the **/o** option must be used to overwrite the existing data in the store. - -### Location Modifications - -Location modifications that redirect migrated content from one volume to a different volume have an adverse impact on the performance of a hard-link migration. This is because the migrating data that must cross system volumes cannot remain in the hard-link migration store, and must be copied across the system volumes. - -### Migrating Encrypting File System (EFS) Certificates and Files - -To migrate Encrypting File System (EFS) files to a new installation of an operating system on the same volume of the computer, specify the **/efs:hardlink** option in the Scanstate command-line syntax. - -If the EFS files are being restored to a different partition, you should use the **/efs:copyraw** option instead of the **/efs:hardlink** option. Hard links can only be created for files on the same volume. Moving the files to another partition during the migration requires a copy of the files to be created on the new partition. The **/efs:copyraw** option will copy the files to the new partition in encrypted format. - -For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md) and the Encrypted File Options in [ScanState Syntax](usmt-scanstate-syntax.md). - -### Migrating Locked Files with the Hard-Link Migration Store - -Files that are locked by an application or the operating system are handled differently when using a hard-link migration store. - -Files that are locked by the operating system cannot remain in place and must be copied into the hard-link migration store. As a result, selecting many operating-system files for migration significantly reduces performance during a hard-link migration. As a best practice, we recommend that you do not migrate any files out of the \\Windows directory, which minimizes performance-related issues. - -Files that are locked by an application are treated the same in hard-link migrations as in other scenarios when the volume shadow-copy service is not being utilized. The volume shadow-copy service cannot be used in conjunction with hard-link migrations. However, by modifying the new **<HardLinkStoreControl>** section in the Config.xml file, it is possible to enable the migration of files locked by an application. - -**Important**   -There are some scenarios in which modifying the **<HardLinkStoreControl>** section in the Config.xml file makes it more difficult to delete a hard-link migration store. In these scenarios, you must use USMTutils.exe to schedule the migration store for deletion on the next restart. - - - -## XML Elements in the Config.xml File - - -A new section in the Config.xml file allows optional configuration of some of the hard-link migration behavior introduced with the **/HardLink** option. - - ---- - - - - - - - - - - - - - - - - - - - - - - -

                        <Policies>

                        This element contains elements that describe the policies that USMT follows while creating a migration store.

                        <HardLinkStoreControl>

                        This element contains elements that describe how to handle files during the creation of a hard link migration store.

                        <fileLocked>

                        This element contains elements that describe how to handle files that are locked for editing.

                        <createHardLink>

                        This element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application.

                        -

                        Syntax: <createHardLink> [pattern] </createHardLink>

                        <errorHardLink>

                        This element defines a standard MigXML pattern that describes file paths where hard links should not be created, if the file is locked for editing by another application.

                        -

                        <errorHardLink> [pattern] </errorHardLink>

                        - - - -**Important**   -You must use the **/nocompress** option with the **/HardLink** option. - - - -The following XML sample specifies that files locked by an application under the \\Users directory can remain in place during the migration. It also specifies that locked files that are not located in the \\Users directory should result in the **File in Use** error. It is important to exercise caution when specifying the paths using the **File in Use<createhardlink>** tag in order to minimize scenarios that make the hard-link migration store more difficult to delete. - -``` syntax - - - - c:\Users\* [*] - C:\* [*] - - - -``` - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md) - - - - - - - - - +--- +title: Hard-Link Migration Store (Windows 10) +description: Hard-Link Migration Store +ms.assetid: b0598418-4607-4952-bfa3-b6e4aaa2c574 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Hard-Link Migration Store + + +A *hard-link migration store* enables you to perform an in-place migration where all user state is maintained on the computer while the old operating system is removed and the new operating system is installed; this is why it is best suited for the computer-refresh scenario. Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization, reduces deployment costs and enables entirely new migration scenarios. + +## In This Topic + + +[When to Use a Hard-Link Migration](#bkmk-when) + +[Understanding a Hard-Link Migration](#bkmk-understandhardlinkmig) + +[Scenario](#bkmk-scenario) + +[Hard-Link Migration Store Details](#bkmk-hardlinkstoredetails) + +[Hard Disk Space](#bkmk-harddiskspace) + +[Hard-Link Store Size Estimation](#bkmk-hardlinkstoresizeest) + +[Migration Store Path on Multiple Volumes](#bkmk-migstoremultvolumes) + +[Location Modifications](#bkmk-locationmodify) + +[Migrating Encrypting File System (EFS) Certificates and Files](#bkmk-efs) + +[Migrating Locked Files With the Hard-Link Migration Store](#bkmk-miglockedfiles) + +[XML Elements in the Config.xml File](#bkmk-xmlelementsinconfig) + +## When to Use a Hard-Link Migration + + +You can use a hard-link migration store when your planned migration meets both of the following criteria: + +- You are upgrading the operating system on existing hardware rather than migrating to new computers. + +- You are upgrading the operating system on the same volume of the computer. + +You cannot use a hard-link migration store if your planned migration includes any of the following: + +- You are migrating data from one computer to a second computer. + +- You are migrating data from one volume on a computer to another volume, for example from C: to D:. + +- You are formatting or repartitioning the disk outside of Windows Setup, or specifying a disk format or repartition during Windows Setup that will remove the migration store. + +## Understanding a Hard-Link Migration + + +The hard-link migration store is created using the command-line option, **/hardlink**, and is equivalent to other migration-store types. However, it differs in that hard links are utilized to keep files stored on the source computer during the migration. Keeping the files in place on the source computer eliminates the redundant work of duplicating files. It also enables the performance benefits and reduction in disk utilization that define this scenario. + +When you create a hard link, you give an existing file an additional path. For instance, you could create a hard link to c:\\file1.txt called c:\\hard link\\myFile.txt. These are two paths to the same file. If you open c:\\file1.txt, make changes, and save the file, you will see those changes when you open c:\\hard link\\myFile.txt. If you delete c:\\file1.txt, the file still exists on your computer as c:\\hardlink\\myFile.txt. You must delete both references to the file in order to delete the file. + +**Note**   +A hard link can only be created for a file on the same volume. If you copy a hard-link migration store to another drive or external device, the files, and not the links, are copied, as in a non-compressed migration-store scenario. + + + +For more information about hard links, please see [Hard Links and Junctions](https://go.microsoft.com/fwlink/p/?LinkId=132934) + +In most aspects, a hard-link migration store is identical to an uncompressed migration store. It is located where specified by the Scanstate command-line tool and you can view the contents of the store by using Windows® Explorer. Once created, it can be deleted or copied to another location without changing user state. Restoring a hard-link migration store is similar to restoring any other migration store; however, as with creating the store, the same hard-link functionality is used to keep files in-place. + +As a best practice, we recommend that you delete the hard-link migration store after you confirm that the Loadstate tool has successfully migrated the files. Since Loadstate has created new paths to the files on your new installation of a Windows operating system, deleting the hard links in the migration store will only delete one path to the files and will not delete the actual files or the paths to them from your new operating system. + +**Important**   +Using the **/c** option will force the Loadstate tool to continue applying files when non-fatal errors occur. If you use the **/c** option, you should verify that no errors are reported in the logs before deleting the hard-link migration store in order to avoid data loss. + + + +Keeping the hard-link migration store can result in additional disk space being consumed or problems with some applications for the following reasons: + +- Applications reporting file-system statistics, for example, space used and free space, might incorrectly report these statistics while the hard-link migration store is present. The file may be reported twice because of the two paths that reference that file. + +- A hard link may lose its connection to the original file. Some applications save changes to a file by creating a temporary file and then renaming the original to a backup filename. The path that was not used to open the file in this application will continue to refer to the unmodified file. The unmodified file that is not in use is taking up additional disk space. You should create the hard-link migration store just before you perform the migration, and not use applications once the store is created, in order to make sure you are migrating the latest versions of all files. + +- Editing the file by using different paths simultaneously may result in data corruption. + +**Important**   +The read-only file attribute on migrated files is lost when the hard-link migration store is deleted. This is due to a limitation in NTFS file system hard links. + + + +## Hard-Link Migration Scenario + + +For example, a company has decided to deploy Windows 10 on all of their computers. Each employee will keep the same computer, but the operating system on each computer will be updated. + +1. An administrator runs the ScanState command-line tool on each computer, specifying the **/hardlink** command-line option. The ScanState tool saves the user state to a hard-link migration store on each computer, improving performance by reducing file duplication, except in certain specific instances. + + **Note**   + As a best practice, we recommend that you do not create your hard-link migration store until just before you perform the migration in order to migrate the latest versions of your files. You should not use your software applications on the computer after creating the migration store until you have finished migrating your files with Loadstate. + + + +2. On each computer, an administrator installs the company's standard operating environment (SOE), which includes Windows 7 and other applications the company currently uses. + +3. An administrator runs the LoadState command-line tool on each computer. The LoadState tool restores user state back on each computer. + +## Hard-Link Migration Store Details + + +This section provides details about hard-link migration stores. + +### Hard Disk Space + +The **/hardlink** command-line option proceeds with creating the migration store only if there is 250 megabytes (MB) of free space on the hard disk. Provided that every volume involved in the migration is formatted as NTFS, 250 MB should be enough space to ensure success for almost every hard-link migration, regardless on the size of the migration. + +### Hard-Link Store Size Estimation + +It is not necessary to estimate the size of a hard-link migration store. Estimating the size of a migration store is only useful in scenarios where the migration store is very large, and on NTFS volumes the hard-link migration store will require much less incremental space than other store options. The only case where the local store can be quite large is when non-NTFS file systems exist on the system and contain data being migrated. Since NTFS has been the default file system format for Windows XP and newer operating systems, this situation is unusual. + +### Migration Store Path on Multiple Volumes + +Separate hard-link migration stores are created on each NTFS volume that contain data being migrated. In this scenario, the primary migration-store location will be specified on the command line, and should be the operating-system volume. Migration stores with identical names and directory names will be created on every volume containing data being migrated. For example: + +`Scanstate /hardlink c:\USMTMIG […]` + +Running this command on a system that contains the operating system on the C: drive and the user data on the D: drive will generate migration stores in the following locations, assuming that both drives are NTFS: + +C:\\USMTMIG\\ + +D:\\USMTMIG\\ + +The drive you specify on the command line for the hard-link migration store is important, because it defines where the *master migration store* should be placed. The *master migration store* is the location where data migrating from non-NTFS volumes is stored. This volume must have enough space to contain all of the data that comes from non-NTFS volumes. As in other scenarios, if a migration store already exists at the specified path, the **/o** option must be used to overwrite the existing data in the store. + +### Location Modifications + +Location modifications that redirect migrated content from one volume to a different volume have an adverse impact on the performance of a hard-link migration. This is because the migrating data that must cross system volumes cannot remain in the hard-link migration store, and must be copied across the system volumes. + +### Migrating Encrypting File System (EFS) Certificates and Files + +To migrate Encrypting File System (EFS) files to a new installation of an operating system on the same volume of the computer, specify the **/efs:hardlink** option in the Scanstate command-line syntax. + +If the EFS files are being restored to a different partition, you should use the **/efs:copyraw** option instead of the **/efs:hardlink** option. Hard links can only be created for files on the same volume. Moving the files to another partition during the migration requires a copy of the files to be created on the new partition. The **/efs:copyraw** option will copy the files to the new partition in encrypted format. + +For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md) and the Encrypted File Options in [ScanState Syntax](usmt-scanstate-syntax.md). + +### Migrating Locked Files with the Hard-Link Migration Store + +Files that are locked by an application or the operating system are handled differently when using a hard-link migration store. + +Files that are locked by the operating system cannot remain in place and must be copied into the hard-link migration store. As a result, selecting many operating-system files for migration significantly reduces performance during a hard-link migration. As a best practice, we recommend that you do not migrate any files out of the \\Windows directory, which minimizes performance-related issues. + +Files that are locked by an application are treated the same in hard-link migrations as in other scenarios when the volume shadow-copy service is not being utilized. The volume shadow-copy service cannot be used in conjunction with hard-link migrations. However, by modifying the new **<HardLinkStoreControl>** section in the Config.xml file, it is possible to enable the migration of files locked by an application. + +**Important**   +There are some scenarios in which modifying the **<HardLinkStoreControl>** section in the Config.xml file makes it more difficult to delete a hard-link migration store. In these scenarios, you must use USMTutils.exe to schedule the migration store for deletion on the next restart. + + + +## XML Elements in the Config.xml File + + +A new section in the Config.xml file allows optional configuration of some of the hard-link migration behavior introduced with the **/HardLink** option. + + ++++ + + + + + + + + + + + + + + + + + + + + + + +

                        <Policies>

                        This element contains elements that describe the policies that USMT follows while creating a migration store.

                        <HardLinkStoreControl>

                        This element contains elements that describe how to handle files during the creation of a hard link migration store.

                        <fileLocked>

                        This element contains elements that describe how to handle files that are locked for editing.

                        <createHardLink>

                        This element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application.

                        +

                        Syntax: <createHardLink> [pattern] </createHardLink>

                        <errorHardLink>

                        This element defines a standard MigXML pattern that describes file paths where hard links should not be created, if the file is locked for editing by another application.

                        +

                        <errorHardLink> [pattern] </errorHardLink>

                        + + + +**Important**   +You must use the **/nocompress** option with the **/HardLink** option. + + + +The following XML sample specifies that files locked by an application under the \\Users directory can remain in place during the migration. It also specifies that locked files that are not located in the \\Users directory should result in the **File in Use** error. It is important to exercise caution when specifying the paths using the **File in Use<createhardlink>** tag in order to minimize scenarios that make the hard-link migration store more difficult to delete. + +``` xml + + + + c:\Users\* [*] + C:\* [*] + + + +``` + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-include-files-and-settings.md b/windows/deployment/usmt/usmt-include-files-and-settings.md index 10f0cf2676..c594b6ea7d 100644 --- a/windows/deployment/usmt/usmt-include-files-and-settings.md +++ b/windows/deployment/usmt/usmt-include-files-and-settings.md @@ -1,226 +1,227 @@ ---- -title: Include Files and Settings (Windows 10) -description: Include Files and Settings -ms.assetid: 9009c6a5-0612-4478-8742-abe5eb6cbac8 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Include Files and Settings - - -When you specify the migration .xml files, User State Migration Tool (USMT) 10.0 migrates the settings and components specified in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) To include additional files and settings, we recommend that you create a custom .xml file and then include this file when using both the ScanState and LoadState commands. By creating a custom .xml file, you can keep your changes separate from the default .xml files, which makes it easier to track your modifications. - -In this topic: - -[Migrate a Single Registry Key](#bkmk-migsingleregkey) - -[Migrate a Specific Folder](#bkmk-migspecificfolder) - -[Migrate a Folder from a Specific Drive](#bkmk-migfoldspecdrive) - -[Migrate a Folder from Any Location](#bkmk-migfolderanyloc) - -[Migrate a File Type Into a Specific Folder](#bkmk-migfiletypetospecificfolder) - -[Migrate a Specific File](#bkmk-migspecificfile) - -## Migrate a Single Registry Key - - -The following .xml file migrates a single registry key. - -``` syntax - - - Component to migrate only registry value string - - - - - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache [Persistent] - - - - - - -``` - -## Migrate a Specific Folder - - -The following examples show how to migrate a folder from a specific drive, and from any location on the computer. - -### Migrate a Folder from a Specific Drive - -- **Including subfolders.** The following .xml file migrates all files and subfolders from C:\\EngineeringDrafts to the destination computer. - - ``` syntax - - - Component to migrate all Engineering Drafts Documents including subfolders - -    -       - - C:\EngineeringDrafts\* [*] - - -     -    - - - ``` - -- **Excluding subfolders.** The following .xml file migrates all files from C:\\EngineeringDrafts, but it does not migrate any subfolders within C:\\EngineeringDrafts. - - ``` syntax - - - Component to migrate all Engineering Drafts Documents without subfolders - -    -       - - C:\EngineeringDrafts\ [*] - - -     -    - - - ``` - -### Migrate a Folder from Any Location - -The following .xml file migrates all files and subfolders of the EngineeringDrafts folder from any drive on the computer. If multiple folders exist with the same name, then all files with this name are migrated. - -``` syntax - - - Component to migrate all Engineering Drafts Documents folder on any drive on the computer - - - - - - - - - - - - -``` - -The following .xml file migrates all files and subfolders of the EngineeringDrafts folder from any location on the C:\\ drive. If multiple folders exist with the same name, they are all migrated. - -``` syntax - - - Component to migrate all Engineering Drafts Documents EngineeringDrafts folder from where ever it exists on the C: drive - - - - - C:\*\EngineeringDrafts\* [*] - C:\EngineeringDrafts\* [*] - - - - - - -``` - -## Migrate a File Type Into a Specific Folder - - -The following .xml file migrates .mp3 files located in the specified drives on the source computer into the C:\\Music folder on the destination computer. - -``` syntax - - - All .mp3 files to My Documents - - - - - - - - - - - - - - - - - -``` - -## Migrate a Specific File - - -The following examples show how to migrate a file from a specific folder, and how to migrate a file from any location. - -- **To migrate a file from a folder.** The following .xml file migrates only the Sample.doc file from C:\\EngineeringDrafts on the source computer to the destination computer. - - ``` syntax - - - Component to migrate all Engineering Drafts Documents - -    -       - - C:\EngineeringDrafts\ [Sample.doc] - - -     -    - - - ``` - -- **To migrate a file from any location.** To migrate the Sample.doc file from any location on the C:\\ drive, use the <pattern> element, as the following example shows. If multiple files exist with the same name on the C:\\ drive, all of files with this name are migrated. - - ``` syntax - C:\* [Sample.doc] - ``` - - To migrate the Sample.doc file from any drive on the computer, use <script> as the following example shows. If multiple files exist with the same name, all files with this name are migrated. - - ``` syntax - - ``` - -## Related topics - - -[Customize USMT XML Files](usmt-customize-xml-files.md) - -[Custom XML Examples](usmt-custom-xml-examples.md) - -[Conflicts and Precedence](usmt-conflicts-and-precedence.md) - -[USMT XML Reference](usmt-xml-reference.md) - -  - -  - - - - - +--- +title: Include Files and Settings (Windows 10) +description: Include Files and Settings +ms.assetid: 9009c6a5-0612-4478-8742-abe5eb6cbac8 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Include Files and Settings + + +When you specify the migration .xml files, User State Migration Tool (USMT) 10.0 migrates the settings and components specified in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) To include additional files and settings, we recommend that you create a custom .xml file and then include this file when using both the ScanState and LoadState commands. By creating a custom .xml file, you can keep your changes separate from the default .xml files, which makes it easier to track your modifications. + +In this topic: + +[Migrate a Single Registry Key](#bkmk-migsingleregkey) + +[Migrate a Specific Folder](#bkmk-migspecificfolder) + +[Migrate a Folder from a Specific Drive](#bkmk-migfoldspecdrive) + +[Migrate a Folder from Any Location](#bkmk-migfolderanyloc) + +[Migrate a File Type Into a Specific Folder](#bkmk-migfiletypetospecificfolder) + +[Migrate a Specific File](#bkmk-migspecificfile) + +## Migrate a Single Registry Key + + +The following .xml file migrates a single registry key. + +``` xml + + + Component to migrate only registry value string + + + + + HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache [Persistent] + + + + + + +``` + +## Migrate a Specific Folder + + +The following examples show how to migrate a folder from a specific drive, and from any location on the computer. + +### Migrate a Folder from a Specific Drive + +- **Including subfolders.** The following .xml file migrates all files and subfolders from C:\\EngineeringDrafts to the destination computer. + + ``` xml + + + Component to migrate all Engineering Drafts Documents including subfolders + +    +       + + C:\EngineeringDrafts\* [*] + + +     +    + + + ``` + +- **Excluding subfolders.** The following .xml file migrates all files from C:\\EngineeringDrafts, but it does not migrate any subfolders within C:\\EngineeringDrafts. + + ``` xml + + + Component to migrate all Engineering Drafts Documents without subfolders + +    +       + + C:\EngineeringDrafts\ [*] + + +     +    + + + ``` + +### Migrate a Folder from Any Location + +The following .xml file migrates all files and subfolders of the EngineeringDrafts folder from any drive on the computer. If multiple folders exist with the same name, then all files with this name are migrated. + +``` xml + + + Component to migrate all Engineering Drafts Documents folder on any drive on the computer + + + + + + + + + + + + +``` + +The following .xml file migrates all files and subfolders of the EngineeringDrafts folder from any location on the C:\\ drive. If multiple folders exist with the same name, they are all migrated. + +``` xml + + + Component to migrate all Engineering Drafts Documents EngineeringDrafts folder from where ever it exists on the C: drive + + + + + C:\*\EngineeringDrafts\* [*] + C:\EngineeringDrafts\* [*] + + + + + + +``` + +## Migrate a File Type Into a Specific Folder + + +The following .xml file migrates .mp3 files located in the specified drives on the source computer into the C:\\Music folder on the destination computer. + +``` xml + + + All .mp3 files to My Documents + + + + + + + + + + + + + + + + + +``` + +## Migrate a Specific File + + +The following examples show how to migrate a file from a specific folder, and how to migrate a file from any location. + +- **To migrate a file from a folder.** The following .xml file migrates only the Sample.doc file from C:\\EngineeringDrafts on the source computer to the destination computer. + + ``` xml + + + Component to migrate all Engineering Drafts Documents + +    +       + + C:\EngineeringDrafts\ [Sample.doc] + + +     +    + + + ``` + +- **To migrate a file from any location.** To migrate the Sample.doc file from any location on the C:\\ drive, use the <pattern> element, as the following example shows. If multiple files exist with the same name on the C:\\ drive, all of files with this name are migrated. + + ``` xml + C:\* [Sample.doc] + ``` + + To migrate the Sample.doc file from any drive on the computer, use <script> as the following example shows. If multiple files exist with the same name, all files with this name are migrated. + + ``` xml + + ``` + +## Related topics + + +[Customize USMT XML Files](usmt-customize-xml-files.md) + +[Custom XML Examples](usmt-custom-xml-examples.md) + +[Conflicts and Precedence](usmt-conflicts-and-precedence.md) + +[USMT XML Reference](usmt-xml-reference.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-log-files.md b/windows/deployment/usmt/usmt-log-files.md index 6e7a2e5a39..d9917d3495 100644 --- a/windows/deployment/usmt/usmt-log-files.md +++ b/windows/deployment/usmt/usmt-log-files.md @@ -1,493 +1,494 @@ ---- -title: Log Files (Windows 10) -description: Log Files -ms.assetid: 28185ebd-630a-4bbd-94f4-8c48aad05649 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Log Files - - -You can use User State Migration Tool (USMT) 10.0 logs to monitor your migration and to troubleshoot errors and failed migrations. This topic describes the available command-line options to enable USMT logs, and new XML elements that configure which types of errors are fatal and should halt the migration, which types are non-fatal and should be skipped so that the migration can continue. - -[Log Command-Line Options](#bkmk-commandlineoptions) - -[ScanState and LoadState Logs](#bkmk-scanloadstatelogs) - -[Progress Log](#bkmk-progresslog) - -[List Files Log](#bkmk-listfileslog) - -[Diagnostic Log](#bkmk-diagnosticlog) - -## Log Command-Line Options - - -The following table describes each command-line option related to logs, and it provides the log name and a description of what type of information each log contains. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        Command line OptionFile NameDescription

                        /l[Path]FileName

                        Scanstate.log or LoadState.log

                        Specifies the path and file name of the ScanState.log or LoadState log.

                        /progress[Path]FileName

                        Specifies the path and file name of the Progress log.

                        Provides information about the status of the migration, by percentage complete.

                        /v[VerbosityLevel]

                        Not applicable

                        See the "Monitoring Options" section in ScanState Syntax.

                        /listfiles[Path]FileName

                        Specifies the path and file name of the Listfiles log.

                        Provides a list of the files that were migrated.

                        Set the environment variable MIG_ENABLE_DIAG to a path to an XML file.

                        USMTDiag.xml

                        The diagnostic log contains detailed system environment information, user environment information, and information about the migration units (migunits) being gathered and their contents.

                        - - - -**Note**   -You cannot store any of the log files in *StorePath*. If you do, the log will be overwritten when USMT is run. - - - -## ScanState and LoadState Logs - - -ScanState and LoadState logs are text files that are create when you run the ScanState and LoadState tools. You can use these logs to help monitor your migration. The content of the log depends on the command-line options that you use and the verbosity level that you specify. For more information about verbosity levels, see Monitoring Options in [ScanState Syntax](usmt-scanstate-syntax.md). - -## Progress Log - - -You can create a progress log using the **/progress** option. External tools, such as Microsoft System Center Operations Manager 2007, can parse the progress log to update your monitoring systems. The first three fields in each line are fixed as follows: - -- **Date:** Date, in the format of *day* *shortNameOfTheMonth* *year*. For example: 08 Jun 2006. - -- **Local time:** Time, in the format of *hrs*:*minutes*:*seconds* (using a 24-hour clock). For example: 13:49:13. - -- **Migration time:** Duration of time that USMT was run, in the format of *hrs:minutes:seconds*. For example: 00:00:10. - -The remaining fields are key/value pairs as indicated in the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        KeyValue

                        program

                        ScanState.exe or LoadState.exe.

                        productVersion

                        The full product version number of USMT.

                        computerName

                        The name of the source or destination computer on which USMT was run.

                        commandLine

                        The full command used to run USMT.

                        PHASE

                        Reports that a new phase in the migration is starting. This can be one of the following:

                        -
                          -

                        • Initializing

                          • -

                        • Scanning

                          • -

                        • Collecting

                          • -

                        • Saving

                          • -

                        • Estimating

                          • -

                        • Applying

                          • -

                        detectedUser

                          -

                        • For the ScanState tool, these are the users USMT detected on the source computer that can be migrated.

                          • -

                        • For the LoadState tool, these are the users USMT detected in the store that can be migrated.

                          • -

                        includedInMigration

                        Defines whether the user profile/component is included for migration. Valid values are Yes or No.

                        forUser

                        Specifies either of the following:

                        -
                          -

                        • The user state being migrated.

                          • -

                        • This Computer, meaning files and settings that are not associated with a user.

                          • -

                        detectedComponent

                        Specifies a component detected by USMT.

                        -
                          -

                        • For ScanState, this is a component or application that is installed on the source computer.

                          • -

                        • For LoadState, this is a component or application that was detected in the store.

                          • -

                        totalSizeInMBToTransfer

                        Total size of the files and settings to migrate in megabytes (MB).

                        totalPercentageCompleted

                        Total percentage of the migration that has been completed by either ScanState or LoadState.

                        collectingUser

                        Specifies which user ScanState is collecting files and settings for.

                        totalMinutesRemaining

                        Time estimate, in minutes, for the migration to complete.

                        error

                        Type of non-fatal error that occurred. This can be one of the following:

                        -
                          -

                        • UnableToCopy: Unable to copy to store because the disk on which the store is located is full.

                          • -

                        • UnableToOpen: Unable to open the file for migration because the file is opened in non-shared mode by another application or service.

                          • -

                        • UnableToCopyCatalog: Unable to copy because the store is corrupted.

                          • -

                        • UnableToAccessDevice: Unable to access the device.

                          • -

                        • UnableToApply: Unable to apply the setting to the destination computer.

                          • -

                        objectName

                        The name of the file or setting that caused the non-fatal error.

                        action

                        Action taken by USMT for the non-fatal error. The values are:

                        -
                          -

                        • Ignore: Non-fatal error ignored and the migration continued because the /c option was specified on the command line.

                          • -

                        • Abort: Stopped the migration because the /c option was not specified.

                          • -

                        errorCode

                        The errorCode or return value.

                        numberOfIgnoredErrors

                        The total number of non-fatal errors that USMT ignored.

                        message

                        The message corresponding to the errorCode.

                        - - - -## List Files Log - - -The List files log (Listfiles.txt) provides a list of the files that were migrated. This list can be used to troubleshoot XML issues or can be retained as a record of the files that were gathered into the migration store. The List Files log is only available for ScanState.exe. - -## Diagnostic Log - - -You can obtain the diagnostic log by setting the environment variable MIG\_ENABLE\_DIAG to a path to an XML file. - -The diagnostic log contains: - -- Detailed system environment information - -- Detailed user environment information - -- Information about the migration units (migunits) being gathered and their contents - -## Using the Diagnostic Log - - -The diagnostic log is essentially a report of all the migration units (migunits) included in the migration. A migunit is a collection of data that is identified by the component it is associated with in the XML files. The migration store is made up of all the migunits in the migration. The diagnostic log can be used to verify which migunits were included in the migration and can be used for troubleshooting while authoring migration XML files. - -The following examples describe common scenarios in which you can use the diagnostic log. - -**Why is this file not migrating when I authored an "include" rule for it?** - -Let’s imagine that we have the following directory structure and that we want the “data” directory to be included in the migration along with the “New Text Document.txt” file in the “New Folder.” The directory of **C:\\data** contains: - -``` syntax -01/21/2009 10:08 PM . -01/21/2009 10:08 PM .. -01/21/2009 10:08 PM New Folder -01/21/2009 09:19 PM 13 test (1).txt -01/21/2009 09:19 PM 13 test.txt - 2 File(s) 26 bytes -``` - -The directory of **C:\\data\\New Folder** contains: - -``` syntax -01/21/2009 10:08 PM . -01/21/2009 10:08 PM .. -01/21/2009 10:08 PM 0 New Text Document.txt - 1 File(s) 0 bytes -``` - -To migrate these files you author the following migration XML: - -```xml - - - - - DATA1 - - - - - c:\data\ [*] - - - - - - - -``` - -However, upon testing the migration you notice that the “New Text Document.txt” file isn’t included in the migration. To troubleshoot this failure, the migration can be repeated with the environment variable MIG\_ENABLE\_DIAG set such that the diagnostic log is generated. Upon searching the diagnostic log for the component “DATA1”, the following XML section is discovered: - -``` syntax - - - - - - - - - - - - - - -``` - -Analysis of this XML section reveals the migunit that was created when the migration rule was processed. The <Perform> section details the actual files that were scheduled for gathering and the result of the gathering operation. The “New Text Document.txt” file doesn’t appear in this section, which confirms that the migration rule was not correctly authored. - -An analysis of the XML elements reference topic reveals that the <pattern> tag needs to be modified as follows: - -``` syntax -c:\data\* [*] -``` - -When the migration is preformed again with the modified tag, the diagnostic log reveals the following: - -``` syntax - - - - - - - - - - - - - - - - -``` - -This diagnostic log confirms that the modified <pattern> value enables the migration of the file. - -**Why is this file migrating when I authored an exclude rule excluding it?** - -In this scenario, you have the following directory structure and you want all files in the “data” directory to migrate, except for text files. The **C:\\Data** folder contains: - -``` syntax -Directory of C:\Data - -01/21/2009 10:08 PM . -01/21/2009 10:08 PM .. -01/21/2009 10:08 PM New Folder -01/21/2009 09:19 PM 13 test (1).txt -01/21/2009 09:19 PM 13 test.txt - 2 File(s) 26 bytes -``` - -The **C:\\Data\\New Folder\\** contains: - -``` syntax -01/21/2009 10:08 PM . -01/21/2009 10:08 PM .. -01/21/2009 10:08 PM 0 New Text Document.txt - 1 File(s) 0 bytes -``` - -You author the following migration XML: - -```xml - - - - - DATA1 - - - - - c:\data\* [*] - - - - - - - c:\* [*.txt] - - - - - - -``` - -However, upon testing the migration you notice that all the text files are still included in the migration. In order to troubleshoot this issue, the migration can be performed with the environment variable MIG\_ENABLE\_DIAG set so that the diagnostic log is generated. Upon searching the diagnostic log for the component “DATA1”, the following XML section is discovered: - -``` syntax - - - - - - - - - - - - - - - - - - - - - -``` - -Upon reviewing the diagnostic log, you confirm that the files are still migrating, and that it is a problem with the authored migration XML rule. You author an update to the migration XML script as follows: - -```xml - - - - - DATA1 - - - - - c:\data\* [*] - - - - - - - c:\data\* [*.txt] - - - - - - - - - -``` - -Your revised migration XML script excludes the files from migrating, as confirmed in the diagnostic log: - -``` syntax - - - - - - - - - - - - - - - - - - -``` - -## Related topics - - -[XML Elements Library](usmt-xml-elements-library.md) - -[ScanState Syntax](usmt-scanstate-syntax.md) - -[LoadState Syntax](usmt-loadstate-syntax.md) - - - - - - - - - +--- +title: Log Files (Windows 10) +description: Log Files +ms.assetid: 28185ebd-630a-4bbd-94f4-8c48aad05649 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Log Files + + +You can use User State Migration Tool (USMT) 10.0 logs to monitor your migration and to troubleshoot errors and failed migrations. This topic describes the available command-line options to enable USMT logs, and new XML elements that configure which types of errors are fatal and should halt the migration, which types are non-fatal and should be skipped so that the migration can continue. + +[Log Command-Line Options](#bkmk-commandlineoptions) + +[ScanState and LoadState Logs](#bkmk-scanloadstatelogs) + +[Progress Log](#bkmk-progresslog) + +[List Files Log](#bkmk-listfileslog) + +[Diagnostic Log](#bkmk-diagnosticlog) + +## Log Command-Line Options + + +The following table describes each command-line option related to logs, and it provides the log name and a description of what type of information each log contains. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        Command line OptionFile NameDescription

                        /l[Path]FileName

                        Scanstate.log or LoadState.log

                        Specifies the path and file name of the ScanState.log or LoadState log.

                        /progress[Path]FileName

                        Specifies the path and file name of the Progress log.

                        Provides information about the status of the migration, by percentage complete.

                        /v[VerbosityLevel]

                        Not applicable

                        See the "Monitoring Options" section in ScanState Syntax.

                        /listfiles[Path]FileName

                        Specifies the path and file name of the Listfiles log.

                        Provides a list of the files that were migrated.

                        Set the environment variable MIG_ENABLE_DIAG to a path to an XML file.

                        USMTDiag.xml

                        The diagnostic log contains detailed system environment information, user environment information, and information about the migration units (migunits) being gathered and their contents.

                        + + + +**Note**   +You cannot store any of the log files in *StorePath*. If you do, the log will be overwritten when USMT is run. + + + +## ScanState and LoadState Logs + + +ScanState and LoadState logs are text files that are create when you run the ScanState and LoadState tools. You can use these logs to help monitor your migration. The content of the log depends on the command-line options that you use and the verbosity level that you specify. For more information about verbosity levels, see Monitoring Options in [ScanState Syntax](usmt-scanstate-syntax.md). + +## Progress Log + + +You can create a progress log using the **/progress** option. External tools, such as Microsoft System Center Operations Manager 2007, can parse the progress log to update your monitoring systems. The first three fields in each line are fixed as follows: + +- **Date:** Date, in the format of *day* *shortNameOfTheMonth* *year*. For example: 08 Jun 2006. + +- **Local time:** Time, in the format of *hrs*:*minutes*:*seconds* (using a 24-hour clock). For example: 13:49:13. + +- **Migration time:** Duration of time that USMT was run, in the format of *hrs:minutes:seconds*. For example: 00:00:10. + +The remaining fields are key/value pairs as indicated in the following table. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        KeyValue

                        program

                        ScanState.exe or LoadState.exe.

                        productVersion

                        The full product version number of USMT.

                        computerName

                        The name of the source or destination computer on which USMT was run.

                        commandLine

                        The full command used to run USMT.

                        PHASE

                        Reports that a new phase in the migration is starting. This can be one of the following:

                        +
                          +

                        • Initializing

                          • +

                        • Scanning

                          • +

                        • Collecting

                          • +

                        • Saving

                          • +

                        • Estimating

                          • +

                        • Applying

                          • +

                        detectedUser

                          +

                        • For the ScanState tool, these are the users USMT detected on the source computer that can be migrated.

                          • +

                        • For the LoadState tool, these are the users USMT detected in the store that can be migrated.

                          • +

                        includedInMigration

                        Defines whether the user profile/component is included for migration. Valid values are Yes or No.

                        forUser

                        Specifies either of the following:

                        +
                          +

                        • The user state being migrated.

                          • +

                        • This Computer, meaning files and settings that are not associated with a user.

                          • +

                        detectedComponent

                        Specifies a component detected by USMT.

                        +
                          +

                        • For ScanState, this is a component or application that is installed on the source computer.

                          • +

                        • For LoadState, this is a component or application that was detected in the store.

                          • +

                        totalSizeInMBToTransfer

                        Total size of the files and settings to migrate in megabytes (MB).

                        totalPercentageCompleted

                        Total percentage of the migration that has been completed by either ScanState or LoadState.

                        collectingUser

                        Specifies which user ScanState is collecting files and settings for.

                        totalMinutesRemaining

                        Time estimate, in minutes, for the migration to complete.

                        error

                        Type of non-fatal error that occurred. This can be one of the following:

                        +
                          +

                        • UnableToCopy: Unable to copy to store because the disk on which the store is located is full.

                          • +

                        • UnableToOpen: Unable to open the file for migration because the file is opened in non-shared mode by another application or service.

                          • +

                        • UnableToCopyCatalog: Unable to copy because the store is corrupted.

                          • +

                        • UnableToAccessDevice: Unable to access the device.

                          • +

                        • UnableToApply: Unable to apply the setting to the destination computer.

                          • +

                        objectName

                        The name of the file or setting that caused the non-fatal error.

                        action

                        Action taken by USMT for the non-fatal error. The values are:

                        +
                          +

                        • Ignore: Non-fatal error ignored and the migration continued because the /c option was specified on the command line.

                          • +

                        • Abort: Stopped the migration because the /c option was not specified.

                          • +

                        errorCode

                        The errorCode or return value.

                        numberOfIgnoredErrors

                        The total number of non-fatal errors that USMT ignored.

                        message

                        The message corresponding to the errorCode.

                        + + + +## List Files Log + + +The List files log (Listfiles.txt) provides a list of the files that were migrated. This list can be used to troubleshoot XML issues or can be retained as a record of the files that were gathered into the migration store. The List Files log is only available for ScanState.exe. + +## Diagnostic Log + + +You can obtain the diagnostic log by setting the environment variable MIG\_ENABLE\_DIAG to a path to an XML file. + +The diagnostic log contains: + +- Detailed system environment information + +- Detailed user environment information + +- Information about the migration units (migunits) being gathered and their contents + +## Using the Diagnostic Log + + +The diagnostic log is essentially a report of all the migration units (migunits) included in the migration. A migunit is a collection of data that is identified by the component it is associated with in the XML files. The migration store is made up of all the migunits in the migration. The diagnostic log can be used to verify which migunits were included in the migration and can be used for troubleshooting while authoring migration XML files. + +The following examples describe common scenarios in which you can use the diagnostic log. + +**Why is this file not migrating when I authored an "include" rule for it?** + +Let’s imagine that we have the following directory structure and that we want the “data” directory to be included in the migration along with the “New Text Document.txt” file in the “New Folder.” The directory of **C:\\data** contains: + +``` +01/21/2009 10:08 PM . +01/21/2009 10:08 PM .. +01/21/2009 10:08 PM New Folder +01/21/2009 09:19 PM 13 test (1).txt +01/21/2009 09:19 PM 13 test.txt + 2 File(s) 26 bytes +``` + +The directory of **C:\\data\\New Folder** contains: + +``` +01/21/2009 10:08 PM . +01/21/2009 10:08 PM .. +01/21/2009 10:08 PM 0 New Text Document.txt + 1 File(s) 0 bytes +``` + +To migrate these files you author the following migration XML: + +```xml + + + + + DATA1 + + + + + c:\data\ [*] + + + + + + + +``` + +However, upon testing the migration you notice that the “New Text Document.txt” file isn’t included in the migration. To troubleshoot this failure, the migration can be repeated with the environment variable MIG\_ENABLE\_DIAG set such that the diagnostic log is generated. Upon searching the diagnostic log for the component “DATA1”, the following XML section is discovered: + +``` xml + + + + + + + + + + + + + + +``` + +Analysis of this XML section reveals the migunit that was created when the migration rule was processed. The <Perform> section details the actual files that were scheduled for gathering and the result of the gathering operation. The “New Text Document.txt” file doesn’t appear in this section, which confirms that the migration rule was not correctly authored. + +An analysis of the XML elements reference topic reveals that the <pattern> tag needs to be modified as follows: + +``` xml +c:\data\* [*] +``` + +When the migration is preformed again with the modified tag, the diagnostic log reveals the following: + +``` xml + + + + + + + + + + + + + + + + +``` + +This diagnostic log confirms that the modified <pattern> value enables the migration of the file. + +**Why is this file migrating when I authored an exclude rule excluding it?** + +In this scenario, you have the following directory structure and you want all files in the “data” directory to migrate, except for text files. The **C:\\Data** folder contains: + +``` +Directory of C:\Data + +01/21/2009 10:08 PM . +01/21/2009 10:08 PM .. +01/21/2009 10:08 PM New Folder +01/21/2009 09:19 PM 13 test (1).txt +01/21/2009 09:19 PM 13 test.txt + 2 File(s) 26 bytes +``` + +The **C:\\Data\\New Folder\\** contains: + +``` +01/21/2009 10:08 PM . +01/21/2009 10:08 PM .. +01/21/2009 10:08 PM 0 New Text Document.txt + 1 File(s) 0 bytes +``` + +You author the following migration XML: + +```xml + + + + + DATA1 + + + + + c:\data\* [*] + + + + + + + c:\* [*.txt] + + + + + + +``` + +However, upon testing the migration you notice that all the text files are still included in the migration. In order to troubleshoot this issue, the migration can be performed with the environment variable MIG\_ENABLE\_DIAG set so that the diagnostic log is generated. Upon searching the diagnostic log for the component “DATA1”, the following XML section is discovered: + +``` xml + + + + + + + + + + + + + + + + + + + + + +``` + +Upon reviewing the diagnostic log, you confirm that the files are still migrating, and that it is a problem with the authored migration XML rule. You author an update to the migration XML script as follows: + +```xml + + + + + DATA1 + + + + + c:\data\* [*] + + + + + + + c:\data\* [*.txt] + + + + + + + + + +``` + +Your revised migration XML script excludes the files from migrating, as confirmed in the diagnostic log: + +``` xml + + + + + + + + + + + + + + + + + + +``` + +## Related topics + + +[XML Elements Library](usmt-xml-elements-library.md) + +[ScanState Syntax](usmt-scanstate-syntax.md) + +[LoadState Syntax](usmt-loadstate-syntax.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-reroute-files-and-settings.md b/windows/deployment/usmt/usmt-reroute-files-and-settings.md index 59ce16d8ed..22f64e513e 100644 --- a/windows/deployment/usmt/usmt-reroute-files-and-settings.md +++ b/windows/deployment/usmt/usmt-reroute-files-and-settings.md @@ -1,129 +1,130 @@ ---- -title: Reroute Files and Settings (Windows 10) -description: Reroute Files and Settings -ms.assetid: 905e6a24-922c-4549-9732-60fa11862a6c -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Reroute Files and Settings - - -To reroute files and settings, create a custom .xml file and specify this file name on both the ScanState and LoadState commandlines. This enables you to keep your changes separate from the default .xml files, so that it is easier to track your modifications. - -In this topic: - -- [Reroute a Folder](#bkmk-reroutefolder) - -- [Reroute a Specific File Type](#bkmk-reroutespecfiletype) - -- [Reroute a Specific File](#bkmk-reroutespecificfile) - -## Reroute a Folder - - -The following custom .xml file migrates the directories and files from C:\\EngineeringDrafts into the My Documents folder of every user. %CSIDL\_PERSONAL% is the virtual folder representing the My Documents desktop item, which is equivalent to CSIDL\_MYDOCUMENTS. - -``` syntax - - - Engineering Drafts Documents to Personal Folder - -   - - - - C:\EngineeringDrafts\* [*] - -     - - - - C:\EngineeringDrafts\* [*] - -     -   - - - -``` - -## Reroute a Specific File Type - - -The following custom .xml file reroutes .mp3 files located in the fixed drives on the source computer into the C:\\Music folder on the destination computer. - -``` syntax - - - All .mp3 files to My Documents - - - - - - - - - - - - - - - - - -``` - -## Reroute a Specific File - - -The following custom .xml file migrates the Sample.doc file from C:\\EngineeringDrafts into the My Documents folder of every user. %CSIDL\_PERSONAL% is the virtual folder representing the My Documents desktop item, which is equivalent to CSIDL\_MYDOCUMENTS. - -``` syntax - - -Sample.doc into My Documents - - - - - C:\EngineeringDrafts\ [Sample.doc] - - - - - C:\EngineeringDrafts\ [Sample.doc] - - - - - - -``` - -## Related topics - - -[Customize USMT XML Files](usmt-customize-xml-files.md) - -[Conflicts and Precedence](usmt-conflicts-and-precedence.md) - -[USMT XML Reference](usmt-xml-reference.md) - -  - -  - - - - - +--- +title: Reroute Files and Settings (Windows 10) +description: Reroute Files and Settings +ms.assetid: 905e6a24-922c-4549-9732-60fa11862a6c +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Reroute Files and Settings + + +To reroute files and settings, create a custom .xml file and specify this file name on both the ScanState and LoadState commandlines. This enables you to keep your changes separate from the default .xml files, so that it is easier to track your modifications. + +In this topic: + +- [Reroute a Folder](#bkmk-reroutefolder) + +- [Reroute a Specific File Type](#bkmk-reroutespecfiletype) + +- [Reroute a Specific File](#bkmk-reroutespecificfile) + +## Reroute a Folder + + +The following custom .xml file migrates the directories and files from C:\\EngineeringDrafts into the My Documents folder of every user. %CSIDL\_PERSONAL% is the virtual folder representing the My Documents desktop item, which is equivalent to CSIDL\_MYDOCUMENTS. + +``` xml + + + Engineering Drafts Documents to Personal Folder + +   + + + + C:\EngineeringDrafts\* [*] + +     + + + + C:\EngineeringDrafts\* [*] + +     +   + + + +``` + +## Reroute a Specific File Type + + +The following custom .xml file reroutes .mp3 files located in the fixed drives on the source computer into the C:\\Music folder on the destination computer. + +``` xml + + + All .mp3 files to My Documents + + + + + + + + + + + + + + + + + +``` + +## Reroute a Specific File + + +The following custom .xml file migrates the Sample.doc file from C:\\EngineeringDrafts into the My Documents folder of every user. %CSIDL\_PERSONAL% is the virtual folder representing the My Documents desktop item, which is equivalent to CSIDL\_MYDOCUMENTS. + +``` xml + + +Sample.doc into My Documents + + + + + C:\EngineeringDrafts\ [Sample.doc] + + + + + C:\EngineeringDrafts\ [Sample.doc] + + + + + + +``` + +## Related topics + + +[Customize USMT XML Files](usmt-customize-xml-files.md) + +[Conflicts and Precedence](usmt-conflicts-and-precedence.md) + +[USMT XML Reference](usmt-xml-reference.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-xml-elements-library.md b/windows/deployment/usmt/usmt-xml-elements-library.md index 54f36c31ff..bfbd4e2c61 100644 --- a/windows/deployment/usmt/usmt-xml-elements-library.md +++ b/windows/deployment/usmt/usmt-xml-elements-library.md @@ -1,4263 +1,4264 @@ ---- -title: XML Elements Library (Windows 10) -description: XML Elements Library -ms.assetid: f5af0f6d-c3bf-4a4c-a0ca-9db7985f954f -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# XML Elements Library - - -## Overview - - -This topic describes the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). It is assumed that you understand the basics of XML. . - -## In This Topic - - -In addition to XML elements and helper functions, this topic describes how to specify encoded locations and locations patterns, functions that are for internal USMT use only, and the version tags that you can use with helper functions. - -- [Elements and helper functions](#elements) - -- [Appendix](#appendix) - - - [Specifying locations](#locations) - - - [Internal USMT functions](#internalusmtfunctions) - - - [Valid version tags](#allowed) - -## Elements and Helper Functions - - -The following table describes the XML elements and helper functions you can use with USMT. - - ----- - - - - - - - - - - - - - - -
                        Elements A-KElements L-ZHelper functions

                        <addObjects>

                        -

                        <attributes>

                        -

                        <bytes>

                        -

                        <commandLine>

                        -

                        <component>

                        -

                        <condition>

                        -

                        <conditions>

                        -

                        <content>

                        -

                        <contentModify>

                        -

                        <description>

                        -

                        <destinationCleanup>

                        -

                        <detect>

                        -

                        <detects>

                        -

                        <detection>

                        -

                        <displayName>

                        -

                        <environment>

                        -

                        <exclude>

                        -

                        <excludeAttributes>

                        -

                        <extensions>

                        -

                        <extension>

                        -

                        <externalProcess>

                        -

                        <icon>

                        -

                        <include>

                        -

                        <includeAttribute>

                        <library>

                        -

                        <location>

                        -

                        <locationModify>

                        -

                        <_locDefinition>

                        -

                        <manufacturer>

                        -

                        <merge>

                        -

                        <migration>

                        -

                        <namedElements>

                        -

                        <object>

                        -

                        <objectSet>

                        -

                        <path>

                        -

                        <paths>

                        -

                        <pattern>

                        -

                        <processing>

                        -

                        <plugin>

                        -

                        <role>

                        -

                        <rules>

                        -

                        <script>

                        -

                        <text>

                        -

                        <unconditionalExclude>

                        -

                        <variable>

                        -

                        <version>

                        -

                        <windowsObjects>

                        <condition> functions

                        -

                        <content> functions

                        -

                        <contentModify> functions

                        -

                        <include> and <exclude> filter functions

                        -

                        <locationModify> functions

                        -

                        <merge> functions

                        -

                        <script> functions

                        -

                        Internal USMT functions

                        - - - -## <addObjects> - - -The <addObjects> element emulates the existence of one or more objects on the source computer. The child <object> elements provide the details of the emulated objects. If the content is a <script> element, the result of the invocation will be an array of objects. - -- **Number of occurrences:** unlimited - -- **Parent elements:**[<rules>](#rules) - -- **Required child elements:** [<object>](#object) In addition, you must specify [<location>](#location) and [<attribute>](#attribute) as child elements of this <object> element. - -- **Optional child elements:**[<conditions>](#conditions), <condition>, [<script>](#script) - -Syntax: - -<addObjects> - -</addObjects> - -The following example is from the MigApp.xml file: - -``` syntax - - - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] - DWORD - 0B000000 - - - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] - DWORD - 00000000 - - -``` - -## <attributes> - - -The <attributes> element defines the attributes for a registry key or file. - -- **Number of occurrences:** once for each <object> - -- **Parent elements:**[<object>](#object) - -- **Child elements:** none - -Syntax: - -<attributes>*Content*</attributes> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        Content

                        Yes

                        The content depends on the type of object specified.

                        -
                          -

                        • For files, the content can be a string containing any of the following attributes separated by commas:

                          -
                            -

                          • Archive

                            • -

                          • Read-only

                            • -

                          • System

                            • -

                          • Hidden

                            • -
                          • -

                        • For registry keys, the content can be one of the following types:

                          -
                            -

                          • None

                            • -

                          • String

                            • -

                          • ExpandString

                            • -

                          • Binary

                            • -

                          • Dword

                            • -

                          • REG_SZ

                            • -
                          • -
                        - - - -The following example is from the MigApp.xml file: - -``` syntax - - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] - DWORD - 00000000 - -``` - -## <bytes> - - -You must specify the <bytes> element only for files because, if <location> corresponds to a registry key or a directory, then <bytes> will be ignored. - -- **Number of occurrences:** zero or one - -- **Parent elements:**[<object>](#object) - -- **Child elements:** none - -Syntax: - -<bytes string="Yes|No" expand="Yes|No">*Content*</bytes> - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        string

                        No, default is No

                        Determines whether Content should be interpreted as a string or as bytes.

                        expand

                        No (default = Yes

                        When the expand parameter is Yes, the content of the <bytes> element is first expanded in the context of the source computer and then interpreted.

                        Content

                        Yes

                        Depends on the value of the string.

                        -
                          -

                        • When the string is Yes: the content of the <bytes> element is interpreted as a string.

                          • -

                        • When the string is No: the content of the <bytes> element is interpreted as bytes. Each two characters represent the hexadecimal value of a byte. For example, "616263" is the representation for the "abc" ANSI string. A complete representation of the UNICODE string "abc" including the string terminator would be: "6100620063000000".

                          • -
                        - - - -The following example is from the MigApp.xml file: - -``` syntax - - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] - DWORD - 00000000 - -``` - -## <commandLine> - - -You might want to use the <commandLine> element if you want to start or stop a service or application before or after you run the ScanState and LoadState tools. - -- **Number of occurrences:** unlimited - -- **Parent elements:**[<externalProcess>](#externalprocess) - -- **Child elements:** none**** - -Syntax: - -<commandLine>*CommandLineString*</commandLine> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        CommandLineString

                        Yes

                        A valid command line.

                        - - - -## <component> - - -The <component> element is required in a custom .xml file. This element defines the most basic construct of a migration .xml file. For example, in the MigApp.xml file, "Microsoft® Office 2003" is a component that contains another component, "Microsoft Office Access® 2003". You can use the child elements to define the component. - -A component can be nested inside another component; that is, the <component> element can be a child of the <role> element within the <component> element in two cases: 1) when the parent <component> element is a container or 2) if the child <component> element has the same role as the parent <component> element. - -- **Number of occurrences:** Unlimited - -- **Parent elements:**[<migration>](#migration), [<role>](#role) - -- **Required child elements:**[<role>](#role), [<displayName>](#displayname) - -- **Optional child elements:**[<manufacturer>](#manufacturer), [<version>](#version), [<description>](#description), [<paths>](#paths), [<icon>](#icon), [<environment>](#bkmk-environment), [<extensions>](#extensions) - -Syntax: - -<component type="System|Application|Device|Documents" context="User|System|UserAndSystem" defaultSupported="TRUE|FALSE|YES|NO" - -hidden="Yes|No"> - -</component> - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        type

                        Yes

                        You can use the following to group settings, and define the type of the component.

                        -
                          -

                        • System: Operating system settings. All Windows® components are defined by this type.

                          -

                          When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that is specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name. Otherwise, the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.

                          • -

                        • Application: Settings for an application.

                          • -

                        • Device: Settings for a device.

                          • -

                        • Documents: Specifies files.

                          • -

                        context

                        No

                        -

                        Default = UserAndSystem

                        Defines the scope of this parameter; that is, whether to process this component in the context of the specific user, across the entire operating system, or both.

                        -

                        The largest possible scope is set by the <component> element. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it has a context of User. If a <rules> element has a context of System, it would act as though the <rules> element is not there.

                        -
                          -

                        • User. Evaluates the component for each user.

                          • -

                        • System. Evaluates the component only once for the system.

                          • -

                        • UserAndSystem. Evaluates the component for the entire operating system and each user.

                          • -

                        defaultSupported

                        No

                        -

                        (default = TRUE)

                        Can be any of TRUE, FALSE, YES or NO. If this parameter is FALSE (or NO), the component will not be migrated unless there is an equivalent component on the destination computer.

                        -

                        When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that are specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name or the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.

                        hidden

                        This parameter is for internal USMT use only.

                        - - - -For an example, see any of the default migration .xml files. - -## <condition> - - -Although the <condition> element under the <detect>, <objectSet>, and <addObjects> elements is supported, we recommend that you do not use it. This element might be deprecated in future versions of USMT, requiring you to rewrite your scripts. We recommend that, if you need to use a condition within the <objectSet> and <addObjects> elements, you use the more powerful [<conditions>](#conditions) element, which allows you to formulate complex Boolean statements. - -The <condition> element has a Boolean result. You can use this element to specify the conditions in which the parent element will be evaluated. If any of the present conditions return FALSE, the parent element will not be evaluated. - -- **Number of occurrences:** unlimited. - -- **Parent elements:**[<conditions>](#conditions), <detect>, <objectSet>, <addObjects> - -- **Child elements:** none - -- **Helper functions:** You can use the following [<condition> functions](#conditionfunctions) with this element: DoesOSMatch, IsNative64Bit(), IsOSLaterThan, IsOSEarlierThan, DoesObjectExist, DoesFileVersionMatch, IsFileVersionAbove, IsFileVersionBelow, IsSystemContext, DoesStringContentEqual, DoesStringContentContain, IsSameObject, IsSameContent, and IsSameStringContent. - -Syntax: - -<condition negation="Yes|No">*ScriptName*</condition> - - ----- - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        negation

                        No

                        -

                        Default = No

                        "Yes" reverses the True/False value of the condition.

                        ScriptName

                        Yes

                        A script that has been defined within this migration section.

                        - - - -For example, - -In the code sample below, the <condition> elements, A and B, are joined together by the AND operator because they are in separate <conditions> sections. For example: - -``` syntax - - - A - - - B - - -``` - -However, in the code sample below, the <condition> elements, A and B, are joined together by the OR operator because they are in the same <conditions> section. - -``` syntax - - - A - B - - -``` - -### <condition> functions - -The <condition> functions return a Boolean value. You can use these elements in <addObjects> conditions. - -- [Operating system version functions](#operatingsystemfunctions) - -- [Object content functions](#objectcontentfunctions) - -### Operating system version functions - -- **DoesOSMatch** - - All matches are case insensitive. - - Syntax: DoesOSMatch("*OSType*","*OSVersion*") - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        OSType

                        Yes

                        The only valid value for this setting is NT. Note, however, that you must set this setting for the <condition> functions to work correctly.

                        OSVersion

                        Yes

                        The major version, minor version, build number and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version with a pattern. For example, 5.0.*.

                        - - - -~~~ -For example: - -<condition>MigXmlHelper.DoesOSMatch("NT","\*")</condition> -~~~ - -- **IsNative64Bit** - - The IsNative64Bit function returns TRUE if the migration process is running as a native 64-bit process; that is, a process running on a 64-bit system without Windows on Windows (WOW). Otherwise, it returns FALSE. - -- **IsOSLaterThan** - - All comparisons are case insensitive. - - Syntax: IsOSLaterThan("*OSType*","*OSVersion*") - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        OSType

                        Yes

                        Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is “9x”, the result will be FALSE.

                        OSVersion

                        Yes

                        The major version, minor version, build number, and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version but no pattern is allowed. For example, 5.0.

                        -

                        The IsOSLaterThan function returns TRUE if the current operating system is later than or equal to OSVersion.

                        - - - -~~~ -For example: - -<condition negation="Yes">MigXmlHelper.IsOSLaterThan("NT","6.0")</condition> -~~~ - -- **IsOSEarlierThan** - - All comparisons are case insensitive. - - Syntax: IsOSEarlierThan("*OSType*","*OSVersion*") - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        OSType

                        Yes

                        Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is “9x” the result will be FALSE.

                        OSVersion

                        Yes

                        The major version, minor version, build number, and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version but no pattern is allowed. For example, 5.0.

                        -

                        The IsOSEarlierThan function returns TRUE if the current operating system is earlier than OSVersion.

                        - - - -### Object content functions - -- **DoesObjectExist** - - The DoesObjectExist function returns TRUE if any object exists that matches the location pattern. Otherwise, it returns FALSE. The location pattern is expanded before attempting the enumeration. - - Syntax: DoesObjectExist("*ObjectType*","*EncodedLocationPattern*") - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        ObjectType

                        Yes

                        Defines the object type. Can be File or Registry.

                        EncodedLocationPattern

                        Yes

                        The location pattern. Environment variables are allowed.

                        - - - -~~~ -For an example of this element, see the MigApp.xml file. -~~~ - -- **DoesFileVersionMatch** - - The pattern check is case insensitive. - - Syntax: DoesFileVersionMatch("*EncodedFileLocation*","*VersionTag*","*VersionValue*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        EncodedFileLocation

                        Yes

                        The location pattern for the file that will be checked. Environment variables are allowed.

                        VersionTag

                        Yes

                        The version tag value that will be checked.

                        VersionValue

                        Yes

                        A string pattern. For example, "Microsoft*".

                        - - - -~~~ -For example: - -<condition>MigXmlHelper.DoesFileVersionMatch("%MSNMessengerInstPath%\\msnmsgr.exe","ProductVersion","6.\*")</condition> - -<condition>MigXmlHelper.DoesFileVersionMatch("%MSNMessengerInstPath%\\msnmsgr.exe","ProductVersion","7.\*")</condition> -~~~ - -- **IsFileVersionAbove** - - The IsFileVersionAbove function returns TRUE if the version of the file is higher than *VersionValue*. - - Syntax: IsFileVersionAbove("*EncodedFileLocation*","*VersionTag*","*VersionValue*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        EncodedFileLocation

                        Yes

                        The location pattern for the file that will be checked. Environment variables are allowed.

                        VersionTag

                        Yes

                        The version tag value that will be checked.

                        VersionValue

                        Yes

                        The value to compare to. You cannot specify a pattern.

                        - - - -- **IsFileVersionBelow** - - Syntax: IsFileVersionBelow("*EncodedFileLocation*","*VersionTag*","*VersionValue*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        EncodedFileLocation

                        Yes

                        The location pattern for the file that will be checked. Environment variables are allowed.

                        VersionTag

                        Yes

                        The version tag value that will be checked.

                        VersionValue

                        Yes

                        The value to compare to. You cannot specify a pattern.

                        - - - -- **IsSystemContext** - - The IsSystemContext function returns TRUE if the current context is "System". Otherwise, it returns FALSE. - - Syntax: IsSystemContext() - -- **DoesStringContentEqual** - - The DoesStringContentEqual function returns TRUE if the string representation of the given object is identical to `StringContent`. - - Syntax: DoesStringContentEqual("*ObjectType*","*EncodedLocation*","*StringContent*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        ObjectType

                        Yes

                        Defines the type of object. Can be File or Registry.

                        EncodedLocationPattern

                        Yes

                        The encoded location for the object that will be examined. You can specify environment variables.

                        StringContent

                        Yes

                        The string that will be checked against.

                        - - - -~~~ -For example: - -``` syntax -MigXmlHelper.DoesStringContentEqual("File","%USERNAME%","") -``` -~~~ - -- **DoesStringContentContain** - - The DoesStringContentContain function returns TRUE if there is at least one occurrence of *StrToFind* in the string representation of the object. - - Syntax: DoesStringContentContain("*ObjectType*","*EncodedLocation*","*StrToFind*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        ObjectType

                        Yes

                        Defines the type of object. Can be File or Registry.

                        EncodedLocationPattern

                        Yes

                        The encoded location for the object that will be examined. You can specify environment variables.

                        StrToFind

                        Yes

                        A string that will be searched inside the content of the given object.

                        - - - -- **IsSameObject** - - The IsSameObject function returns TRUE if the given encoded locations resolve to the same physical object. Otherwise, it returns FALSE. - - Syntax: IsSameObject("*ObjectType*","*EncodedLocation1*","*EncodedLocation2*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        ObjectType

                        Yes

                        Defines the type of object. Can be File or Registry.

                        EncodedLocation1

                        Yes

                        The encoded location for the first object. You can specify environment variables.

                        EncodedLocation2

                        Yes

                        The encoded location for the second object. You can specify environment variables.

                        - - - -~~~ -For example: - -``` syntax - - MigXmlHelper.IsSameObject("File","%CSIDL_FAVORITES%","%CSIDL_COMMON_FAVORITES%") - %CSIDL_FAVORITES%\* [*] - -``` -~~~ - -- **IsSameContent** - - The IsSameContent function returns TRUE if the given objects have the same content. Otherwise, it returns FALSE. The content will be compared byte by byte. - - Syntax: IsSameContent("*ObjectType1*","*EncodedLocation1*","*ObjectType2*","*EncodedLocation2*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        ObjectType1

                        Yes

                        Defines the type of the first object. Can be File or Registry.

                        EncodedLocation1

                        Yes

                        The encoded location for the first object. You can specify environment variables.

                        ObjectType2

                        Yes

                        Defines the type of the second object. Can be File or Registry.

                        EncodedLocation2

                        Yes

                        The encoded location for the second object. You can specify environment variables.

                        - - - -- **IsSameStringContent** - - The IsSameStringContent function returns TRUE if the given objects have the same content. Otherwise, it returns FALSE. The content will be interpreted as a string. - - Syntax: IsSameStringContent("*ObjectType1*","*EncodedLocation1*","*ObjectType2*","*EncodedLocation2*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        ObjectType1

                        Yes

                        Defines the type of the first object. Can be File or Registry.

                        EncodedLocation1

                        Yes

                        The encoded location for the first object. You can specify environment variables.

                        ObjectType2

                        Yes

                        Defines the type of the second object. Can be File or Registry.

                        EncodedLocation2

                        Yes

                        The encoded location for the second object. You can specify environment variables.

                        - - - -## <conditions> - - -The <conditions> element returns a Boolean result that is used to specify the conditions in which the parent element is evaluated. USMT evaluates the child elements, and then joins their results using the operators AND or OR according to the **operation** parameter. - -- **Number of occurrences:** Unlimited inside another <conditions> element. Limited to one occurrence in [<detection>](#detection), [<rules>](#rules), [<addObjects>](#addobjects), and [<objectSet>](#objectset) - -- **Parent elements:**[<conditions>](#conditions), [<detection>](#detection), [<environment>](#bkmk-environment), [<rules>](#rules), [<addObjects>](#addobjects), and [<objectSet>](#objectset) - -- **Child elements:**[<conditions>](#conditions), [<condition>](#condition) - -Syntax: - -<conditions operation="AND|OR"> - -</conditions> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        operation

                        No, default = AND

                        Defines the Boolean operation that is performed on the results that are obtained from the child elements.

                        - - - -The following example is from the MigApp.xml file: - -``` syntax - - - MigXmlHelper.IsNative64Bit() - - - HKLM\Software - - -``` - -## <content> - - -You can use the <content> element to specify a list of object patterns to obtain an object set from the source computer. Each <objectSet> within a <content> element is evaluated. For each resulting object pattern list, the objects that match it are enumerated and their content is filtered by the filter parameter. The resulting string array is the output for the <content> element. The filter script returns an array of locations. The parent <objectSet> element can contain multiple child <content> elements. - -- **Number of occurrences:** unlimited - -- **Parent elements:**[<objectSet>](#objectset) - -- **Child elements:**[<objectSet>](#objectset) - -- **Helper functions:** You can use the following [<content> functions](#contentfunctions) with this element: ExtractSingleFile, ExtractMultipleFiles, and ExtractDirectory. - -Syntax: - -<content filter="*ScriptInvocation*"> - -</content> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        filter

                        Yes

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        -

                        The script is called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        - - - -### <content> functions - -The following functions generate patterns out of the content of an object. These functions are called for every object that the parent <ObjectSet> element is enumerating. - -- **ExtractSingleFile** - - If the registry value is a MULTI-SZ, only the first segment is processed. The returned pattern is the encoded location for a file that must exist on the system. If the specification is correct in the registry value, but the file does not exist, this function returns NULL. - - Syntax: ExtractSingleFile(*Separators*,*PathHints*) - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        Separators

                        Yes

                        A list of possible separators that might follow the file specification in this registry value name. For example, if the content is "C:\Windows\Notepad.exe,-2", the separator is a comma. You can specify NULL.

                        PathHints

                        Yes

                        A list of extra paths, separated by colons (;), where the function will look for a file matching the current content. For example, if the content is "Notepad.exe" and the path is the %Path% environment variable, the function will find Notepad.exe in %windir% and returns "c:\Windows [Notepad.exe]". You can specify NULL.

                        - - - -~~~ -For example: - -``` syntax - -``` - -and - -``` syntax - -``` -~~~ - -- **ExtractMultipleFiles** - - The ExtractMultipleFiles function returns multiple patterns, one for each file that is found in the content of the given registry value. If the registry value is a MULTI-SZ, the MULTI-SZ separator is considered a separator by default. therefore, for MULTI-SZ, the <Separators> argument must be NULL. - - The returned patterns are the encoded locations for files that must exist on the source computer. If the specification is correct in the registry value but the file does not exist, it will not be included in the resulting list. - - Syntax: ExtractMultipleFiles(*Separators*,*PathHints*) - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        Separators

                        Yes

                        A list of possible separators that might follow the file specification in this registry value name. For example, if the content is "C:\Windows\Notepad.exe,-2", the separator is a comma. This parameter must be NULL when processing MULTI-SZ registry values.

                        PathHints

                        Yes

                        A list of extra paths, separated by colons (;), where the function will look for a file matching the current content. For example, if the content is "Notepad.exe" and the path is the %Path% environment variable, the function will find Notepad.exe in %windir% and returns "c:\Windows [Notepad.exe]". You can specify NULL.

                        - - - -- **ExtractDirectory** - - The ExtractDirectory function returns a pattern that is the encoded location for a directory that must exist on the source computer. If the specification is correct in the registry value, but the directory does not exist, this function returns NULL. If it is processing a registry value that is a MULTI-SZ, only the first segment will be processed. - - Syntax: ExtractDirectory(*Separators*,*LevelsToTrim*,*PatternSuffix*) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        Separators

                        No

                        A list of possible separators that might follow the file specification in this registry value name. For example, if the content is "C:\Windows\Notepad.exe,-2", the separator is a comma. You must specify NULL when processing MULTI-SZ registry values.

                        LevelsToTrim

                        Yes

                        The number of levels to delete from the end of the directory specification. Use this function to extract a root directory when you have a registry value that points inside that root directory in a known location.

                        PatternSuffix

                        Yes

                        The pattern to add to the directory specification. For example, * [*].

                        - - - -~~~ -For example: - -``` syntax - - - - %HklmWowSoftware%\Classes\Software\RealNetworks\Preferences\DT_Common [] - - - -``` -~~~ - -## <contentModify> - - -The <contentModify> element modifies the content of an object before it is written to the destination computer. For each <contentModify> element there can be multiple <objectSet> elements. This element returns the new content of the object that is being processed. - -- **Number of occurrences:** Unlimited - -- **Parent elements:**[<rules>](#rules) - -- **Required child elements:**[<objectSet>](#objectset) - -- **Helper functions**: You can use the following [<contentModify> functions](#contentmodifyfunctions) with this element: ConvertToDWORD, ConvertToString, ConvertToBinary, KeepExisting, OffsetValue, SetValueByTable, MergeMultiSzContent, and MergeDelimitedContent. - -Syntax: - -<contentModify script="*ScriptInvocation*"> - -</contentModify> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        script

                        Yes

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        -

                        The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        - - - -### <contentModify> functions - -The following functions change the content of objects as they are migrated. These functions are called for every object that the parent <ObjectSet> element is enumerating. - -- **ConvertToDWORD** - - The ConvertToDWORD function converts the content of registry values that are enumerated by the parent <ObjectSet> element to a DWORD. For example, ConvertToDWORD will convert the string "1" to the DWORD 0x00000001. If the conversion fails, then the value of DefaultValueOnError will be applied. - - Syntax: ConvertToDWORD(*DefaultValueOnError*) - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        DefaultValueOnError

                        No

                        The value that will be written into the value name if the conversion fails. You can specify NULL, and 0 will be written if the conversion fails.

                        - - - -- **ConvertToString** - - The ConvertToString function converts the content of registry values that match the parent <ObjectSet> element to a string. For example, it will convert the DWORD 0x00000001 to the string "1". If the conversion fails, then the value of DefaultValueOnError will be applied. - - Syntax: ConvertToString(*DefaultValueOnError*) - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        DefaultValueOnError

                        No

                        The value that will be written into the value name if the conversion fails. You can specify NULL, and 0 will be written if the conversion fails.

                        - - - -~~~ -For example: - -``` syntax - - - HKCU\Control Panel\Desktop [ScreenSaveUsePassword] - - -``` -~~~ - -- **ConvertToBinary** - - The ConvertToBinary function converts the content of registry values that match the parent <ObjectSet> element to a binary type. - - Syntax: ConvertToBinary () - -- **OffsetValue** - - The OffsetValue function adds or subtracts *Value* from the value of the migrated object, and then writes the result back into the registry value on the destination computer. For example, if the migrated object is a DWORD with a value of 14, and the *Value* is "-2", the registry value will be 12 on the destination computer. - - Syntax: OffsetValue(*Value*) - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        Value

                        Yes

                        The string representation of a numeric value. It can be positive or negative. For example, OffsetValue(2).

                        - - - -- **SetValueByTable** - - The SetValueByTable function matches the value from the source computer to the source table. If the value is there, the equivalent value in the destination table will be applied. If the value is not there, or if the destination table has no equivalent value, the *DefaultValueOnError* will be applied. - - Syntax: SetValueByTable(*SourceTable*,*DestinationTable*,*DefaultValueOnError*) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        SourceTable

                        Yes

                        A list of values separated by commas that are possible for the source registry values.

                        DestinationTable

                        No

                        A list of translated values separated by commas.

                        DefaultValueOnError

                        No

                        The value that will be applied to the destination computer if either 1) the value for the source computer does not match SourceTable, or 2) DestinationTable has no equivalent value.

                        -

                        If DefaultValueOnError is NULL, the value will not be changed on the destination computer.

                        - - - -- **KeepExisting** - - You can use the KeepExisting function when there are conflicts on the destination computer. This function will keep (not overwrite) the specified attributes for the object that is on the destination computer. - - Syntax: KeepExisting("*OptionString*","*OptionString*","*OptionString*",…) - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        OptionString

                        Yes

                        OptionString can be Security, TimeFields, or FileAttrib:Letter. You can specify one of each type of OptionStrings. Do not specify multiple OptionStrings with the same value. If you do, the right-most option of that type will be kept. For example, do not specify ("FileAttrib:H", "FileAttrib:R") because only Read-only will be evaluated. Instead specify ("FileAttrib:HR") and both Hidden and Read-only attributes will be kept on the destination computer.

                        -
                          -

                        • Security. Keeps the destination object's security descriptor if it exists.

                          • -

                        • TimeFields. Keeps the destination object's time stamps. This parameter is for files only.

                          • -

                        • FileAttrib:Letter. Keeps the destination object's attribute value, either On or OFF, for the specified set of file attributes. This parameter is for files only. The following are case-insensitive, but USMT will ignore any values that are invalid, repeated, or if there is a space after "FileAttrib:". You can specify any combination of the following attributes:

                          -
                            -

                          • A = Archive

                            • -

                          • C = Compressed

                            • -

                          • E = Encrypted

                            • -

                          • H = Hidden

                            • -

                          • I = Not Content Indexed

                            • -

                          • O = Offline

                            • -

                          • R = Read-Only

                            • -

                          • S = System

                            • -

                          • T = Temporary

                            • -
                          • -
                        - - - -- **MergeMultiSzContent** - - The MergeMultiSzContent function merges the MULTI-SZ content of the registry values that are enumerated by the parent <ObjectSet> element with the content of the equivalent registry values that already exist on the destination computer. `Instruction` and `String` either remove or add content to the resulting MULTI-SZ. Duplicate elements will be removed. - - Syntax: MergeMultiSzContent (*Instruction*,*String*,*Instruction*,*String*,…) - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        Instruction

                        Yes

                        Can be one of the following:

                        -
                          -

                        • Add. Adds the corresponding String to the resulting MULTI-SZ if it is not already there.

                          • -

                        • Remove. Removes the corresponding String from the resulting MULTI-SZ.

                          • -

                        String

                        Yes

                        The string to be added or removed.

                        - - - -- **MergeDelimitedContent** - - The MergeDelimitedContent function merges the content of the registry values that are enumerated by the parent <ObjectSet> element with the content of the equivalent registry values that already exist on the destination computer. The content is considered a list of elements separated by one of the characters in the Delimiters parameter. Duplicate elements will be removed. - - Syntax: MergeDelimitedContent(*Delimiters*,*Instruction*,*String*,…) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        Delimiters

                        Yes

                        A single character that will be used to separate the content of the object that is being processed. The content will be considered as a list of elements that is separated by the Delimiters.

                        -

                        For example, "." will separate the string based on a period.

                        Instruction

                        Yes

                        Can one of the following:

                        -
                          -

                        • Add. Adds String to the resulting MULTI-SZ if it is not already there.

                          • -

                        • Remove. Removes String from the resulting MULTI-SZ.

                          • -

                        String

                        Yes

                        The string to be added or removed.

                        - - - -## <description> - - -The <description> element defines a description for the component but does not affect the migration. - -- **Number of occurrences:** zero or one - -- **Parent elements:**[<component>](#component) - -- **Child elements:** none - -Syntax: - -<description>*ComponentDescription*</description> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        ComponentDescription

                        Yes

                        The description of the component.

                        - - - -The following code sample shows how the <description> element defines the "My custom component" description.: - -``` syntax -My custom component -``` - -## <destinationCleanup> - - -The <destinationCleanup> element deletes objects, such as files and registry keys, from the destination computer before applying the objects from the source computer. This element is evaluated only when the LoadState tool is run on the destination computer. That is, this element is ignored by the ScanState tool. - -**Important** -Use this option with extreme caution because it will delete objects from the destination computer. - - - -For each <destinationCleanup> element there can be multiple <objectSet> elements. A common use for this element is if there is a missing registry key on the source computer and you want to ensure that a component is migrated. In this case, you can delete all of the component's registry keys before migrating the source registry keys. This will ensure that if there is a missing key on the source computer, it will also be missing on the destination computer. - -- **Number of occurrences:** Unlimited - -- **Parent elements:**[<rules>](#rules) - -- **Child elements:**[<objectSet>](#objectset) (Note that the destination computer will delete all child elements.) - -Syntax: - -<destinationCleanup filter=*ScriptInvocation*> - -</destinationCleanup> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        filter

                        Yes

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        -

                        The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        - - - -For example: - -``` syntax - - - HKCU\Software\Lotus\123\99.0\DDE Preferences\* [*] - HKCU\Software\Lotus\123\99.0\Find Preferences\* [*] - - -``` - -## <detect> - - -Although the <detect> element is still supported, we do not recommend using it because it may be deprecated in future versions of USMT. In that case, you would have to rewrite your scripts. Instead, we recommend that you use the [<detection>](#detection)**element.** - -You use the <detect> element to determine if the component is present on a system. If all child <detect> elements within a <detect> element resolve to TRUE, then the <detect> element resolves to TRUE. If any child <detect> elements resolve to FALSE, then their parent <detect> element resolves to FALSE. If there is no <detect> element section, then USMT will assume that the component is present. - -For each <detect> element there can be multiple child <condition> or <objectSet> elements, which will be logically joined by an OR operator. If at least one <condition> or <objectSet> element evaluates to TRUE, then the <detect> element evaluates to TRUE. - -- **Number of occurrences:** unlimited - -- **Parent elements:** <detects>, [<namedElements>](#namedelements) - -- **Required child elements:**[<condition>](#condition) - -- **Optional child elements:**[<objectSet>](#objectset) - -Syntax: - -<detect name="*ID*" context="User|System|UserAndSystem"> - -</detect> - - ----- - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        name

                        Yes, when <detect> is a child to <namedElements>

                        -

                        No, when <detect> is a child to <detects>

                        When ID is specified, any child elements are not processed. Instead, any other <detect> elements with the same name that are declared within the <namedElements> element are processed.

                        context

                        No

                        -

                        (default = UserAndSystem)

                        Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.

                        -

                        The largest possible scope is set by the component element. For example, if a <component> element has a context of User, and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it had a context of User. If the <rules> element had a context of System, it would act as though the <rules> element were not there.

                        -
                          -

                        • User. Evaluates the variables for each user.

                          • -

                        • System. Evaluates the variables only once for the system.

                          • -

                        • UserAndSystem. Evaluates the variables for the entire operating system and each user.

                          • -
                        - - - -For examples, see the examples for [<detection>](#detection). - -## <detects> - - -Although the <detects> element is still supported, we recommend that you do not use it because it may be deprecated in future versions of USMT, which would require you to rewrite your scripts. Instead, we recommend that you use the [<detection>](#detection) element if the parent element is <role> or <namedElements>, and we recommend that you use the <conditions> element if the parent element is <rules>. Using <detection> allows you to more clearly formulate complex Boolean statements. - -The <detects> element is a container for one or more <detect> elements. If all of the child <detect> elements within a <detects> element resolve to TRUE, then <detects> resolves to TRUE. If any of the child <detect> elements resolve to FALSE, then <detects> resolves to FALSE. If you do not want to write the <detects> elements within a component, then you can create the <detects> element under the <namedElements> element, and then refer to it. If there is no <detects> element section, then USMT will assume that the component is present. The results from each <detects> element are joined together by the OR operator to form the rule used to detect the parent element. - -Syntax: - -<detects name="*ID*" context="User|System|UserAndSystem"> - -</detects> - -- **Number of occurrences:** Unlimited. - -- **Parent elements:**[<role>](#role), [<rules>](#rules), [<namedElements>](#namedelements) - -- **Required child elements:** <detect> - - ----- - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        name

                        Yes, when <detects> is a child to <namedElements>

                        -

                        No, when <detects> is a child to <role> or <rules>

                        When ID is specified, no child <detect> elements are processed. Instead, any other <detects> elements with the same name that are declared within the <namedElements> element are processed.

                        context

                        No

                        -

                        (default = UserAndSystem)

                        Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.

                        -

                        The largest possible scope is set by the <component element>. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it had a context of User. If the <rules> element had a context of System, it would act as though the <rules> element were not there.

                        -
                          -

                        • User. Evaluates the variables for each user.

                          • -

                        • System. Evaluates the variables only once for the system.

                          • -

                        • UserAndSystem. Evaluates the variables for the entire operating system and each user.

                          • -
                        -

                        The context parameter is ignored for <detects> elements that are inside <rules> elements.

                        - - - -The following example is from the MigApp.xml file. - -``` syntax - - - MigXmlHelper.DoesFileVersionMatch("%Lotus123InstPath%\123w.exe","ProductVersion","9.*") - - - MigXmlHelper.DoesFileVersionMatch("%SmartSuiteInstPath%\smartctr.exe","ProductVersion","99.*") - - -``` - -## <detection> - - -The <detection> element is a container for one <conditions> element. The result of the child <condition> elements, located underneath the <conditions> element, determines the result of this element. For example, if all of the child <conditions> elements within the <detection> element resolve to TRUE, then the <detection> element resolves to TRUE. If any of the child <conditions> elements resolve to FALSE, then the <detection> element resolves to FALSE. - -In addition, the results from each <detection> section within the <role> element are joined together by the OR operator to form the detection rule of the parent element. That is, if one of the <detection> sections resolves to TRUE, then the <role> element will be processed. Otherwise, the <role> element will not be processed. - -Use the <detection> element under the <namedElements> element if you do not want to write it within a component. Then include a matching <detection> section under the <role> element to control whether the component is migrated. If there is not a <detection> section for a component, then USMT will assume that the component is present. - -- **Number of occurrences:** Unlimited. - -- **Parent elements:**[<role>](#role), [<namedElements>](#namedelements) - -- **Child elements:**[<conditions>](#conditions) - -Syntax: - -<detection name="*ID*" context="User|System|UserAndSystem"> - -</detection> - - ----- - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        name

                          -

                        • Yes, when <detection> is declared under <namedElements>

                          • -

                        • Optional, when declared under <role>

                          • -

                        If declared, the content of the <detection> element is ignored and the content of the <detection> element with the same name that is declared in the <namedElements> element will be evaluated.

                        context

                        No, default = UserAndSystem

                        Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.

                        -
                          -

                        • User. Evaluates the component for each user.

                          • -

                        • System. Evaluates the component only once for the system.

                          • -

                        • UserAndSystem. Evaluates the component for the entire operating system and each user.

                          • -
                        - - - -For example: - -``` syntax - - - MigXmlHelper.DoesObjectExist("Registry","HKCU\Software\Adobe\Photoshop\8.0") - MigXmlHelper.DoesFileVersionMatch("%PhotoshopSuite8Path%\Photoshop.exe","FileVersion","8.*") - - -``` - -and - -``` syntax - - - - MigXmlHelper.DoesFileVersionMatch("%QuickTime5Exe%","ProductVersion","QuickTime 5.*") - MigXmlHelper.DoesFileVersionMatch("%QuickTime5Exe%","ProductVersion","QuickTime 6.*") - - -``` - -## <displayName> - - -The <displayName> element is a required field within each <component> element. - -- **Number of occurrences:** once for each component - -- **Parent elements:**[<component>](#component) - -- **Child elements:** none - -Syntax: - -<displayName \_locID="*ID*">*ComponentName*</displayName> - - ----- - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        locID

                        No

                        This parameter is for internal USMT use. Do not use this parameter.

                        ComponentName

                        Yes

                        The name for the component.

                        - - - -For example: - -``` syntax -Command Prompt settings -``` - -## <environment> - - -The <environment> element is a container for <variable> elements in which you can define variables to use in your .xml file. All environment variables defined this way will be private. That is, they will be available only for their child components and the component in which they were defined. For two example scenarios, see [Examples](#envex). - -- **Number of occurrences:** unlimited - -- **Parent elements:**[<role>](#role), [<component>](#component), [<namedElements>](#namedelements) - -- **Required child elements:**[<variable>](#variable) - -- **Optional child elements:**[conditions](#conditions) - -Syntax: - -<environment name="ID" context="User|System|UserAndSystem"> - -</environment> - - ----- - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        name

                        Yes, when <environment> is a child of <namedElements>

                        -

                        No, when <environment> is a child of <role> or <component>

                        When declared as a child of the <role> or <component> elements, if ID is declared, USMT ignores the content of the <environment> element and the content of the <environment> element with the same name declared in the <namedElements> element is processed.

                        context

                        No

                        -

                        (default = UserAndSystem)

                        Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.

                        -

                        The largest possible scope is set by the <component> element. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it had a context of User. If the <rules> element had a context of System, it would act as though <rules> were not there.

                        -
                          -

                        • User. Evaluates the variables for each user.

                          • -

                        • System. Evaluates the variables only once for the system.

                          • -

                        • UserAndSystem. Evaluates the variables for the entire operating system and each user.

                          • -
                        - - - -## - - -### Example scenario 1 - -In this scenario, you want to generate the location of objects at run time depending on the configuration of the destination computer. For example, you must do this if an application writes data in the directory where it is installed, and users can install the application anywhere on the computer. If the application writes a registry value hklm\\software\\companyname\\install \[path\] and then updates this value with the location where the application is installed, then the only way for you to migrate the required data correctly is to define an environment variable. For example: - -``` syntax - - - - - -``` - -Then you can use an include rule as follows. You can use any of the [<script> functions](#scriptfunctions) to perform similar tasks. - -``` syntax - - - %INSTALLPATH%\ [*.xyz] - - -``` - -Second, you can also filter registry values that contain data that you need. The following example extracts the first string (before the separator ",") in the value of the registry Hklm\\software\\companyname\\application\\ \[Path\]. - -``` syntax - - - - - - Hklm\software\companyname\application\ [Path] - - - - - -``` - -### Example scenario 2: - -In this scenario, you want to migrate five files named File1.txt, File2.txt, and so on, from %SYSTEMDRIVE%\\data\\userdata\\dir1\\dir2\\. To do this you must have the following <include> rule in an .xml file: - -``` syntax - - - %SYSTEMDRIVE%\data\userdata\dir1\dir2 [File1.txt] - %SYSTEMDRIVE%\data\userdata\dir1\dir2 [File2.txt] - %SYSTEMDRIVE%\data\userdata\dir1\dir2 [File3.txt] - %SYSTEMDRIVE%\data\userdata\dir1\dir2 [File4.txt] - %SYSTEMDRIVE%\data\userdata\dir1\dir2 [File5.txt] - - -``` - -Instead of typing the path five times, you can create a variable for the location as follows: - -``` syntax - - - %SYSTEMDRIVE%\data\userdata\dir1\dir2 - - -``` - -Then, you can specify the variable in an <include> rule as follows: - -``` syntax - - - %DATAPATH% [File1.txt] - %DATAPATH% [File2.txt] - %DATAPATH% [File3.txt] - %DATAPATH% [File4.txt] - %DATAPATH% [File5.txt] - - -``` - -## <exclude> - - -The <exclude> element determines what objects will not be migrated, unless there is a more specific <include> element that migrates an object. If there is an <include> and <exclude> element for the same object, the object will be included. For each <exclude> element there can be multiple child <objectSet> elements. - -- **Number of occurrences:** Unlimited - -- **Parent elements:**[<rules>](#rules) - -- **Child elements:**[<objectSet>](#objectset) - -- **Helper functions:** You can use the following [<exclude> filter functions](#persistfilterfunctions) with this element: CompareStringContent, IgnoreIrrelevantLinks, AnswerNo, NeverRestore, and SameRegContent. - -Syntax: - -<exclude filter="*ScriptInvocation*"> - -</exclude> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        filter

                        No

                        -

                        (default = No)

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        -

                        The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        - - - -For example, from the MigUser.xml file: - -``` syntax - - - %CSIDL_MYMUSIC%\* [*] - %CSIDL_MYPICTURES%\* [*] - %CSIDL_MYVIDEO%\* [*] - - -``` - -## <excludeAttributes> - - -You can use the <excludeAttributes> element to determine which parameters associated with an object will not be migrated. If there are conflicts between the <includeAttributes> and <excludeAttributes> elements, the most specific pattern determines the patterns that will not be migrated. If an object does not have an <includeAttributes> or <excludeAttributes> element, then all of its parameters will be migrated. - -- **Number of occurrences:** Unlimited - -- **Parent elements:**[<rules>](#rules) - -- **Child elements:**[<objectSet>](#objectset) - -Syntax: - -<excludeAttributes attributes="Security|TimeFields|Security,TimeFields"> - -</excludeAttributes> - - ----- - - - - - - - - - - - - - - -
                        ParameterRequired?Value

                        attributes

                        Yes

                        Specifies the attributes to be excluded. You can specify one of the following, or both separated by quotes; for example, "Security","TimeFields":

                        -
                          -

                        • Security can be one of Owner, Group, DACL, or SACL.

                          • -

                        • TimeFields can be one of CreationTime, LastAccessTime and LastWrittenTime

                          • -
                        - - - -Example: - -``` syntax - - - - System Data - - - - - - %SYSTEMDRIVE%\ [*.txt] - - - - - - %SYSTEMDRIVE%\ [a*.txt] - - - - - - %SYSTEMDRIVE%\ [aa.txt] - - - - - - logoff - - - - - - - DOC - PPT - VXD - PST - CPP - - - -``` - -## <extensions> - - -The <extensions> element is a container for one or more <extension> elements. - -- **Number of occurrences:** zero or one - -- **Parent elements:**[<component>](#component) - -- **Required child elements:**[<extension>](#extension) - -Syntax: - -<extensions> - -</extensions> - -## <extension> - - -You can use the <extension> element to specify documents of a specific extension. - -- **Number of occurrences:** unlimited - -- **Parent elements:**[<extensions>](#extensions) - -- **Child elements:** none - -Syntax: - -<extension>*FilenameExtension*</extension> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        FilenameExtension

                        Yes

                        A file name extension.

                        - - - -For example, if you want to migrate all \*.doc files from the source computer, specifying the following code under the <component> element: - -``` syntax - - doc - -``` - -is the same as specifying the following code below the <rules> element: - -``` syntax - - - - - -``` - -For another example of how to use the <extension> element, see the example for [<excludeAttributes>](#excludeattributes). - -## <externalProcess> - - -You can use the <externalProcess> element to run a command line during the migration process. For example, you may want to run a command after the LoadState process completes. - -- **Number of occurrences:** Unlimited - -- **Parent elements:**[<rules>](#rules) - -- **Required child elements:**[<commandLine>](#commandline) - -Syntax: - -<externalProcess when="pre-scan|scan-success|post-scan|pre-apply|apply-success|post-apply"> - -</externalProcess> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        when

                        Yes

                        Indicates when the command line should be run. This value can be one of the following:

                        -
                          -

                        • pre-scan before the scanning process begins.

                          • -

                        • scan-success after the scanning process has finished successfully.

                          • -

                        • post-scan after the scanning process has finished, whether it was successful or not.

                          • -

                        • pre-apply before the apply process begins.

                          • -

                        • apply-success after the apply process has finished successfully.

                          • -

                        • post-apply after the apply process has finished, whether it was successful or not.

                          • -
                        - - - -For an example of how to use the <externalProcess> element, see the example for [<excludeAttributes>](#excludeattributes). - -## <icon> - - -This is an internal USMT element. Do not use this element. - -## <include> - - -The <include> element determines what to migrate, unless there is a more specific [<exclude>](#exclude) rule. You can specify a script to be more specific to extend the definition of what you want to collect. For each <include> element there can be multiple <objectSet> elements. - -- **Number of occurrences:** Unlimited - -- **Parent elements:**[<rules>](#rules) - -- **Required child element:**[<objectSet>](#objectset) - -- **Helper functions:** You can use the following [<include> filter functions](#persistfilterfunctions) with this element: CompareStringContent, IgnoreIrrelevantLinks, AnswerNo, and NeverRestore. - -Syntax: - -<include filter="*ScriptInvocation*"> - -</include> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        filter

                        No.

                        -

                        If this parameter is not specified, then all patterns that are inside the child <ObjectSet> element will be processed.

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        -

                        The script will be called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        - - - -The following example is from the MigUser.xml file: - -``` syntax - - My Video - - %CSIDL_MYVIDEO% - - - - - MigXmlHelper.DoesObjectExist("File","%CSIDL_MYVIDEO%") - - - - - - %CSIDL_MYVIDEO%\* [*] - - - - - %CSIDL_MYVIDEO% [desktop.ini] - - - - - -``` - -### <include> and <exclude> filter functions - -The following functions return a Boolean value. You can use them to migrate certain objects based on when certain conditions are met. - -- **AnswerNo** - - This filter always returns FALSE. - - Syntax: AnswerNo () - -- **CompareStringContent** - - Syntax: CompareStringContent("*StringContent*","*CompareType*") - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        StringContent

                        Yes

                        The string to check against.

                        CompareType

                        Yes

                        A string. Use one of the following values:

                        -
                          -

                        • Equal (case insensitive). The function returns TRUE if the string representation of the current object that is processed by the migration engine is identical to StringContent.

                          • -

                        • NULL or any other value. The function returns TRUE if the string representation of the current object that is processed by the migration engine does not match StringContent.

                          • -
                        - - - -- **IgnoreIrrelevantLinks** - - This filter screens out the .lnk files that point to an object that is not valid on the destination computer. Note that the screening takes place on the destination computer, so all .lnk files will be saved to the store during ScanState. Then they will be screened out when you run the LoadState tool. - - Syntax: IgnoreIrrelevantLinks () - - For example: - - ``` syntax - - - %CSIDL_COMMON_VIDEO%\* [*] - - - ``` - -- **NeverRestore** - - You can use this function to collect the specified objects from the source computer but then not migrate the objects to the destination computer. When run with the ScanState tool, this function evaluates to TRUE. When run with the LoadState tool, this function evaluates to FALSE. You may want to use this function when you want to check an object's value on the destination computer but do not intend to migrate the object to the destination. - - Syntax: NeverRestore() - - In the following example, HKCU\\Control Panel\\International \[Locale\] will be included in the store, but it will not be migrated to the destination computer: - - ``` syntax - - - HKCU\Control Panel\International [Locale] - - - ``` - -## <includeAttributes> - - -You can use the <includeAttributes> element to determine whether certain parameters associated with an object will be migrated along with the object itself. If there are conflicts between the <includeAttributes> and <excludeAttributes> elements, the most specific pattern will determine which parameters will be migrated. If an object does not have an <includeAttributes> or <excludeAttributes> element, then all of its parameters will be migrated. - -- **Number of occurrences:** unlimited - -- **Parent elements:**[<rules>](#rules) - -- **Child elements:**[<objectSet>](#objectset) - -Syntax: - -<includeAttributes attributes="Security|TimeFields|Security,TimeFields"> - -</includeAttributes> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        attributes

                        Yes

                        Specifies the attributes to be included with a migrated object. You can specify one of the following, or both separated by quotes; for example, "Security","TimeFields":

                        -
                          -

                        • Security can be one of the following values:

                          -
                            -

                          • Owner. The owner of the object (SID).

                            • -

                          • Group. The primary group for the object (SID).

                            • -

                          • DACL (discretionary access control list). An access control list that is controlled by the owner of an object and that specifies the access particular users or groups can have to the object.

                            • -

                          • SACL (system access control list). An ACL that controls the generation of audit messages for attempts to access a securable object. The ability to get or set an object's SACL is controlled by a privilege typically held only by system administrators.

                            • -
                          • -

                        • TimeFields can be one of the following:

                          -
                            -

                          • CreationTime. Specifies when the file or directory was created.

                            • -

                          • LastAccessTime. Specifies when the file is last read from, written to, or, in the case of executable files, run.

                            • -

                          • LastWrittenTime. Specifies when the file is last written to, truncated, or overwritten.

                            • -
                          • -
                        - - - -For an example of how to use the <includeAttributes> element, see the example for [<excludeAttributes>](#excludeattributes). - -## <library> - - -This is an internal USMT element. Do not use this element. - -## <location> - - -The <location> element defines the location of the <object> element. - -- **Number of occurrences:** once for each <object> - -- **Parent elements:**[<object>](#object) - -- **Child elements:**[<script>](#script) - -Syntax: - -<location type="*typeID*">*ObjectLocation*</location> - - ----- - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        type

                        Yes

                        typeID can be Registry or File.

                        ObjectLocation

                        Yes

                        The location of the object.

                        - - - -The following example is from the MigApp.xml file: - -``` syntax - - - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] - DWORD - 0B000000 - - - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] - DWORD - 00000000 - - -``` - -## <locationModify> - - -You can use the <locationModify> element to change the location and name of an object before it is migrated to the destination computer. The <locationModify> element is processed only when the LoadState tool is run on the destination computer. In other words, this element is ignored by the ScanState tool. The <locationModify> element will create the appropriate folder on the destination computer if it does not already exist. - -**Number of occurrences:** Unlimited - -- **Parent elements:**[<rules>](#rules) - -- **Required child element:**[<objectSet>](#objectset) - -- **Helper functions:** You can use the following [<locationModify> functions](#locationmodifyfunctions) with this element: ExactMove, RelativeMove, and Move. - -Syntax: - -<locationModify script="*ScriptInvocation*"> - -</locationModify> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        script

                        Yes

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        -

                        The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        - - - -The following example is from the MigApp.xml file: - -``` syntax - - - %CSIDL_APPDATA%\Microsoft\Office\ [Access10.pip] - - -``` - -### <locationModify> functions - -The following functions change the location of objects as they are migrated when using the <locationModify> element. These functions are called for every object that the parent <ObjectSet> element is enumerating. The <locationModify> element will create the appropriate folder on the destination computer if it does not already exist. - -- **ExactMove** - - The ExactMove function moves all of the objects that are matched by the parent <ObjectSet> element into the given *ObjectEncodedLocation*. You can use this function when you want to move a single file to a different location on the destination computer. If the destination location is a node, all of the matching source objects will be written to the node without any subdirectories. If the destination location is a leaf, the migration engine will migrate all of the matching source objects to the same location. If a collision occurs, the normal collision algorithms will apply. - - Syntax: ExactMove(*ObjectEncodedLocation*) - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        ObjectEncodedLocation

                        Yes

                        The destination location for all of the source objects.

                        - - - -~~~ -For example: - -``` syntax - - - HKCU\Keyboard Layout\Toggle [] - - -``` -~~~ - -- **Move** - - The Move function moves objects to a different location on the destination computer. In addition, this function creates subdirectories that were above the longest CSIDL in the source object name. - - Syntax: Move(*DestinationRoot*) - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        DestinationRoot

                        Yes

                        The location where the source objects will be moved. If needed, this function will create any subdirectories that were above the longest CSIDL in the source object name.

                        - - - -- **RelativeMove** - - You can use the RelativeMove function to collect and move data. Note that you can use environment variables in source and destination roots, but they may be defined differently on the source and destination computers. - - Syntax: RelativeMove(*SourceRoot*,*DestinationRoot*) - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        SourceRoot

                        Yes

                        The location from where the objects will be moved. Any source objects that are enumerated by the parent <ObjectSet> element that are not in this location will not be moved.

                        DestinationRoot

                        Yes

                        The location where the source objects will be moved to on the destination computer. If needed, this function will create any subdirectories that were above SourceRoot.

                        - - - -~~~ -For example: - -``` syntax - - - %CSIDL_COMMON_FAVORITES%\* [*] - - - - - %CSIDL_COMMON_FAVORITES%\* [*] - - -``` -~~~ - -## <\_locDefinition> - - -This is an internal USMT element. Do not use this element. - -## <manufacturer> - - -The <manufacturer> element defines the manufacturer for the component, but does not affect the migration. - -- **Number of occurrences:** zero or one - -- **Parent elements:**[<component>](#component) - -- **Child elements:** none - -Syntax: - -<manufacturer>*Name*</manufacturer> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        Name

                        Yes

                        The name of the manufacturer for the component.

                        - - - -## <merge> - - -The <merge> element determines what will happen when a collision occurs. A collision is when an object that is migrated is already present on the destination computer. If you do not specify this element, the default behavior for the registry is for the source object to overwrite the destination object. The default behavior for files is for the source file to be renamed to "OriginalFileName(1).OriginalExtension". This element specifies only what should be done when a collision occurs. It does not include objects. Therefore, for your objects to migrate, you must specify <include> rules along with the <merge> element. When an object is processed and a collision is detected, USMT will select the most specific merge rule and apply it to resolve the conflict. For example, if you have a <merge> rule C:\\\* \[\*\] set to <sourcePriority> and a <merge> rule C:\\subfolder\\\* \[\*\] set to <destinationPriority>, then USMT would use the <destinationPriority> rule because it is the more specific. - -For an example of this element, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - -- **Number of occurrences:** Unlimited - -- **Parent elements:**[<rules>](#rules) - -- **Required child element:**[<objectSet>](#objectset) - -- **Helper functions:** You can use the following [<merge> functions](#mergefunctions) with this element: SourcePriority, DestinationPriority, FindFilePlaceByPattern, LeafPattern, NewestVersion, HigherValue(), and LowerValue(). - -Syntax: - -<merge script="*ScriptInvocation*"> - -</merge> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        script

                        Yes

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        -

                        The script will be called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        - - - -The following example is from the MigUser.xml file: - -``` syntax - - - - %CSIDL_MYVIDEO%\* [*] - - - - - %CSIDL_MYVIDEO% [desktop.ini] - - - -``` - -### <merge> functions - -These functions control how collisions are resolved. - -- **DestinationPriority** - - Specifies to keep the object that is on the destination computer and not migrate the object from the source computer. - - For example: - - ``` syntax - - - HKCU\Software\Microsoft\Office\9.0\PhotoDraw\ [MyPictures] - HKCU\Software\Microsoft\Office\9.0\PhotoDraw\Settings\ [PicturesPath] - HKCU\Software\Microsoft\Office\9.0\PhotoDraw\Settings\ [AdditionalPlugInPath] - - - ``` - -- **FindFilePlaceByPattern** - - The FindFilePlaceByPattern function saves files with an incrementing counter when a collision occurs. It is a string that contains one of each constructs: <F>, <E>, <N> in any order. - - Syntax: FindFilePlaceByPattern(*FilePattern*) - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        FilePattern

                        Yes

                          -

                        • <F> will be replaced by the original file name.

                          • -

                        • <N> will be replaced by an incrementing counter until there is no collision with the objects on the destination computer.

                          • -

                        • <E> will be replaced by the original file name extension.

                          • -
                        -

                        For example, <F> (<N>).<E> will change the source file MyDocument.doc into MyDocument (1).doc on the destination computer.

                        - - - -- **NewestVersion** - - The NewestVersion function will resolve conflicts on the destination computer based on the version of the file. - - Syntax: NewestVersion(*VersionTag*) - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        VersionTag

                        Yes

                        The version field that will be checked. This can be "FileVersion" or "ProductVersion". The file with the highest VersionTag version determines which conflicts will be resolved based on the file's version. For example, if Myfile.txt contains FileVersion 1 and the same file on the destination computer contains FileVersion 2, the file on destination will remain.

                        - - - -- **HigherValue()** - - You can use this function for merging registry values. The registry values will be evaluated as numeric values, and the one with the higher value will determine which registry values will be merged. - -- **LowerValue()** - - You can use this function for merging registry values. The registry values will be evaluated as numeric values and the one with the lower value will determine which registry values will be merged. - -- **SourcePriority** - - Specifies to migrate the object from the source computer, and to delete the object that is on the destination computer. - - For example: - - ``` syntax - - - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Publisher [UpgradeVersion] - %HklmWowSoftware%\Microsoft\Office\11.0\Common\Migration\Publisher [UpgradeVersion] - %HklmWowSoftware%\Microsoft\Office\10.0\Common\Migration\Publisher [UpgradeVersion] - - - ``` - -## <migration> - - -The <migration> element is the single root element of a migration .xml file and is required. Each .xml file must have a unique migration urlid. The urlid of each file that you specify on the command line must be unique. This is because USMT uses the urlid to define the components within the file. For example, you must specify the following at the beginning of each file: <CustomFileName> is the name of the file; for example, "CustomApp". - -- **Number of occurrences:** one - -- **Parent elements:** none - -- **Required child elements:**[<component>](#component) - -- **Optional child elements:**[<library>](#library), [<namedElements>](#namedelements) - -Syntax: - -<migration urlid="UrlID/Name"> - -</migration> - - ----- - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        urlid

                        Yes

                        UrlID is a string identifier that uniquely identifies this .xml file. This parameter must be a no-colon-name as defined by the XML Namespaces specification. Each migration .xml file must have a unique urlid. If two migration .xml files have the same urlid, the second .xml file that is specified on the command line will not be processed. For more information about XML Namespaces, see Use XML Namespaces.

                        Name

                        No

                        Although not required, it is good practice to use the name of the .xml file.

                        - - - -The following example is from the MigApp.xml file: - -``` syntax - - -``` - -## MigXMLHelper.FileProperties - - -This filter helper function can be used to filter the migration of files based on file size and date attributes. - - ---- - - - - - - - - - - - - - - - - - - - - -
                        Helper FunctionMigXMLHelper.FileProperties (property, operator, valueToCompare)

                        Property

                        filesize, dateCreated, dateModified, dateAccessed

                        Operator

                        range, neq, lte, lt, eq, gte, gt

                        valueToCompare

                        The value we are comparing. For example:

                        -

                        Date: “2008/05/15-2005/05/17”, “2008/05/15”

                        -

                        Size: A numeral with B, KB, MB, or GB at the end. “5GB”, “1KB-1MB”

                        - - - -``` syntax - -File_size - - - - - - %SYSTEMDRIVE%\DOCS\* [*] - - - - - -``` - -## <namedElements> - - -You can use the **<namedElements>** element to define named elements. You can use these elements in any component throughout your .xml file. For an example of how to use this element, see the MigApp.xml file. - -Syntax: - -<namedElements> - -</namedElements> - -- **Number of occurrences:** Unlimited - -- **Parent elements:**[<migration>](#migration) - -- **Child elements:**[<environment>](#bkmk-environment), [<rules>](#rules), [<conditions>](#conditions), [<detection>](#detection), <detects>, <detect> - -For an example of this element, see the MigApp.xml file. - -## <object> - - -The <object> element represents a file or registry key. - -- **Number of occurrences:** Unlimited - -- **Parent elements:**[<addObjects>](#addobjects) - -- **Required child elements:**[<location>](#location), [<attributes>](#attribute) - -- **Optional child elements:**[<bytes>](#bytes) - -Syntax: - -<object> - -</object> - -The following example is from the MigApp.xml file: - -``` syntax - - - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] - DWORD - 0B000000 - - - %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] - DWORD - 00000000 - - -``` - -## <objectSet> - - -The <objectSet> element contains a list of object patterns ; for example, file paths, registry locations, and so on. Any child <conditions> elements will be evaluated first. If all child <conditions> elements return FALSE, the <objectSet> element will evaluate to an empty set. For each parent element, there can be only multiple <objectSet> elements. - -- **Number of occurrences:** Unlimited - -- **Parent elements:**[<variable>](#variable), [<content>](#content), [<include>](#include), [<exclude>](#exclude), [<merge>](#merge), [<contentModify>](#contentmodify), [<locationModify>](#locationmodify), [<destinationCleanup>](#destinationcleanup), [<includeAttributes>](#includeattributes), [<excludeAttributes>](#excludeattributes), [<unconditionalExclude>](#unconditionalexclude), <detect> - -- **Required child elements:** either [<script>](#script) or [<pattern>](#pattern) - -- **Optional child elements:**[<content>](#content), [conditions](#conditions), <condition> - -Syntax: - -<objectSet> - -</objectSet> - -The following example is from the MigUser.xml file: - -``` syntax - - My Music - - %CSIDL_MYMUSIC% - - - - - MigXmlHelper.DoesObjectExist("File","%CSIDL_MYMUSIC%") - - - - - - %CSIDL_MYMUSIC%\* [*] - - - - - %CSIDL_MYMUSIC%\ [desktop.ini] - - - - - -``` - -## <path> - - -This is an internal USMT element. Do not use this element. - -## <paths> - - -This is an internal USMT element. Do not use this element. - -## <pattern> - - -You can use this element to specify multiple objects. You can specify multiple <pattern> elements for each <objectSet> element and they will be combined. If you are specifying files, you may want to use GenerateDrivePatterns with <script> instead. GenerateDrivePatterns is basically the same as a <pattern> rule, without the drive letter specification. For example, the following two lines of code are similar: - -``` syntax -C:\Folder\* [Sample.doc] - -``` - -- **Number of occurrences:** Unlimited - -- **Parent elements:**[<objectSet>](#objectset) - -- **Child elements:** none but *Path* \[*object*\] must be valid. - -Syntax: - -<pattern type="*typeID*">*Path* \[*object*\]</pattern> - - ----- - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        type

                        Yes

                        typeID can be Registry, File, or Ini. If typeId is Ini, then you cannot have a space between Path and object. For example, the following is correct when type="Ini":

                        -

                        <pattern type="Ini">%WinAmp5InstPath%\Winamp.ini|WinAmp[keeponscreen]</pattern>

                        Path [object]

                        Yes

                        A valid registry or file path pattern, followed by at least one space, followed by brackets [] that contain the object to be migrated.

                        -
                          -

                        • Path can contain the asterisk () wildcard character or can be an Recognized Environment Variables. You cannot use the question mark as a wildcard character.You can use HKCU and HKLM to refer to HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE respectively.

                          • -

                        • Object can contain the asterisk () wildcard character. However, you cannot use the question mark as a wildcard character. For example:

                          -

                          C:\Folder\ [] enumerates all files in C:<em>Path but no subfolders of C:\Folder.

                          -

                          C:\Folder* [] enumerates all files and subfolders of C:\Folder.

                          -

                          C:\Folder\ [*.mp3] enumerates all .mp3 files in C:\Folder.

                          -

                          C:\Folder\ [Sample.doc] enumerates only the Sample.doc file located in C:\Folder.

                          -
                          -Note

                          If you are migrating a file that has a square bracket character ([ or ]) in the file name, you must insert the carrot (^) character directly before the bracket for it to be valid. For example, if there is a file named "file].txt", you must specify <pattern type="File">c:\documents\mydocs [file^].txt]</pattern> instead of <pattern type="File">c:\documents\mydocs [file].txt]</pattern>.

                          -
                          -
                          - -
                          • -
                        - - - -For example: - -- To migrate a single registry key: - - ``` syntax - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache [Persistent] - ``` - -- To migrate the EngineeringDrafts folder and any subfolders from the C: drive: - - ``` syntax - C:\EngineeringDrafts\* [*] - ``` - -- To migrate only the EngineeringDrafts folder, excluding any subfolders, from the C: drive: - - [Reroute Files and Settings](usmt-reroute-files-and-settings.md) - -- To migrate the Sample.doc file from C:\\EngineeringDrafts: - - ``` syntax - C:\EngineeringDrafts\ [Sample.doc] - ``` - -- To migrate the Sample.doc file from where ever it exists on the C: drive use pattern in the following way. If multiple files exist with the same name on the C: drive, then all of these files will be migrated. - - ``` syntax - C:\* [Sample.doc] - ``` - -- For more examples of how to use this element, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md), [Reroute Files and Settings](usmt-reroute-files-and-settings.md), [Include Files and Settings](usmt-include-files-and-settings.md), and [Custom XML Examples](usmt-custom-xml-examples.md). - -## <processing> - - -You can use this element to run a script during a specific point within the migration process. Return values are not expected from the scripts that you specify, and if there are return values, they will be ignored. - -- **Number of occurrences:** unlimited - -- **Parent elements:**[<rules>](#rules) - -- **Required child element:**[<script>](#script) - -Syntax: - -<processing when="pre-scan|scan-success|post-scan|pre-apply|apply-success|post-apply"> - -</processing> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        when

                        Yes

                        Indicates when the script should be run. This value can be one of the following:

                        -
                          -

                        • pre-scan means before the scanning process begins.

                          • -

                        • scan-success means after the scanning process has finished successfully.

                          • -

                        • post-scan means after the scanning process has finished, whether it was successful or not.

                          • -

                        • pre-apply means before the apply process begins.

                          • -

                        • apply-success means after the apply process has finished successfully.

                          • -

                        • post-apply means after the apply process has finished, whether it was successful or not.

                          • -
                        - - - -## <plugin> - - -This is an internal USMT element. Do not use this element. - -## <role> - - -The <role> element is required in a custom .xml file. By specifying the <role> element, you can create a concrete component. The component will be defined by the parameters specified at the <component> level, and with the role that you specify here. - -- **Number of occurrences:** Each <component> can have one, two or three child <role> elements. - -- **Parent elements:**[<component>](#component), [<role>](#role) - -- **Required child elements:**[<rules>](#rules) - -- **Optional child elements:**[<environment>](#bkmk-environment), [<detection>](#detection), [<component>](#component), [<role>](#role), <detects>, <plugin>, - -Syntax: - -<role role="Container|Binaries|Settings|Data"> - -</role> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        role

                        Yes

                        Defines the role for the component. Role can be one of:

                        -
                          -

                        • Container

                          • -

                        • Binaries

                          • -

                        • Settings

                          • -

                        • Data

                          • -
                        -

                        You can either:

                        -
                          -

                        1. Specify up to three <role> elements within a <component> — one “Binaries” role element, one “Settings” role element and one “Data” role element. These parameters do not change the migration behavior — their only purpose is to help you categorize the settings that you are migrating. You can nest these <role> elements, but each nested element must be of the same role parameter.

                          2. -

                        2. Specify one “Container” <role> element within a <component> element. In this case, you cannot specify any child <rules> elements, only other <component> elements. And each child <component> element must have the same type as that of parent <component> element. For example:

                          3. -
                        -
                        <component context="UserAndSystem" type="Application">
-  <displayName _locID="migapp.msoffice2003">Microsoft Office 2003</displayName> 
-  <environment name="GlobalEnv" /> 
-  <role role="Container">
-    <detection name="AnyOffice2003Version" /> 
-    <detection name="FrontPage2003" /> 
-    <!-- 
- Office 2003 Common Settings 
-  --> 
-    <component context="UserAndSystem" type="Application">
                        - - - -The following example is from the MigUser.xml file. For more examples, see the MigApp.xml file: - -``` syntax - - Start Menu - - %CSIDL_STARTMENU% - - - - - MigXmlHelper.DoesObjectExist("File","%CSIDL_STARTMENU%") - - - - - - %CSIDL_STARTMENU%\* [*] - - - - - %CSIDL_STARTMENU% [desktop.ini] - %CSIDL_STARTMENU%\* [*] - - - - - -``` - -## <rules> - - -The <rules> element is required in a custom .xml file. This element contains rules that will run during the migration if the parent <component> element is selected, unless the child <conditions> element, if present, evaluates to FALSE. For each <rules> element there can be multiple child <rules> elements. - -- **Number of occurrences:** unlimited - -- **Parent elements:**[<role>](#role), [<rules>](#rules), [<namedElements>](#namedelements) - -- **Required child elements:**[<include>](#include) - -- **Optional child elements:**[<rules>](#rules), [<exclude>](#exclude), [<unconditionalExclude>](#unconditionalexclude),[<merge>](#merge), [<contentModify>](#contentmodify), [<locationModify>](#locationmodify), [<destinationCleanup>](#destinationcleanup), [<addObjects>](#addobjects), [<externalProcess>](#externalprocess), [<processing>](#processing), [<includeAttributes>](#includeattributes), [<excludeAttributes>](#excludeattributes), [conditions](#conditions), <detects> - -Syntax: - -<rules name="*ID*" context="User|System|UserAndSystem"> - -</rules> - - ----- - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        name

                        Yes, when <rules> is a child to <namedElements>

                        -

                        No, when <rules> is a child to any other element

                        When ID is specified, any child elements are not processed. Instead, any other <rules> elements with the same name that are declared within <namedElements> are processed.

                        context

                        No

                        -

                        (default = UserAndSystem)

                        Defines the scope of this parameter — whether to process this component in the context of the specific user, across the entire operating system, or both.

                        -

                        The largest possible scope is set by the component element. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it has a context of User. If <rules> had a context of System, it would act as though <rules> was not there.

                        -
                          -

                        • User. Evaluates the variables for each user.

                          • -

                        • System. Evaluates the variables only once for the system.

                          • -

                        • UserAndSystem. Evaluates the variables for the entire operating system and each user.

                          • -
                        - - - -The following example is from the MigUser.xml file: - -``` syntax - - My Music - - %CSIDL_MYMUSIC% - - - - - MigXmlHelper.DoesObjectExist("File","%CSIDL_MYMUSIC%") - - - - - - %CSIDL_MYMUSIC%\* [*] - - - - - %CSIDL_MYMUSIC%\ [desktop.ini] - - - - - -``` - -## <script> - - -The return value that is required by <script> depends on the parent element. - -**Number of occurrences:** Once for [<variable>](#variable), unlimited for [<objectSet>](#objectset) and [<processing>](#processing) - -**Parent elements:**[<objectSet>](#objectset), [<variable>](#variable), [<processing>](#processing) - -**Child elements:** none - -**Syntax and helper functions:** - -- General Syntax: <script>*ScriptWithArguments*</script> - -- You can use [GetStringContent](#scriptfunctions) when <script> is within <variable>. - - Syntax: <script>MigXmlHelper.GetStringContent("*ObjectType*","*EncodedLocationPattern*", "*ExpandContent*")</script> - - Example: `` - -- You can use [GenerateUserPatterns](#scriptfunctions) when <script> is within <objectSet>. - - Syntax: <script>MigXmlHelper.GenerateUserPatterns("*ObjectType*","*EncodedLocationPattern*","*ProcessCurrentUser*")</script> - - Example: `` - -- You can use [GenerateDrivePatterns](#scriptfunctions) when <script> is within <objectSet>. - - Syntax: <script>MigXmlHelper.GenerateDrivePatterns("*PatternSegment*","*DriveType*")</script> - - Example: `` - -- You can use the [Simple executing scripts](#scriptfunctions) with <script> elements that are within <processing> elements: AskForLogoff, ConvertToShortFileName, KillExplorer, RemoveEmptyDirectories, RestartExplorer, RegisterFonts, StartService, StopService, SyncSCM. - - Syntax: <script>MigXmlHelper.*ExecutingScript*</script> - - Example: `` - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        ScriptWithArguments

                        Yes

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        -

                        The script will be called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        -

                        The return value that is required by <script> depends on the parent element.

                        -
                          -

                        • When used within <variable>, the return value must be a string.

                          • -

                        • When used within <objectSet>, the return value must be a two-dimensional array of strings.

                          • -

                        • When used within <location>, the return value must be a valid location that aligns with the type attribute of <location>. For example, if <location type="File">, the child script element, if specified, must be a valid file location.

                          -
                          -Note

                          If you are migrating a file that has a bracket character ([ or ]) in the file name, insert the carrot (^) character directly before the bracket for it to be valid. For example, if there is a file named "file].txt", specify <pattern type="File">c:\documents\mydocs [file^].txt]</pattern> instead of <pattern type="File">c:\documents\mydocs [file].txt]</pattern>.

                          -
                          -
                          - -
                          • -
                        - - - -Examples: - -To migrate the Sample.doc file from any drive on the source computer, use <script> as follows. If multiple files exist with the same name, all such files will get migrated. - -``` syntax - -``` - -For more examples of how to use this element, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md), [Reroute Files and Settings](usmt-reroute-files-and-settings.md), and [Custom XML Examples](usmt-custom-xml-examples.md). - -### <script> functions - -You can use the following functions with the <script> element - -- [String and pattern generating functions](#stringgeneratingfunctions) - -- [Simple executing scripts](#simple) - -### String and pattern generating functions - -These functions return either a string or a pattern. - -- **GetStringContent** - - You can use GetStringContent with <script> elements that are within <variable> elements. If possible, this function returns the string representation of the given object. Otherwise, it returns NULL. For file objects this function always returns NULL. - - Syntax: GetStringContent("*ObjectType*","*EncodedLocationPattern*", "*ExpandContent*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        ObjectType

                        Yes

                        The type of object. Can be Registry or Ini (for an .ini file).

                        EncodedLocationPattern

                        Yes

                          -

                        • If type of object is Registry, EncodedLocationPattern must be a valid registry path. For example, HKLM\SOFTWARE\MyKey[].

                          • -

                        • If the type of object is Ini, then EncodedLocationPattern must be in the following format:

                          -

                          IniFilePath|SectionName[SettingName]

                          • -

                        ExpandContent

                        No (default=TRUE)

                        Can be TRUE or FALSE. If FALSE, then the given location will not be expanded before it is returned.

                        - - - -~~~ -For example: - -``` syntax - - - -``` -~~~ - -- **GenerateDrivePatterns** - - The GenerateDrivePatterns function will iterate all of the available drives and select the ones that match the requested drive type. It will then concatenate the selected drives with the end part of *PatternSegment* to form a full encoded file pattern. For example, if *PatternSegment* is `Path [file.txt]` and DriveType is `Fixed`, then the function will generate `C:\Path [file.txt]`, and other patterns if there are fixed drives other than C:. You cannot specify environment variables with this function. You can use GenerateDrivePatterns with <script> elements that are within [<objectSet>](#objectset) that are within <include>/<exclude>. - - Syntax: GenerateDrivePatterns("*PatternSegment*","*DriveType*") - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        PatternSegment

                        Yes

                        The suffix of an encoded pattern. It will be concatenated with a drive specification, such as "c:&quot;, to form a complete encoded file pattern. For example, "* [*.doc]". PatternSegment cannot be an environment variable.

                        DriveType

                        Yes

                        The drive type for which the patterns are to be generated. You can specify one of:

                        -
                          -

                        • Fixed

                          • -

                        • CDROM

                          • -

                        • Removable

                          • -

                        • Remote

                          • -
                        - - - -~~~ -See the last component in the MigUser.xml file for an example of this element. -~~~ - -- **GenerateUserPatterns** - - The function will iterate through all users that are being migrated, excluding the currently processed user if <ProcessCurrentUser> is FALSE, and will expand the specified pattern in the context of each user. For example, if users A, B and C have profiles in C:\\Documents and Settings), by calling `GenerateUserPattens('File','%userprofile% [*.doc]','TRUE')`, the helper function will generate the following three patterns: - - - "C:\\Documents and Settings\\A\\\* \[\*.doc\]" - - - "C:\\Documents and Settings\\B\\\* \[\*.doc\]" - - - "C:\\Documents and Settings\\C\\\* \[\*.doc\]" - - Syntax:GenerateUserPatterns("*ObjectType*","*EncodedLocationPattern*","*ProcessCurrentUser*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        ObjectType

                        Yes

                        Defines the object type. Can be File or Registry.

                        EncodedLocationPattern

                        Yes

                        The location pattern. Environment variables are allowed.

                        ProcessCurrentUser

                        Yes

                        Can be TRUE or FALSE. Indicates if the patterns should be generated for the current user.

                        - - - -~~~ -**Example:** - -If GenerateUserPattens('File','%userprofile% \[\*.doc\]','FALSE') is called while USMT is processing user A, then this function will only generate patterns for users B and C. You can use this helper function to build complex rules. For example, to migrate all .doc files from the source computer — but if user X is not migrated, then do not migrate any of the .doc files from user X’s profile. - -The following is example code for this scenario. The first <rules> element migrates all.doc files on the source computer with the exception of those inside C:\\Documents and Settings. The second <rules> elements will migrate all .doc files from C:\\Documents and Settings with the exception of the .doc files in the profiles of the other users. Because the second <rules> element will be processed in each migrated user context, the end result will be the desired behavior. The end result is the one we expected. - -``` syntax - - - - - - - - - %ProfilesFolder%\* [*.doc] - - - - - - - %ProfilesFolder%\* [*.doc] - - - - - - - - -``` -~~~ - -### MigXmlHelper.GenerateDocPatterns - -This helper function invokes the document finder to scan the system for all files that can be migrated. It can be invoked in either System or User context to focus the scan. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        ScanProgramFiles

                        No (default = FALSE)

                        Can be TRUE or FALSE. The ScanProgramFiles parameter determines whether or not the document finder scans the Program Files directory to gather registered file extensions for known applications. For example, when set to TRUE it will discover and migrate .jpg files under the Photoshop directory, if .jpg is a file extension registered to Photoshop.

                        IncludePatterns

                        No (default = TRUE)

                        Can be TRUE or FALSE. TRUE will generate include patterns and can be added under the <include> element. FALSE will generate exclude patterns and can be added under the <exclude> element.

                        SystemDrive

                        No (default = FALSE)

                        Can be TRUE or FALSE. If TRUE, restricts all patterns to the system drive.

                        - - - -``` syntax - - - MigDocUser - - - - - - - - - - - - - - - -``` - -### Simple executing scripts - -The following scripts have no return value. You can use the following errors with <script> elements that are within <processing> elements - -- **AskForLogoff()**. Prompts the user to log off at the end of the migration. For example: - - ``` syntax - - - - ``` - -- **ConvertToShortFileName(RegistryEncodedLocation)**. If *RegistryEncodedLocation* is the full path of an existing file, this function will convert the file to its short file name and then it will update the registry value. - -- **KillExplorer()**. Stops Explorer.exe for the current user context. This allows access to certain keys and files that are kept open when Explorer.exe is running. For example: - - ``` syntax - - - - ``` - -- **RegisterFonts(FileEncodedLocation)**. Registers the given font or all of the fonts in the given directory. For example: - - ``` syntax - - - - ``` - -- **RemoveEmptyDirectories (DirectoryEncodedPattern).** Deletes any empty directories that match *DirectoryEncodedPattern* on the destination computer. - -- **RestartExplorer().** Restarts Explorer.exe at the end of the migration. For example: - - ``` syntax - - - - ``` - -- **StartService (ServiceName, OptionalParam1, OptionalParam2,…).** Starts the service identified by *ServiceName. ServiceName* is the subkey in HKLM\\System\\CurrentControlSet\\Services that holds the data for the given service. The optional parameters, if any, will be passed to the StartService API. For more information, see [this Microsoft Web site](https://go.microsoft.com/fwlink/p/?LinkId=267898). - -- **StopService (ServiceName)**. Stops the service that is identified by *ServiceName. ServiceName* is the subkey in HKLM\\System\\CurrentControlSet\\Services that holds the data for the given service. - -- **SyncSCM(ServiceShortName).** Reads the Start type value from the registry (HKLM\\System\\CurrentControlSet\\Services\\ServiceShortName \[Start\]) after it is changed by the migration engine, and then synchronizes Service Control Manager (SCM) with the new value. - -## <text> - - -You can use the <text> element to set a value for any environment variables that are inside one of the migration .xml files. - -- **Number of occurrences:** Once in each [<variable>](#variable) element. - -- **Parent elements:**[<variable>](#variable) - -- **Child elements:** None. - -Syntax: - -<text>*NormalText*</text> - - ---- - - - - - - - - - - - - -
                        SettingValue

                        NormalText

                        This is interpreted as normal text.

                        - - - -For example: - -``` syntax - - %CSIDL_COMMON_APPDATA%\QuickTime - -``` - -## <unconditionalExclude> - - -The <unconditionalExclude> element excludes the specified files and registry values from the migration, regardless of the other include rules in any of the migration .xml files or in the Config.xml file. The objects declared here will not be migrated because this element takes precedence over all other rules. For example, even if there are explicit <include> rules to include .mp3 files, if you specify to exclude them with this option, then they will not be migrated. - -Use this element if you want to exclude all .mp3 files from the source computer. Or, if you are backing up C:\\UserData using another method, you can exclude the entire folder from the migration. Use this element with caution, however, because if an application needs a file that you exclude, the application may not function properly on the destination computer. - -- **Number of occurrences:** Unlimited. - -- **Parent elements:**[<rules>](#rules) - -- **Child elements:**[<objectSet>](#objectset) - -Syntax: - -<unconditionalExclude></unconditionalExclude> - -The following .xml file excludes all .mp3 files from migration. For additional examples of how to use this element, see the [Exclude Files and Settings](usmt-exclude-files-and-settings.md). - -``` syntax - - - Test - - - - - - - - - - - -``` - -## <variable> - - -The <variable> element is required in an <environment> element. For each <variable> element there must be one <objectSet>, <script>, or <text> element. The content of the <variable> element assigns a text value to the environment variable. This element has the following three options: - -1. If the <variable> element contains a <text> element, then the value of the variable element will be the value of the <text> element. - -2. If the <variable> element contains a <script> element and the invocation of the script produces a non-null string, then the value of the <variable> element will be the result of the script invocation. - -3. If the <variable> element contains an <objectSet> element and the evaluation of the <objectSet> element produces at least one object pattern, then the value of the first object to match the resulting object pattern will be the value of the variable element. - -- **Number of occurrences:** Unlimited - -- **Parent elements:**[<environment>](#bkmk-environment) - -- **Required child elements:** either [<text>](#text), or [<script>](#script), or [<objectSet>](#objectset) - -Syntax: - -<variable name="*ID*" remap=TRUE|FALSE> - -</variable> - - ----- - - - - - - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        name

                        Yes

                        ID is a string value that is the name used to reference the environment variable. We recommend that ID start with the component’s name to avoid namespace collisions. For example, if your component’s name is MyComponent, and you want a variable that is your component’s install path, you could specify MyComponent.InstallPath.

                        remap

                        No, default = FALSE

                        Specifies whether to evaluate this environment variable as a remapping environment variable. Objects that are located in a path that is underneath this environment variable’s value are automatically moved to where the environment variable points on the destination computer.

                        - - - -The following example is from the MigApp.xml file: - -``` syntax - - - HKLM\Software - - - - - -``` - -## <version> - - -The <version> element defines the version for the component, but does not affect the migration. - -- **Number of occurrences:** zero or one - -- **Parent elements:**[<component>](#component) - -- **Child elements:** none - -Syntax: - -<version>*ComponentVersion*</version> - - ----- - - - - - - - - - - - - - - -
                        SettingRequired?Value

                        ComponentVersion

                        Yes

                        The version of the component, which can contain patterns.

                        - - - -For example: - -``` syntax -4.* -``` - -## <windowsObjects> - - -The <windowsObjects> element is for USMT internal use only. Do not use this element. - -## Appendix - - -### Specifying locations - -- **Specifying encoded locations**. The encoded location used in all of the helper functions is an unambiguous string representation for the name of an object. It is composed of the node part, optionally followed by the leaf enclosed in square brackets. This makes a clear distinction between nodes and leaves. - - For example, specify the file C:\\Windows\\Notepad.exe like this: `c:\Windows[Notepad.exe]`. Similarly, specify the directory C:\\Windows\\System32 like this: `c:\Windows\System32`. (Notice the absence of the \[\] construct.) - - Representing the registry is very similar. The default value of a registry key is represented as an empty \[\] construct. For example, the default value for the HKLM\\SOFTWARE\\MyKey registry key will be `HKLM\SOFTWARE\MyKey[]`. - -- **Specifying location patterns**. You specify a location pattern in a way that is similar to how you specify an actual location. The exception is that both the node and leaf part accept patterns. However, a pattern from the node does not extend to the leaf. - - For example, the pattern `c:\Windows\*` will match the Windows directory and all subdirectories. But it will not match any of the files in those directories. To match the files as well, you must specify `c:\Windows\*[*]`. - -### Internal USMT functions - -The following functions are for internal USMT use only. Do not use them in an .xml file. - -- AntiAlias - -- ConvertScreenSaver - -- ConvertShowIEOnDesktop - -- ConvertToOfficeLangID - -- MigrateActiveDesktop - -- MigrateAppearanceUPM - -- MigrateDisplayCS - -- MigrateDisplaySS - -- MigrateIEAutoSearch - -- MigrateMouseUPM - -- MigrateSoundSysTray - -- MigrateTaskBarSS - -- SetPstPathInMapiStruc - -### Valid version tags - -You can use the following version tags with various helper functions: - -- “CompanyName” - -- “FileDescription” - -- “FileVersion” - -- “InternalName” - -- “LegalCopyright” - -- “OriginalFilename” - -- “ProductName” - -- “ProductVersion” - -The following version tags contain values that can be compared: - -- “FileVersion” - -- “ProductVersion” - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - - - - - - - - - +--- +title: XML Elements Library (Windows 10) +description: XML Elements Library +ms.assetid: f5af0f6d-c3bf-4a4c-a0ca-9db7985f954f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# XML Elements Library + + +## Overview + + +This topic describes the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). It is assumed that you understand the basics of XML. . + +## In This Topic + + +In addition to XML elements and helper functions, this topic describes how to specify encoded locations and locations patterns, functions that are for internal USMT use only, and the version tags that you can use with helper functions. + +- [Elements and helper functions](#elements) + +- [Appendix](#appendix) + + - [Specifying locations](#locations) + + - [Internal USMT functions](#internalusmtfunctions) + + - [Valid version tags](#allowed) + +## Elements and Helper Functions + + +The following table describes the XML elements and helper functions you can use with USMT. + + +++++ + + + + + + + + + + + + + + +
                        Elements A-KElements L-ZHelper functions

                        <addObjects>

                        +

                        <attributes>

                        +

                        <bytes>

                        +

                        <commandLine>

                        +

                        <component>

                        +

                        <condition>

                        +

                        <conditions>

                        +

                        <content>

                        +

                        <contentModify>

                        +

                        <description>

                        +

                        <destinationCleanup>

                        +

                        <detect>

                        +

                        <detects>

                        +

                        <detection>

                        +

                        <displayName>

                        +

                        <environment>

                        +

                        <exclude>

                        +

                        <excludeAttributes>

                        +

                        <extensions>

                        +

                        <extension>

                        +

                        <externalProcess>

                        +

                        <icon>

                        +

                        <include>

                        +

                        <includeAttribute>

                        <library>

                        +

                        <location>

                        +

                        <locationModify>

                        +

                        <_locDefinition>

                        +

                        <manufacturer>

                        +

                        <merge>

                        +

                        <migration>

                        +

                        <namedElements>

                        +

                        <object>

                        +

                        <objectSet>

                        +

                        <path>

                        +

                        <paths>

                        +

                        <pattern>

                        +

                        <processing>

                        +

                        <plugin>

                        +

                        <role>

                        +

                        <rules>

                        +

                        <script>

                        +

                        <text>

                        +

                        <unconditionalExclude>

                        +

                        <variable>

                        +

                        <version>

                        +

                        <windowsObjects>

                        <condition> functions

                        +

                        <content> functions

                        +

                        <contentModify> functions

                        +

                        <include> and <exclude> filter functions

                        +

                        <locationModify> functions

                        +

                        <merge> functions

                        +

                        <script> functions

                        +

                        Internal USMT functions

                        + + + +## <addObjects> + + +The <addObjects> element emulates the existence of one or more objects on the source computer. The child <object> elements provide the details of the emulated objects. If the content is a <script> element, the result of the invocation will be an array of objects. + +- **Number of occurrences:** unlimited + +- **Parent elements:**[<rules>](#rules) + +- **Required child elements:** [<object>](#object) In addition, you must specify [<location>](#location) and [<attribute>](#attribute) as child elements of this <object> element. + +- **Optional child elements:**[<conditions>](#conditions), <condition>, [<script>](#script) + +Syntax: + +<addObjects> + +</addObjects> + +The following example is from the MigApp.xml file: + +``` xml + + + %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] + DWORD + 0B000000 + + + %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] + DWORD + 00000000 + + +``` + +## <attributes> + + +The <attributes> element defines the attributes for a registry key or file. + +- **Number of occurrences:** once for each <object> + +- **Parent elements:**[<object>](#object) + +- **Child elements:** none + +Syntax: + +<attributes>*Content*</attributes> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        Content

                        Yes

                        The content depends on the type of object specified.

                        +
                          +

                        • For files, the content can be a string containing any of the following attributes separated by commas:

                          +
                            +

                          • Archive

                            • +

                          • Read-only

                            • +

                          • System

                            • +

                          • Hidden

                            • +
                          • +

                        • For registry keys, the content can be one of the following types:

                          +
                            +

                          • None

                            • +

                          • String

                            • +

                          • ExpandString

                            • +

                          • Binary

                            • +

                          • Dword

                            • +

                          • REG_SZ

                            • +
                          • +
                        + + + +The following example is from the MigApp.xml file: + +``` xml + + %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] + DWORD + 00000000 + +``` + +## <bytes> + + +You must specify the <bytes> element only for files because, if <location> corresponds to a registry key or a directory, then <bytes> will be ignored. + +- **Number of occurrences:** zero or one + +- **Parent elements:**[<object>](#object) + +- **Child elements:** none + +Syntax: + +<bytes string="Yes|No" expand="Yes|No">*Content*</bytes> + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        string

                        No, default is No

                        Determines whether Content should be interpreted as a string or as bytes.

                        expand

                        No (default = Yes

                        When the expand parameter is Yes, the content of the <bytes> element is first expanded in the context of the source computer and then interpreted.

                        Content

                        Yes

                        Depends on the value of the string.

                        +
                          +

                        • When the string is Yes: the content of the <bytes> element is interpreted as a string.

                          • +

                        • When the string is No: the content of the <bytes> element is interpreted as bytes. Each two characters represent the hexadecimal value of a byte. For example, "616263" is the representation for the "abc" ANSI string. A complete representation of the UNICODE string "abc" including the string terminator would be: "6100620063000000".

                          • +
                        + + + +The following example is from the MigApp.xml file: + +``` xml + + %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] + DWORD + 00000000 + +``` + +## <commandLine> + + +You might want to use the <commandLine> element if you want to start or stop a service or application before or after you run the ScanState and LoadState tools. + +- **Number of occurrences:** unlimited + +- **Parent elements:**[<externalProcess>](#externalprocess) + +- **Child elements:** none**** + +Syntax: + +<commandLine>*CommandLineString*</commandLine> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        CommandLineString

                        Yes

                        A valid command line.

                        + + + +## <component> + + +The <component> element is required in a custom .xml file. This element defines the most basic construct of a migration .xml file. For example, in the MigApp.xml file, "Microsoft® Office 2003" is a component that contains another component, "Microsoft Office Access® 2003". You can use the child elements to define the component. + +A component can be nested inside another component; that is, the <component> element can be a child of the <role> element within the <component> element in two cases: 1) when the parent <component> element is a container or 2) if the child <component> element has the same role as the parent <component> element. + +- **Number of occurrences:** Unlimited + +- **Parent elements:**[<migration>](#migration), [<role>](#role) + +- **Required child elements:**[<role>](#role), [<displayName>](#displayname) + +- **Optional child elements:**[<manufacturer>](#manufacturer), [<version>](#version), [<description>](#description), [<paths>](#paths), [<icon>](#icon), [<environment>](#bkmk-environment), [<extensions>](#extensions) + +Syntax: + +<component type="System|Application|Device|Documents" context="User|System|UserAndSystem" defaultSupported="TRUE|FALSE|YES|NO" + +hidden="Yes|No"> + +</component> + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        type

                        Yes

                        You can use the following to group settings, and define the type of the component.

                        +
                          +

                        • System: Operating system settings. All Windows® components are defined by this type.

                          +

                          When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that is specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name. Otherwise, the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.

                          • +

                        • Application: Settings for an application.

                          • +

                        • Device: Settings for a device.

                          • +

                        • Documents: Specifies files.

                          • +

                        context

                        No

                        +

                        Default = UserAndSystem

                        Defines the scope of this parameter; that is, whether to process this component in the context of the specific user, across the entire operating system, or both.

                        +

                        The largest possible scope is set by the <component> element. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it has a context of User. If a <rules> element has a context of System, it would act as though the <rules> element is not there.

                        +
                          +

                        • User. Evaluates the component for each user.

                          • +

                        • System. Evaluates the component only once for the system.

                          • +

                        • UserAndSystem. Evaluates the component for the entire operating system and each user.

                          • +

                        defaultSupported

                        No

                        +

                        (default = TRUE)

                        Can be any of TRUE, FALSE, YES or NO. If this parameter is FALSE (or NO), the component will not be migrated unless there is an equivalent component on the destination computer.

                        +

                        When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that are specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name or the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.

                        hidden

                        This parameter is for internal USMT use only.

                        + + + +For an example, see any of the default migration .xml files. + +## <condition> + + +Although the <condition> element under the <detect>, <objectSet>, and <addObjects> elements is supported, we recommend that you do not use it. This element might be deprecated in future versions of USMT, requiring you to rewrite your scripts. We recommend that, if you need to use a condition within the <objectSet> and <addObjects> elements, you use the more powerful [<conditions>](#conditions) element, which allows you to formulate complex Boolean statements. + +The <condition> element has a Boolean result. You can use this element to specify the conditions in which the parent element will be evaluated. If any of the present conditions return FALSE, the parent element will not be evaluated. + +- **Number of occurrences:** unlimited. + +- **Parent elements:**[<conditions>](#conditions), <detect>, <objectSet>, <addObjects> + +- **Child elements:** none + +- **Helper functions:** You can use the following [<condition> functions](#conditionfunctions) with this element: DoesOSMatch, IsNative64Bit(), IsOSLaterThan, IsOSEarlierThan, DoesObjectExist, DoesFileVersionMatch, IsFileVersionAbove, IsFileVersionBelow, IsSystemContext, DoesStringContentEqual, DoesStringContentContain, IsSameObject, IsSameContent, and IsSameStringContent. + +Syntax: + +<condition negation="Yes|No">*ScriptName*</condition> + + +++++ + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        negation

                        No

                        +

                        Default = No

                        "Yes" reverses the True/False value of the condition.

                        ScriptName

                        Yes

                        A script that has been defined within this migration section.

                        + + + +For example, + +In the code sample below, the <condition> elements, A and B, are joined together by the AND operator because they are in separate <conditions> sections. For example: + +``` xml + + + A + + + B + + +``` + +However, in the code sample below, the <condition> elements, A and B, are joined together by the OR operator because they are in the same <conditions> section. + +``` xml + + + A + B + + +``` + +### <condition> functions + +The <condition> functions return a Boolean value. You can use these elements in <addObjects> conditions. + +- [Operating system version functions](#operatingsystemfunctions) + +- [Object content functions](#objectcontentfunctions) + +### Operating system version functions + +- **DoesOSMatch** + + All matches are case insensitive. + + Syntax: DoesOSMatch("*OSType*","*OSVersion*") + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        OSType

                        Yes

                        The only valid value for this setting is NT. Note, however, that you must set this setting for the <condition> functions to work correctly.

                        OSVersion

                        Yes

                        The major version, minor version, build number and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version with a pattern. For example, 5.0.*.

                        + + + +~~~ +For example: + +<condition>MigXmlHelper.DoesOSMatch("NT","\*")</condition> +~~~ + +- **IsNative64Bit** + + The IsNative64Bit function returns TRUE if the migration process is running as a native 64-bit process; that is, a process running on a 64-bit system without Windows on Windows (WOW). Otherwise, it returns FALSE. + +- **IsOSLaterThan** + + All comparisons are case insensitive. + + Syntax: IsOSLaterThan("*OSType*","*OSVersion*") + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        OSType

                        Yes

                        Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is “9x”, the result will be FALSE.

                        OSVersion

                        Yes

                        The major version, minor version, build number, and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version but no pattern is allowed. For example, 5.0.

                        +

                        The IsOSLaterThan function returns TRUE if the current operating system is later than or equal to OSVersion.

                        + + + +~~~ +For example: + +<condition negation="Yes">MigXmlHelper.IsOSLaterThan("NT","6.0")</condition> +~~~ + +- **IsOSEarlierThan** + + All comparisons are case insensitive. + + Syntax: IsOSEarlierThan("*OSType*","*OSVersion*") + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        OSType

                        Yes

                        Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is “9x” the result will be FALSE.

                        OSVersion

                        Yes

                        The major version, minor version, build number, and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version but no pattern is allowed. For example, 5.0.

                        +

                        The IsOSEarlierThan function returns TRUE if the current operating system is earlier than OSVersion.

                        + + + +### Object content functions + +- **DoesObjectExist** + + The DoesObjectExist function returns TRUE if any object exists that matches the location pattern. Otherwise, it returns FALSE. The location pattern is expanded before attempting the enumeration. + + Syntax: DoesObjectExist("*ObjectType*","*EncodedLocationPattern*") + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        ObjectType

                        Yes

                        Defines the object type. Can be File or Registry.

                        EncodedLocationPattern

                        Yes

                        The location pattern. Environment variables are allowed.

                        + + + +~~~ +For an example of this element, see the MigApp.xml file. +~~~ + +- **DoesFileVersionMatch** + + The pattern check is case insensitive. + + Syntax: DoesFileVersionMatch("*EncodedFileLocation*","*VersionTag*","*VersionValue*") + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        EncodedFileLocation

                        Yes

                        The location pattern for the file that will be checked. Environment variables are allowed.

                        VersionTag

                        Yes

                        The version tag value that will be checked.

                        VersionValue

                        Yes

                        A string pattern. For example, "Microsoft*".

                        + + + +~~~ +For example: + +<condition>MigXmlHelper.DoesFileVersionMatch("%MSNMessengerInstPath%\\msnmsgr.exe","ProductVersion","6.\*")</condition> + +<condition>MigXmlHelper.DoesFileVersionMatch("%MSNMessengerInstPath%\\msnmsgr.exe","ProductVersion","7.\*")</condition> +~~~ + +- **IsFileVersionAbove** + + The IsFileVersionAbove function returns TRUE if the version of the file is higher than *VersionValue*. + + Syntax: IsFileVersionAbove("*EncodedFileLocation*","*VersionTag*","*VersionValue*") + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        EncodedFileLocation

                        Yes

                        The location pattern for the file that will be checked. Environment variables are allowed.

                        VersionTag

                        Yes

                        The version tag value that will be checked.

                        VersionValue

                        Yes

                        The value to compare to. You cannot specify a pattern.

                        + + + +- **IsFileVersionBelow** + + Syntax: IsFileVersionBelow("*EncodedFileLocation*","*VersionTag*","*VersionValue*") + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        EncodedFileLocation

                        Yes

                        The location pattern for the file that will be checked. Environment variables are allowed.

                        VersionTag

                        Yes

                        The version tag value that will be checked.

                        VersionValue

                        Yes

                        The value to compare to. You cannot specify a pattern.

                        + + + +- **IsSystemContext** + + The IsSystemContext function returns TRUE if the current context is "System". Otherwise, it returns FALSE. + + Syntax: IsSystemContext() + +- **DoesStringContentEqual** + + The DoesStringContentEqual function returns TRUE if the string representation of the given object is identical to `StringContent`. + + Syntax: DoesStringContentEqual("*ObjectType*","*EncodedLocation*","*StringContent*") + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        ObjectType

                        Yes

                        Defines the type of object. Can be File or Registry.

                        EncodedLocationPattern

                        Yes

                        The encoded location for the object that will be examined. You can specify environment variables.

                        StringContent

                        Yes

                        The string that will be checked against.

                        + + + +~~~ +For example: + +``` xml +MigXmlHelper.DoesStringContentEqual("File","%USERNAME%","") +``` +~~~ + +- **DoesStringContentContain** + + The DoesStringContentContain function returns TRUE if there is at least one occurrence of *StrToFind* in the string representation of the object. + + Syntax: DoesStringContentContain("*ObjectType*","*EncodedLocation*","*StrToFind*") + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        ObjectType

                        Yes

                        Defines the type of object. Can be File or Registry.

                        EncodedLocationPattern

                        Yes

                        The encoded location for the object that will be examined. You can specify environment variables.

                        StrToFind

                        Yes

                        A string that will be searched inside the content of the given object.

                        + + + +- **IsSameObject** + + The IsSameObject function returns TRUE if the given encoded locations resolve to the same physical object. Otherwise, it returns FALSE. + + Syntax: IsSameObject("*ObjectType*","*EncodedLocation1*","*EncodedLocation2*") + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        ObjectType

                        Yes

                        Defines the type of object. Can be File or Registry.

                        EncodedLocation1

                        Yes

                        The encoded location for the first object. You can specify environment variables.

                        EncodedLocation2

                        Yes

                        The encoded location for the second object. You can specify environment variables.

                        + + + +~~~ +For example: + +``` xml + + MigXmlHelper.IsSameObject("File","%CSIDL_FAVORITES%","%CSIDL_COMMON_FAVORITES%") + %CSIDL_FAVORITES%\* [*] + +``` +~~~ + +- **IsSameContent** + + The IsSameContent function returns TRUE if the given objects have the same content. Otherwise, it returns FALSE. The content will be compared byte by byte. + + Syntax: IsSameContent("*ObjectType1*","*EncodedLocation1*","*ObjectType2*","*EncodedLocation2*") + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        ObjectType1

                        Yes

                        Defines the type of the first object. Can be File or Registry.

                        EncodedLocation1

                        Yes

                        The encoded location for the first object. You can specify environment variables.

                        ObjectType2

                        Yes

                        Defines the type of the second object. Can be File or Registry.

                        EncodedLocation2

                        Yes

                        The encoded location for the second object. You can specify environment variables.

                        + + + +- **IsSameStringContent** + + The IsSameStringContent function returns TRUE if the given objects have the same content. Otherwise, it returns FALSE. The content will be interpreted as a string. + + Syntax: IsSameStringContent("*ObjectType1*","*EncodedLocation1*","*ObjectType2*","*EncodedLocation2*") + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        ObjectType1

                        Yes

                        Defines the type of the first object. Can be File or Registry.

                        EncodedLocation1

                        Yes

                        The encoded location for the first object. You can specify environment variables.

                        ObjectType2

                        Yes

                        Defines the type of the second object. Can be File or Registry.

                        EncodedLocation2

                        Yes

                        The encoded location for the second object. You can specify environment variables.

                        + + + +## <conditions> + + +The <conditions> element returns a Boolean result that is used to specify the conditions in which the parent element is evaluated. USMT evaluates the child elements, and then joins their results using the operators AND or OR according to the **operation** parameter. + +- **Number of occurrences:** Unlimited inside another <conditions> element. Limited to one occurrence in [<detection>](#detection), [<rules>](#rules), [<addObjects>](#addobjects), and [<objectSet>](#objectset) + +- **Parent elements:**[<conditions>](#conditions), [<detection>](#detection), [<environment>](#bkmk-environment), [<rules>](#rules), [<addObjects>](#addobjects), and [<objectSet>](#objectset) + +- **Child elements:**[<conditions>](#conditions), [<condition>](#condition) + +Syntax: + +<conditions operation="AND|OR"> + +</conditions> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        operation

                        No, default = AND

                        Defines the Boolean operation that is performed on the results that are obtained from the child elements.

                        + + + +The following example is from the MigApp.xml file: + +``` xml + + + MigXmlHelper.IsNative64Bit() + + + HKLM\Software + + +``` + +## <content> + + +You can use the <content> element to specify a list of object patterns to obtain an object set from the source computer. Each <objectSet> within a <content> element is evaluated. For each resulting object pattern list, the objects that match it are enumerated and their content is filtered by the filter parameter. The resulting string array is the output for the <content> element. The filter script returns an array of locations. The parent <objectSet> element can contain multiple child <content> elements. + +- **Number of occurrences:** unlimited + +- **Parent elements:**[<objectSet>](#objectset) + +- **Child elements:**[<objectSet>](#objectset) + +- **Helper functions:** You can use the following [<content> functions](#contentfunctions) with this element: ExtractSingleFile, ExtractMultipleFiles, and ExtractDirectory. + +Syntax: + +<content filter="*ScriptInvocation*"> + +</content> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        filter

                        Yes

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        +

                        The script is called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        + + + +### <content> functions + +The following functions generate patterns out of the content of an object. These functions are called for every object that the parent <ObjectSet> element is enumerating. + +- **ExtractSingleFile** + + If the registry value is a MULTI-SZ, only the first segment is processed. The returned pattern is the encoded location for a file that must exist on the system. If the specification is correct in the registry value, but the file does not exist, this function returns NULL. + + Syntax: ExtractSingleFile(*Separators*,*PathHints*) + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        Separators

                        Yes

                        A list of possible separators that might follow the file specification in this registry value name. For example, if the content is "C:\Windows\Notepad.exe,-2", the separator is a comma. You can specify NULL.

                        PathHints

                        Yes

                        A list of extra paths, separated by colons (;), where the function will look for a file matching the current content. For example, if the content is "Notepad.exe" and the path is the %Path% environment variable, the function will find Notepad.exe in %windir% and returns "c:\Windows [Notepad.exe]". You can specify NULL.

                        + + + +~~~ +For example: + +``` xml + +``` + +and + +``` xml + +``` +~~~ + +- **ExtractMultipleFiles** + + The ExtractMultipleFiles function returns multiple patterns, one for each file that is found in the content of the given registry value. If the registry value is a MULTI-SZ, the MULTI-SZ separator is considered a separator by default. therefore, for MULTI-SZ, the <Separators> argument must be NULL. + + The returned patterns are the encoded locations for files that must exist on the source computer. If the specification is correct in the registry value but the file does not exist, it will not be included in the resulting list. + + Syntax: ExtractMultipleFiles(*Separators*,*PathHints*) + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        Separators

                        Yes

                        A list of possible separators that might follow the file specification in this registry value name. For example, if the content is "C:\Windows\Notepad.exe,-2", the separator is a comma. This parameter must be NULL when processing MULTI-SZ registry values.

                        PathHints

                        Yes

                        A list of extra paths, separated by colons (;), where the function will look for a file matching the current content. For example, if the content is "Notepad.exe" and the path is the %Path% environment variable, the function will find Notepad.exe in %windir% and returns "c:\Windows [Notepad.exe]". You can specify NULL.

                        + + + +- **ExtractDirectory** + + The ExtractDirectory function returns a pattern that is the encoded location for a directory that must exist on the source computer. If the specification is correct in the registry value, but the directory does not exist, this function returns NULL. If it is processing a registry value that is a MULTI-SZ, only the first segment will be processed. + + Syntax: ExtractDirectory(*Separators*,*LevelsToTrim*,*PatternSuffix*) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        Separators

                        No

                        A list of possible separators that might follow the file specification in this registry value name. For example, if the content is "C:\Windows\Notepad.exe,-2", the separator is a comma. You must specify NULL when processing MULTI-SZ registry values.

                        LevelsToTrim

                        Yes

                        The number of levels to delete from the end of the directory specification. Use this function to extract a root directory when you have a registry value that points inside that root directory in a known location.

                        PatternSuffix

                        Yes

                        The pattern to add to the directory specification. For example, * [*].

                        + + + +~~~ +For example: + +``` xml + + + + %HklmWowSoftware%\Classes\Software\RealNetworks\Preferences\DT_Common [] + + + +``` +~~~ + +## <contentModify> + + +The <contentModify> element modifies the content of an object before it is written to the destination computer. For each <contentModify> element there can be multiple <objectSet> elements. This element returns the new content of the object that is being processed. + +- **Number of occurrences:** Unlimited + +- **Parent elements:**[<rules>](#rules) + +- **Required child elements:**[<objectSet>](#objectset) + +- **Helper functions**: You can use the following [<contentModify> functions](#contentmodifyfunctions) with this element: ConvertToDWORD, ConvertToString, ConvertToBinary, KeepExisting, OffsetValue, SetValueByTable, MergeMultiSzContent, and MergeDelimitedContent. + +Syntax: + +<contentModify script="*ScriptInvocation*"> + +</contentModify> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        script

                        Yes

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        +

                        The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        + + + +### <contentModify> functions + +The following functions change the content of objects as they are migrated. These functions are called for every object that the parent <ObjectSet> element is enumerating. + +- **ConvertToDWORD** + + The ConvertToDWORD function converts the content of registry values that are enumerated by the parent <ObjectSet> element to a DWORD. For example, ConvertToDWORD will convert the string "1" to the DWORD 0x00000001. If the conversion fails, then the value of DefaultValueOnError will be applied. + + Syntax: ConvertToDWORD(*DefaultValueOnError*) + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        DefaultValueOnError

                        No

                        The value that will be written into the value name if the conversion fails. You can specify NULL, and 0 will be written if the conversion fails.

                        + + + +- **ConvertToString** + + The ConvertToString function converts the content of registry values that match the parent <ObjectSet> element to a string. For example, it will convert the DWORD 0x00000001 to the string "1". If the conversion fails, then the value of DefaultValueOnError will be applied. + + Syntax: ConvertToString(*DefaultValueOnError*) + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        DefaultValueOnError

                        No

                        The value that will be written into the value name if the conversion fails. You can specify NULL, and 0 will be written if the conversion fails.

                        + + + +~~~ +For example: + +``` xml + + + HKCU\Control Panel\Desktop [ScreenSaveUsePassword] + + +``` +~~~ + +- **ConvertToBinary** + + The ConvertToBinary function converts the content of registry values that match the parent <ObjectSet> element to a binary type. + + Syntax: ConvertToBinary () + +- **OffsetValue** + + The OffsetValue function adds or subtracts *Value* from the value of the migrated object, and then writes the result back into the registry value on the destination computer. For example, if the migrated object is a DWORD with a value of 14, and the *Value* is "-2", the registry value will be 12 on the destination computer. + + Syntax: OffsetValue(*Value*) + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        Value

                        Yes

                        The string representation of a numeric value. It can be positive or negative. For example, OffsetValue(2).

                        + + + +- **SetValueByTable** + + The SetValueByTable function matches the value from the source computer to the source table. If the value is there, the equivalent value in the destination table will be applied. If the value is not there, or if the destination table has no equivalent value, the *DefaultValueOnError* will be applied. + + Syntax: SetValueByTable(*SourceTable*,*DestinationTable*,*DefaultValueOnError*) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        SourceTable

                        Yes

                        A list of values separated by commas that are possible for the source registry values.

                        DestinationTable

                        No

                        A list of translated values separated by commas.

                        DefaultValueOnError

                        No

                        The value that will be applied to the destination computer if either 1) the value for the source computer does not match SourceTable, or 2) DestinationTable has no equivalent value.

                        +

                        If DefaultValueOnError is NULL, the value will not be changed on the destination computer.

                        + + + +- **KeepExisting** + + You can use the KeepExisting function when there are conflicts on the destination computer. This function will keep (not overwrite) the specified attributes for the object that is on the destination computer. + + Syntax: KeepExisting("*OptionString*","*OptionString*","*OptionString*",…) + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        OptionString

                        Yes

                        OptionString can be Security, TimeFields, or FileAttrib:Letter. You can specify one of each type of OptionStrings. Do not specify multiple OptionStrings with the same value. If you do, the right-most option of that type will be kept. For example, do not specify ("FileAttrib:H", "FileAttrib:R") because only Read-only will be evaluated. Instead specify ("FileAttrib:HR") and both Hidden and Read-only attributes will be kept on the destination computer.

                        +
                          +

                        • Security. Keeps the destination object's security descriptor if it exists.

                          • +

                        • TimeFields. Keeps the destination object's time stamps. This parameter is for files only.

                          • +

                        • FileAttrib:Letter. Keeps the destination object's attribute value, either On or OFF, for the specified set of file attributes. This parameter is for files only. The following are case-insensitive, but USMT will ignore any values that are invalid, repeated, or if there is a space after "FileAttrib:". You can specify any combination of the following attributes:

                          +
                            +

                          • A = Archive

                            • +

                          • C = Compressed

                            • +

                          • E = Encrypted

                            • +

                          • H = Hidden

                            • +

                          • I = Not Content Indexed

                            • +

                          • O = Offline

                            • +

                          • R = Read-Only

                            • +

                          • S = System

                            • +

                          • T = Temporary

                            • +
                          • +
                        + + + +- **MergeMultiSzContent** + + The MergeMultiSzContent function merges the MULTI-SZ content of the registry values that are enumerated by the parent <ObjectSet> element with the content of the equivalent registry values that already exist on the destination computer. `Instruction` and `String` either remove or add content to the resulting MULTI-SZ. Duplicate elements will be removed. + + Syntax: MergeMultiSzContent (*Instruction*,*String*,*Instruction*,*String*,…) + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        Instruction

                        Yes

                        Can be one of the following:

                        +
                          +

                        • Add. Adds the corresponding String to the resulting MULTI-SZ if it is not already there.

                          • +

                        • Remove. Removes the corresponding String from the resulting MULTI-SZ.

                          • +

                        String

                        Yes

                        The string to be added or removed.

                        + + + +- **MergeDelimitedContent** + + The MergeDelimitedContent function merges the content of the registry values that are enumerated by the parent <ObjectSet> element with the content of the equivalent registry values that already exist on the destination computer. The content is considered a list of elements separated by one of the characters in the Delimiters parameter. Duplicate elements will be removed. + + Syntax: MergeDelimitedContent(*Delimiters*,*Instruction*,*String*,…) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        Delimiters

                        Yes

                        A single character that will be used to separate the content of the object that is being processed. The content will be considered as a list of elements that is separated by the Delimiters.

                        +

                        For example, "." will separate the string based on a period.

                        Instruction

                        Yes

                        Can one of the following:

                        +
                          +

                        • Add. Adds String to the resulting MULTI-SZ if it is not already there.

                          • +

                        • Remove. Removes String from the resulting MULTI-SZ.

                          • +

                        String

                        Yes

                        The string to be added or removed.

                        + + + +## <description> + + +The <description> element defines a description for the component but does not affect the migration. + +- **Number of occurrences:** zero or one + +- **Parent elements:**[<component>](#component) + +- **Child elements:** none + +Syntax: + +<description>*ComponentDescription*</description> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        ComponentDescription

                        Yes

                        The description of the component.

                        + + + +The following code sample shows how the <description> element defines the "My custom component" description.: + +``` xml +My custom component +``` + +## <destinationCleanup> + + +The <destinationCleanup> element deletes objects, such as files and registry keys, from the destination computer before applying the objects from the source computer. This element is evaluated only when the LoadState tool is run on the destination computer. That is, this element is ignored by the ScanState tool. + +**Important** +Use this option with extreme caution because it will delete objects from the destination computer. + + + +For each <destinationCleanup> element there can be multiple <objectSet> elements. A common use for this element is if there is a missing registry key on the source computer and you want to ensure that a component is migrated. In this case, you can delete all of the component's registry keys before migrating the source registry keys. This will ensure that if there is a missing key on the source computer, it will also be missing on the destination computer. + +- **Number of occurrences:** Unlimited + +- **Parent elements:**[<rules>](#rules) + +- **Child elements:**[<objectSet>](#objectset) (Note that the destination computer will delete all child elements.) + +Syntax: + +<destinationCleanup filter=*ScriptInvocation*> + +</destinationCleanup> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        filter

                        Yes

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        +

                        The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        + + + +For example: + +``` xml + + + HKCU\Software\Lotus\123\99.0\DDE Preferences\* [*] + HKCU\Software\Lotus\123\99.0\Find Preferences\* [*] + + +``` + +## <detect> + + +Although the <detect> element is still supported, we do not recommend using it because it may be deprecated in future versions of USMT. In that case, you would have to rewrite your scripts. Instead, we recommend that you use the [<detection>](#detection)**element.** + +You use the <detect> element to determine if the component is present on a system. If all child <detect> elements within a <detect> element resolve to TRUE, then the <detect> element resolves to TRUE. If any child <detect> elements resolve to FALSE, then their parent <detect> element resolves to FALSE. If there is no <detect> element section, then USMT will assume that the component is present. + +For each <detect> element there can be multiple child <condition> or <objectSet> elements, which will be logically joined by an OR operator. If at least one <condition> or <objectSet> element evaluates to TRUE, then the <detect> element evaluates to TRUE. + +- **Number of occurrences:** unlimited + +- **Parent elements:** <detects>, [<namedElements>](#namedelements) + +- **Required child elements:**[<condition>](#condition) + +- **Optional child elements:**[<objectSet>](#objectset) + +Syntax: + +<detect name="*ID*" context="User|System|UserAndSystem"> + +</detect> + + +++++ + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        name

                        Yes, when <detect> is a child to <namedElements>

                        +

                        No, when <detect> is a child to <detects>

                        When ID is specified, any child elements are not processed. Instead, any other <detect> elements with the same name that are declared within the <namedElements> element are processed.

                        context

                        No

                        +

                        (default = UserAndSystem)

                        Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.

                        +

                        The largest possible scope is set by the component element. For example, if a <component> element has a context of User, and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it had a context of User. If the <rules> element had a context of System, it would act as though the <rules> element were not there.

                        +
                          +

                        • User. Evaluates the variables for each user.

                          • +

                        • System. Evaluates the variables only once for the system.

                          • +

                        • UserAndSystem. Evaluates the variables for the entire operating system and each user.

                          • +
                        + + + +For examples, see the examples for [<detection>](#detection). + +## <detects> + + +Although the <detects> element is still supported, we recommend that you do not use it because it may be deprecated in future versions of USMT, which would require you to rewrite your scripts. Instead, we recommend that you use the [<detection>](#detection) element if the parent element is <role> or <namedElements>, and we recommend that you use the <conditions> element if the parent element is <rules>. Using <detection> allows you to more clearly formulate complex Boolean statements. + +The <detects> element is a container for one or more <detect> elements. If all of the child <detect> elements within a <detects> element resolve to TRUE, then <detects> resolves to TRUE. If any of the child <detect> elements resolve to FALSE, then <detects> resolves to FALSE. If you do not want to write the <detects> elements within a component, then you can create the <detects> element under the <namedElements> element, and then refer to it. If there is no <detects> element section, then USMT will assume that the component is present. The results from each <detects> element are joined together by the OR operator to form the rule used to detect the parent element. + +Syntax: + +<detects name="*ID*" context="User|System|UserAndSystem"> + +</detects> + +- **Number of occurrences:** Unlimited. + +- **Parent elements:**[<role>](#role), [<rules>](#rules), [<namedElements>](#namedelements) + +- **Required child elements:** <detect> + + +++++ + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        name

                        Yes, when <detects> is a child to <namedElements>

                        +

                        No, when <detects> is a child to <role> or <rules>

                        When ID is specified, no child <detect> elements are processed. Instead, any other <detects> elements with the same name that are declared within the <namedElements> element are processed.

                        context

                        No

                        +

                        (default = UserAndSystem)

                        Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.

                        +

                        The largest possible scope is set by the <component element>. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it had a context of User. If the <rules> element had a context of System, it would act as though the <rules> element were not there.

                        +
                          +

                        • User. Evaluates the variables for each user.

                          • +

                        • System. Evaluates the variables only once for the system.

                          • +

                        • UserAndSystem. Evaluates the variables for the entire operating system and each user.

                          • +
                        +

                        The context parameter is ignored for <detects> elements that are inside <rules> elements.

                        + + + +The following example is from the MigApp.xml file. + +``` xml + + + MigXmlHelper.DoesFileVersionMatch("%Lotus123InstPath%\123w.exe","ProductVersion","9.*") + + + MigXmlHelper.DoesFileVersionMatch("%SmartSuiteInstPath%\smartctr.exe","ProductVersion","99.*") + + +``` + +## <detection> + + +The <detection> element is a container for one <conditions> element. The result of the child <condition> elements, located underneath the <conditions> element, determines the result of this element. For example, if all of the child <conditions> elements within the <detection> element resolve to TRUE, then the <detection> element resolves to TRUE. If any of the child <conditions> elements resolve to FALSE, then the <detection> element resolves to FALSE. + +In addition, the results from each <detection> section within the <role> element are joined together by the OR operator to form the detection rule of the parent element. That is, if one of the <detection> sections resolves to TRUE, then the <role> element will be processed. Otherwise, the <role> element will not be processed. + +Use the <detection> element under the <namedElements> element if you do not want to write it within a component. Then include a matching <detection> section under the <role> element to control whether the component is migrated. If there is not a <detection> section for a component, then USMT will assume that the component is present. + +- **Number of occurrences:** Unlimited. + +- **Parent elements:**[<role>](#role), [<namedElements>](#namedelements) + +- **Child elements:**[<conditions>](#conditions) + +Syntax: + +<detection name="*ID*" context="User|System|UserAndSystem"> + +</detection> + + +++++ + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        name

                          +

                        • Yes, when <detection> is declared under <namedElements>

                          • +

                        • Optional, when declared under <role>

                          • +

                        If declared, the content of the <detection> element is ignored and the content of the <detection> element with the same name that is declared in the <namedElements> element will be evaluated.

                        context

                        No, default = UserAndSystem

                        Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.

                        +
                          +

                        • User. Evaluates the component for each user.

                          • +

                        • System. Evaluates the component only once for the system.

                          • +

                        • UserAndSystem. Evaluates the component for the entire operating system and each user.

                          • +
                        + + + +For example: + +``` xml + + + MigXmlHelper.DoesObjectExist("Registry","HKCU\Software\Adobe\Photoshop\8.0") + MigXmlHelper.DoesFileVersionMatch("%PhotoshopSuite8Path%\Photoshop.exe","FileVersion","8.*") + + +``` + +and + +``` xml + + + + MigXmlHelper.DoesFileVersionMatch("%QuickTime5Exe%","ProductVersion","QuickTime 5.*") + MigXmlHelper.DoesFileVersionMatch("%QuickTime5Exe%","ProductVersion","QuickTime 6.*") + + +``` + +## <displayName> + + +The <displayName> element is a required field within each <component> element. + +- **Number of occurrences:** once for each component + +- **Parent elements:**[<component>](#component) + +- **Child elements:** none + +Syntax: + +<displayName \_locID="*ID*">*ComponentName*</displayName> + + +++++ + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        locID

                        No

                        This parameter is for internal USMT use. Do not use this parameter.

                        ComponentName

                        Yes

                        The name for the component.

                        + + + +For example: + +``` xml +Command Prompt settings +``` + +## <environment> + + +The <environment> element is a container for <variable> elements in which you can define variables to use in your .xml file. All environment variables defined this way will be private. That is, they will be available only for their child components and the component in which they were defined. For two example scenarios, see [Examples](#envex). + +- **Number of occurrences:** unlimited + +- **Parent elements:**[<role>](#role), [<component>](#component), [<namedElements>](#namedelements) + +- **Required child elements:**[<variable>](#variable) + +- **Optional child elements:**[conditions](#conditions) + +Syntax: + +<environment name="ID" context="User|System|UserAndSystem"> + +</environment> + + +++++ + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        name

                        Yes, when <environment> is a child of <namedElements>

                        +

                        No, when <environment> is a child of <role> or <component>

                        When declared as a child of the <role> or <component> elements, if ID is declared, USMT ignores the content of the <environment> element and the content of the <environment> element with the same name declared in the <namedElements> element is processed.

                        context

                        No

                        +

                        (default = UserAndSystem)

                        Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.

                        +

                        The largest possible scope is set by the <component> element. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it had a context of User. If the <rules> element had a context of System, it would act as though <rules> were not there.

                        +
                          +

                        • User. Evaluates the variables for each user.

                          • +

                        • System. Evaluates the variables only once for the system.

                          • +

                        • UserAndSystem. Evaluates the variables for the entire operating system and each user.

                          • +
                        + + + +## + + +### Example scenario 1 + +In this scenario, you want to generate the location of objects at run time depending on the configuration of the destination computer. For example, you must do this if an application writes data in the directory where it is installed, and users can install the application anywhere on the computer. If the application writes a registry value hklm\\software\\companyname\\install \[path\] and then updates this value with the location where the application is installed, then the only way for you to migrate the required data correctly is to define an environment variable. For example: + +``` xml + + + + + +``` + +Then you can use an include rule as follows. You can use any of the [<script> functions](#scriptfunctions) to perform similar tasks. + +``` xml + + + %INSTALLPATH%\ [*.xyz] + + +``` + +Second, you can also filter registry values that contain data that you need. The following example extracts the first string (before the separator ",") in the value of the registry Hklm\\software\\companyname\\application\\ \[Path\]. + +``` xml + + + + + + Hklm\software\companyname\application\ [Path] + + + + + +``` + +### Example scenario 2: + +In this scenario, you want to migrate five files named File1.txt, File2.txt, and so on, from %SYSTEMDRIVE%\\data\\userdata\\dir1\\dir2\\. To do this you must have the following <include> rule in an .xml file: + +``` xml + + + %SYSTEMDRIVE%\data\userdata\dir1\dir2 [File1.txt] + %SYSTEMDRIVE%\data\userdata\dir1\dir2 [File2.txt] + %SYSTEMDRIVE%\data\userdata\dir1\dir2 [File3.txt] + %SYSTEMDRIVE%\data\userdata\dir1\dir2 [File4.txt] + %SYSTEMDRIVE%\data\userdata\dir1\dir2 [File5.txt] + + +``` + +Instead of typing the path five times, you can create a variable for the location as follows: + +``` xml + + + %SYSTEMDRIVE%\data\userdata\dir1\dir2 + + +``` + +Then, you can specify the variable in an <include> rule as follows: + +``` xml + + + %DATAPATH% [File1.txt] + %DATAPATH% [File2.txt] + %DATAPATH% [File3.txt] + %DATAPATH% [File4.txt] + %DATAPATH% [File5.txt] + + +``` + +## <exclude> + + +The <exclude> element determines what objects will not be migrated, unless there is a more specific <include> element that migrates an object. If there is an <include> and <exclude> element for the same object, the object will be included. For each <exclude> element there can be multiple child <objectSet> elements. + +- **Number of occurrences:** Unlimited + +- **Parent elements:**[<rules>](#rules) + +- **Child elements:**[<objectSet>](#objectset) + +- **Helper functions:** You can use the following [<exclude> filter functions](#persistfilterfunctions) with this element: CompareStringContent, IgnoreIrrelevantLinks, AnswerNo, NeverRestore, and SameRegContent. + +Syntax: + +<exclude filter="*ScriptInvocation*"> + +</exclude> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        filter

                        No

                        +

                        (default = No)

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        +

                        The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        + + + +For example, from the MigUser.xml file: + +``` xml + + + %CSIDL_MYMUSIC%\* [*] + %CSIDL_MYPICTURES%\* [*] + %CSIDL_MYVIDEO%\* [*] + + +``` + +## <excludeAttributes> + + +You can use the <excludeAttributes> element to determine which parameters associated with an object will not be migrated. If there are conflicts between the <includeAttributes> and <excludeAttributes> elements, the most specific pattern determines the patterns that will not be migrated. If an object does not have an <includeAttributes> or <excludeAttributes> element, then all of its parameters will be migrated. + +- **Number of occurrences:** Unlimited + +- **Parent elements:**[<rules>](#rules) + +- **Child elements:**[<objectSet>](#objectset) + +Syntax: + +<excludeAttributes attributes="Security|TimeFields|Security,TimeFields"> + +</excludeAttributes> + + +++++ + + + + + + + + + + + + + + +
                        ParameterRequired?Value

                        attributes

                        Yes

                        Specifies the attributes to be excluded. You can specify one of the following, or both separated by quotes; for example, "Security","TimeFields":

                        +
                          +

                        • Security can be one of Owner, Group, DACL, or SACL.

                          • +

                        • TimeFields can be one of CreationTime, LastAccessTime and LastWrittenTime

                          • +
                        + + + +Example: + +``` xml + + + + System Data + + + + + + %SYSTEMDRIVE%\ [*.txt] + + + + + + %SYSTEMDRIVE%\ [a*.txt] + + + + + + %SYSTEMDRIVE%\ [aa.txt] + + + + + + logoff + + + + + + + DOC + PPT + VXD + PST + CPP + + + +``` + +## <extensions> + + +The <extensions> element is a container for one or more <extension> elements. + +- **Number of occurrences:** zero or one + +- **Parent elements:**[<component>](#component) + +- **Required child elements:**[<extension>](#extension) + +Syntax: + +<extensions> + +</extensions> + +## <extension> + + +You can use the <extension> element to specify documents of a specific extension. + +- **Number of occurrences:** unlimited + +- **Parent elements:**[<extensions>](#extensions) + +- **Child elements:** none + +Syntax: + +<extension>*FilenameExtension*</extension> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        FilenameExtension

                        Yes

                        A file name extension.

                        + + + +For example, if you want to migrate all \*.doc files from the source computer, specifying the following code under the <component> element: + +``` xml + + doc + +``` + +is the same as specifying the following code below the <rules> element: + +``` xml + + + + + +``` + +For another example of how to use the <extension> element, see the example for [<excludeAttributes>](#excludeattributes). + +## <externalProcess> + + +You can use the <externalProcess> element to run a command line during the migration process. For example, you may want to run a command after the LoadState process completes. + +- **Number of occurrences:** Unlimited + +- **Parent elements:**[<rules>](#rules) + +- **Required child elements:**[<commandLine>](#commandline) + +Syntax: + +<externalProcess when="pre-scan|scan-success|post-scan|pre-apply|apply-success|post-apply"> + +</externalProcess> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        when

                        Yes

                        Indicates when the command line should be run. This value can be one of the following:

                        +
                          +

                        • pre-scan before the scanning process begins.

                          • +

                        • scan-success after the scanning process has finished successfully.

                          • +

                        • post-scan after the scanning process has finished, whether it was successful or not.

                          • +

                        • pre-apply before the apply process begins.

                          • +

                        • apply-success after the apply process has finished successfully.

                          • +

                        • post-apply after the apply process has finished, whether it was successful or not.

                          • +
                        + + + +For an example of how to use the <externalProcess> element, see the example for [<excludeAttributes>](#excludeattributes). + +## <icon> + + +This is an internal USMT element. Do not use this element. + +## <include> + + +The <include> element determines what to migrate, unless there is a more specific [<exclude>](#exclude) rule. You can specify a script to be more specific to extend the definition of what you want to collect. For each <include> element there can be multiple <objectSet> elements. + +- **Number of occurrences:** Unlimited + +- **Parent elements:**[<rules>](#rules) + +- **Required child element:**[<objectSet>](#objectset) + +- **Helper functions:** You can use the following [<include> filter functions](#persistfilterfunctions) with this element: CompareStringContent, IgnoreIrrelevantLinks, AnswerNo, and NeverRestore. + +Syntax: + +<include filter="*ScriptInvocation*"> + +</include> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        filter

                        No.

                        +

                        If this parameter is not specified, then all patterns that are inside the child <ObjectSet> element will be processed.

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        +

                        The script will be called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        + + + +The following example is from the MigUser.xml file: + +``` xml + + My Video + + %CSIDL_MYVIDEO% + + + + + MigXmlHelper.DoesObjectExist("File","%CSIDL_MYVIDEO%") + + + + + + %CSIDL_MYVIDEO%\* [*] + + + + + %CSIDL_MYVIDEO% [desktop.ini] + + + + + +``` + +### <include> and <exclude> filter functions + +The following functions return a Boolean value. You can use them to migrate certain objects based on when certain conditions are met. + +- **AnswerNo** + + This filter always returns FALSE. + + Syntax: AnswerNo () + +- **CompareStringContent** + + Syntax: CompareStringContent("*StringContent*","*CompareType*") + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        StringContent

                        Yes

                        The string to check against.

                        CompareType

                        Yes

                        A string. Use one of the following values:

                        +
                          +

                        • Equal (case insensitive). The function returns TRUE if the string representation of the current object that is processed by the migration engine is identical to StringContent.

                          • +

                        • NULL or any other value. The function returns TRUE if the string representation of the current object that is processed by the migration engine does not match StringContent.

                          • +
                        + + + +- **IgnoreIrrelevantLinks** + + This filter screens out the .lnk files that point to an object that is not valid on the destination computer. Note that the screening takes place on the destination computer, so all .lnk files will be saved to the store during ScanState. Then they will be screened out when you run the LoadState tool. + + Syntax: IgnoreIrrelevantLinks () + + For example: + + ``` xml + + + %CSIDL_COMMON_VIDEO%\* [*] + + + ``` + +- **NeverRestore** + + You can use this function to collect the specified objects from the source computer but then not migrate the objects to the destination computer. When run with the ScanState tool, this function evaluates to TRUE. When run with the LoadState tool, this function evaluates to FALSE. You may want to use this function when you want to check an object's value on the destination computer but do not intend to migrate the object to the destination. + + Syntax: NeverRestore() + + In the following example, HKCU\\Control Panel\\International \[Locale\] will be included in the store, but it will not be migrated to the destination computer: + + ``` xml + + + HKCU\Control Panel\International [Locale] + + + ``` + +## <includeAttributes> + + +You can use the <includeAttributes> element to determine whether certain parameters associated with an object will be migrated along with the object itself. If there are conflicts between the <includeAttributes> and <excludeAttributes> elements, the most specific pattern will determine which parameters will be migrated. If an object does not have an <includeAttributes> or <excludeAttributes> element, then all of its parameters will be migrated. + +- **Number of occurrences:** unlimited + +- **Parent elements:**[<rules>](#rules) + +- **Child elements:**[<objectSet>](#objectset) + +Syntax: + +<includeAttributes attributes="Security|TimeFields|Security,TimeFields"> + +</includeAttributes> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        attributes

                        Yes

                        Specifies the attributes to be included with a migrated object. You can specify one of the following, or both separated by quotes; for example, "Security","TimeFields":

                        +
                          +

                        • Security can be one of the following values:

                          +
                            +

                          • Owner. The owner of the object (SID).

                            • +

                          • Group. The primary group for the object (SID).

                            • +

                          • DACL (discretionary access control list). An access control list that is controlled by the owner of an object and that specifies the access particular users or groups can have to the object.

                            • +

                          • SACL (system access control list). An ACL that controls the generation of audit messages for attempts to access a securable object. The ability to get or set an object's SACL is controlled by a privilege typically held only by system administrators.

                            • +
                          • +

                        • TimeFields can be one of the following:

                          +
                            +

                          • CreationTime. Specifies when the file or directory was created.

                            • +

                          • LastAccessTime. Specifies when the file is last read from, written to, or, in the case of executable files, run.

                            • +

                          • LastWrittenTime. Specifies when the file is last written to, truncated, or overwritten.

                            • +
                          • +
                        + + + +For an example of how to use the <includeAttributes> element, see the example for [<excludeAttributes>](#excludeattributes). + +## <library> + + +This is an internal USMT element. Do not use this element. + +## <location> + + +The <location> element defines the location of the <object> element. + +- **Number of occurrences:** once for each <object> + +- **Parent elements:**[<object>](#object) + +- **Child elements:**[<script>](#script) + +Syntax: + +<location type="*typeID*">*ObjectLocation*</location> + + +++++ + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        type

                        Yes

                        typeID can be Registry or File.

                        ObjectLocation

                        Yes

                        The location of the object.

                        + + + +The following example is from the MigApp.xml file: + +``` xml + + + %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] + DWORD + 0B000000 + + + %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] + DWORD + 00000000 + + +``` + +## <locationModify> + + +You can use the <locationModify> element to change the location and name of an object before it is migrated to the destination computer. The <locationModify> element is processed only when the LoadState tool is run on the destination computer. In other words, this element is ignored by the ScanState tool. The <locationModify> element will create the appropriate folder on the destination computer if it does not already exist. + +**Number of occurrences:** Unlimited + +- **Parent elements:**[<rules>](#rules) + +- **Required child element:**[<objectSet>](#objectset) + +- **Helper functions:** You can use the following [<locationModify> functions](#locationmodifyfunctions) with this element: ExactMove, RelativeMove, and Move. + +Syntax: + +<locationModify script="*ScriptInvocation*"> + +</locationModify> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        script

                        Yes

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        +

                        The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        + + + +The following example is from the MigApp.xml file: + +``` xml + + + %CSIDL_APPDATA%\Microsoft\Office\ [Access10.pip] + + +``` + +### <locationModify> functions + +The following functions change the location of objects as they are migrated when using the <locationModify> element. These functions are called for every object that the parent <ObjectSet> element is enumerating. The <locationModify> element will create the appropriate folder on the destination computer if it does not already exist. + +- **ExactMove** + + The ExactMove function moves all of the objects that are matched by the parent <ObjectSet> element into the given *ObjectEncodedLocation*. You can use this function when you want to move a single file to a different location on the destination computer. If the destination location is a node, all of the matching source objects will be written to the node without any subdirectories. If the destination location is a leaf, the migration engine will migrate all of the matching source objects to the same location. If a collision occurs, the normal collision algorithms will apply. + + Syntax: ExactMove(*ObjectEncodedLocation*) + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        ObjectEncodedLocation

                        Yes

                        The destination location for all of the source objects.

                        + + + +~~~ +For example: + +``` xml + + + HKCU\Keyboard Layout\Toggle [] + + +``` +~~~ + +- **Move** + + The Move function moves objects to a different location on the destination computer. In addition, this function creates subdirectories that were above the longest CSIDL in the source object name. + + Syntax: Move(*DestinationRoot*) + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        DestinationRoot

                        Yes

                        The location where the source objects will be moved. If needed, this function will create any subdirectories that were above the longest CSIDL in the source object name.

                        + + + +- **RelativeMove** + + You can use the RelativeMove function to collect and move data. Note that you can use environment variables in source and destination roots, but they may be defined differently on the source and destination computers. + + Syntax: RelativeMove(*SourceRoot*,*DestinationRoot*) + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        SourceRoot

                        Yes

                        The location from where the objects will be moved. Any source objects that are enumerated by the parent <ObjectSet> element that are not in this location will not be moved.

                        DestinationRoot

                        Yes

                        The location where the source objects will be moved to on the destination computer. If needed, this function will create any subdirectories that were above SourceRoot.

                        + + + +~~~ +For example: + +``` xml + + + %CSIDL_COMMON_FAVORITES%\* [*] + + + + + %CSIDL_COMMON_FAVORITES%\* [*] + + +``` +~~~ + +## <\_locDefinition> + + +This is an internal USMT element. Do not use this element. + +## <manufacturer> + + +The <manufacturer> element defines the manufacturer for the component, but does not affect the migration. + +- **Number of occurrences:** zero or one + +- **Parent elements:**[<component>](#component) + +- **Child elements:** none + +Syntax: + +<manufacturer>*Name*</manufacturer> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        Name

                        Yes

                        The name of the manufacturer for the component.

                        + + + +## <merge> + + +The <merge> element determines what will happen when a collision occurs. A collision is when an object that is migrated is already present on the destination computer. If you do not specify this element, the default behavior for the registry is for the source object to overwrite the destination object. The default behavior for files is for the source file to be renamed to "OriginalFileName(1).OriginalExtension". This element specifies only what should be done when a collision occurs. It does not include objects. Therefore, for your objects to migrate, you must specify <include> rules along with the <merge> element. When an object is processed and a collision is detected, USMT will select the most specific merge rule and apply it to resolve the conflict. For example, if you have a <merge> rule C:\\\* \[\*\] set to <sourcePriority> and a <merge> rule C:\\subfolder\\\* \[\*\] set to <destinationPriority>, then USMT would use the <destinationPriority> rule because it is the more specific. + +For an example of this element, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + +- **Number of occurrences:** Unlimited + +- **Parent elements:**[<rules>](#rules) + +- **Required child element:**[<objectSet>](#objectset) + +- **Helper functions:** You can use the following [<merge> functions](#mergefunctions) with this element: SourcePriority, DestinationPriority, FindFilePlaceByPattern, LeafPattern, NewestVersion, HigherValue(), and LowerValue(). + +Syntax: + +<merge script="*ScriptInvocation*"> + +</merge> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        script

                        Yes

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        +

                        The script will be called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        + + + +The following example is from the MigUser.xml file: + +``` xml + + + + %CSIDL_MYVIDEO%\* [*] + + + + + %CSIDL_MYVIDEO% [desktop.ini] + + + +``` + +### <merge> functions + +These functions control how collisions are resolved. + +- **DestinationPriority** + + Specifies to keep the object that is on the destination computer and not migrate the object from the source computer. + + For example: + + ``` xml + + + HKCU\Software\Microsoft\Office\9.0\PhotoDraw\ [MyPictures] + HKCU\Software\Microsoft\Office\9.0\PhotoDraw\Settings\ [PicturesPath] + HKCU\Software\Microsoft\Office\9.0\PhotoDraw\Settings\ [AdditionalPlugInPath] + + + ``` + +- **FindFilePlaceByPattern** + + The FindFilePlaceByPattern function saves files with an incrementing counter when a collision occurs. It is a string that contains one of each constructs: <F>, <E>, <N> in any order. + + Syntax: FindFilePlaceByPattern(*FilePattern*) + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        FilePattern

                        Yes

                          +

                        • <F> will be replaced by the original file name.

                          • +

                        • <N> will be replaced by an incrementing counter until there is no collision with the objects on the destination computer.

                          • +

                        • <E> will be replaced by the original file name extension.

                          • +
                        +

                        For example, <F> (<N>).<E> will change the source file MyDocument.doc into MyDocument (1).doc on the destination computer.

                        + + + +- **NewestVersion** + + The NewestVersion function will resolve conflicts on the destination computer based on the version of the file. + + Syntax: NewestVersion(*VersionTag*) + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        VersionTag

                        Yes

                        The version field that will be checked. This can be "FileVersion" or "ProductVersion". The file with the highest VersionTag version determines which conflicts will be resolved based on the file's version. For example, if Myfile.txt contains FileVersion 1 and the same file on the destination computer contains FileVersion 2, the file on destination will remain.

                        + + + +- **HigherValue()** + + You can use this function for merging registry values. The registry values will be evaluated as numeric values, and the one with the higher value will determine which registry values will be merged. + +- **LowerValue()** + + You can use this function for merging registry values. The registry values will be evaluated as numeric values and the one with the lower value will determine which registry values will be merged. + +- **SourcePriority** + + Specifies to migrate the object from the source computer, and to delete the object that is on the destination computer. + + For example: + + ``` xml + + + %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Publisher [UpgradeVersion] + %HklmWowSoftware%\Microsoft\Office\11.0\Common\Migration\Publisher [UpgradeVersion] + %HklmWowSoftware%\Microsoft\Office\10.0\Common\Migration\Publisher [UpgradeVersion] + + + ``` + +## <migration> + + +The <migration> element is the single root element of a migration .xml file and is required. Each .xml file must have a unique migration urlid. The urlid of each file that you specify on the command line must be unique. This is because USMT uses the urlid to define the components within the file. For example, you must specify the following at the beginning of each file: <CustomFileName> is the name of the file; for example, "CustomApp". + +- **Number of occurrences:** one + +- **Parent elements:** none + +- **Required child elements:**[<component>](#component) + +- **Optional child elements:**[<library>](#library), [<namedElements>](#namedelements) + +Syntax: + +<migration urlid="UrlID/Name"> + +</migration> + + +++++ + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        urlid

                        Yes

                        UrlID is a string identifier that uniquely identifies this .xml file. This parameter must be a no-colon-name as defined by the XML Namespaces specification. Each migration .xml file must have a unique urlid. If two migration .xml files have the same urlid, the second .xml file that is specified on the command line will not be processed. For more information about XML Namespaces, see Use XML Namespaces.

                        Name

                        No

                        Although not required, it is good practice to use the name of the .xml file.

                        + + + +The following example is from the MigApp.xml file: + +``` xml + + +``` + +## MigXMLHelper.FileProperties + + +This filter helper function can be used to filter the migration of files based on file size and date attributes. + + ++++ + + + + + + + + + + + + + + + + + + + + +
                        Helper FunctionMigXMLHelper.FileProperties (property, operator, valueToCompare)

                        Property

                        filesize, dateCreated, dateModified, dateAccessed

                        Operator

                        range, neq, lte, lt, eq, gte, gt

                        valueToCompare

                        The value we are comparing. For example:

                        +

                        Date: “2008/05/15-2005/05/17”, “2008/05/15”

                        +

                        Size: A numeral with B, KB, MB, or GB at the end. “5GB”, “1KB-1MB”

                        + + + +``` xml + +File_size + + + + + + %SYSTEMDRIVE%\DOCS\* [*] + + + + + +``` + +## <namedElements> + + +You can use the **<namedElements>** element to define named elements. You can use these elements in any component throughout your .xml file. For an example of how to use this element, see the MigApp.xml file. + +Syntax: + +<namedElements> + +</namedElements> + +- **Number of occurrences:** Unlimited + +- **Parent elements:**[<migration>](#migration) + +- **Child elements:**[<environment>](#bkmk-environment), [<rules>](#rules), [<conditions>](#conditions), [<detection>](#detection), <detects>, <detect> + +For an example of this element, see the MigApp.xml file. + +## <object> + + +The <object> element represents a file or registry key. + +- **Number of occurrences:** Unlimited + +- **Parent elements:**[<addObjects>](#addobjects) + +- **Required child elements:**[<location>](#location), [<attributes>](#attribute) + +- **Optional child elements:**[<bytes>](#bytes) + +Syntax: + +<object> + +</object> + +The following example is from the MigApp.xml file: + +``` xml + + + %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] + DWORD + 0B000000 + + + %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] + DWORD + 00000000 + + +``` + +## <objectSet> + + +The <objectSet> element contains a list of object patterns ; for example, file paths, registry locations, and so on. Any child <conditions> elements will be evaluated first. If all child <conditions> elements return FALSE, the <objectSet> element will evaluate to an empty set. For each parent element, there can be only multiple <objectSet> elements. + +- **Number of occurrences:** Unlimited + +- **Parent elements:**[<variable>](#variable), [<content>](#content), [<include>](#include), [<exclude>](#exclude), [<merge>](#merge), [<contentModify>](#contentmodify), [<locationModify>](#locationmodify), [<destinationCleanup>](#destinationcleanup), [<includeAttributes>](#includeattributes), [<excludeAttributes>](#excludeattributes), [<unconditionalExclude>](#unconditionalexclude), <detect> + +- **Required child elements:** either [<script>](#script) or [<pattern>](#pattern) + +- **Optional child elements:**[<content>](#content), [conditions](#conditions), <condition> + +Syntax: + +<objectSet> + +</objectSet> + +The following example is from the MigUser.xml file: + +``` xml + + My Music + + %CSIDL_MYMUSIC% + + + + + MigXmlHelper.DoesObjectExist("File","%CSIDL_MYMUSIC%") + + + + + + %CSIDL_MYMUSIC%\* [*] + + + + + %CSIDL_MYMUSIC%\ [desktop.ini] + + + + + +``` + +## <path> + + +This is an internal USMT element. Do not use this element. + +## <paths> + + +This is an internal USMT element. Do not use this element. + +## <pattern> + + +You can use this element to specify multiple objects. You can specify multiple <pattern> elements for each <objectSet> element and they will be combined. If you are specifying files, you may want to use GenerateDrivePatterns with <script> instead. GenerateDrivePatterns is basically the same as a <pattern> rule, without the drive letter specification. For example, the following two lines of code are similar: + +``` xml +C:\Folder\* [Sample.doc] + +``` + +- **Number of occurrences:** Unlimited + +- **Parent elements:**[<objectSet>](#objectset) + +- **Child elements:** none but *Path* \[*object*\] must be valid. + +Syntax: + +<pattern type="*typeID*">*Path* \[*object*\]</pattern> + + +++++ + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        type

                        Yes

                        typeID can be Registry, File, or Ini. If typeId is Ini, then you cannot have a space between Path and object. For example, the following is correct when type="Ini":

                        +

                        <pattern type="Ini">%WinAmp5InstPath%\Winamp.ini|WinAmp[keeponscreen]</pattern>

                        Path [object]

                        Yes

                        A valid registry or file path pattern, followed by at least one space, followed by brackets [] that contain the object to be migrated.

                        +
                          +

                        • Path can contain the asterisk () wildcard character or can be an Recognized Environment Variables. You cannot use the question mark as a wildcard character.You can use HKCU and HKLM to refer to HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE respectively.

                          • +

                        • Object can contain the asterisk () wildcard character. However, you cannot use the question mark as a wildcard character. For example:

                          +

                          C:\Folder\ [] enumerates all files in C:<em>Path but no subfolders of C:\Folder.

                          +

                          C:\Folder* [] enumerates all files and subfolders of C:\Folder.

                          +

                          C:\Folder\ [*.mp3] enumerates all .mp3 files in C:\Folder.

                          +

                          C:\Folder\ [Sample.doc] enumerates only the Sample.doc file located in C:\Folder.

                          +
                          +Note

                          If you are migrating a file that has a square bracket character ([ or ]) in the file name, you must insert the carrot (^) character directly before the bracket for it to be valid. For example, if there is a file named "file].txt", you must specify <pattern type="File">c:\documents\mydocs [file^].txt]</pattern> instead of <pattern type="File">c:\documents\mydocs [file].txt]</pattern>.

                          +
                          +
                          + +
                          • +
                        + + + +For example: + +- To migrate a single registry key: + + ``` xml + HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache [Persistent] + ``` + +- To migrate the EngineeringDrafts folder and any subfolders from the C: drive: + + ``` xml + C:\EngineeringDrafts\* [*] + ``` + +- To migrate only the EngineeringDrafts folder, excluding any subfolders, from the C: drive: + + [Reroute Files and Settings](usmt-reroute-files-and-settings.md) + +- To migrate the Sample.doc file from C:\\EngineeringDrafts: + + ``` xml + C:\EngineeringDrafts\ [Sample.doc] + ``` + +- To migrate the Sample.doc file from where ever it exists on the C: drive use pattern in the following way. If multiple files exist with the same name on the C: drive, then all of these files will be migrated. + + ``` xml + C:\* [Sample.doc] + ``` + +- For more examples of how to use this element, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md), [Reroute Files and Settings](usmt-reroute-files-and-settings.md), [Include Files and Settings](usmt-include-files-and-settings.md), and [Custom XML Examples](usmt-custom-xml-examples.md). + +## <processing> + + +You can use this element to run a script during a specific point within the migration process. Return values are not expected from the scripts that you specify, and if there are return values, they will be ignored. + +- **Number of occurrences:** unlimited + +- **Parent elements:**[<rules>](#rules) + +- **Required child element:**[<script>](#script) + +Syntax: + +<processing when="pre-scan|scan-success|post-scan|pre-apply|apply-success|post-apply"> + +</processing> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        when

                        Yes

                        Indicates when the script should be run. This value can be one of the following:

                        +
                          +

                        • pre-scan means before the scanning process begins.

                          • +

                        • scan-success means after the scanning process has finished successfully.

                          • +

                        • post-scan means after the scanning process has finished, whether it was successful or not.

                          • +

                        • pre-apply means before the apply process begins.

                          • +

                        • apply-success means after the apply process has finished successfully.

                          • +

                        • post-apply means after the apply process has finished, whether it was successful or not.

                          • +
                        + + + +## <plugin> + + +This is an internal USMT element. Do not use this element. + +## <role> + + +The <role> element is required in a custom .xml file. By specifying the <role> element, you can create a concrete component. The component will be defined by the parameters specified at the <component> level, and with the role that you specify here. + +- **Number of occurrences:** Each <component> can have one, two or three child <role> elements. + +- **Parent elements:**[<component>](#component), [<role>](#role) + +- **Required child elements:**[<rules>](#rules) + +- **Optional child elements:**[<environment>](#bkmk-environment), [<detection>](#detection), [<component>](#component), [<role>](#role), <detects>, <plugin>, + +Syntax: + +<role role="Container|Binaries|Settings|Data"> + +</role> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        role

                        Yes

                        Defines the role for the component. Role can be one of:

                        +
                          +

                        • Container

                          • +

                        • Binaries

                          • +

                        • Settings

                          • +

                        • Data

                          • +
                        +

                        You can either:

                        +
                          +

                        1. Specify up to three <role> elements within a <component> — one “Binaries” role element, one “Settings” role element and one “Data” role element. These parameters do not change the migration behavior — their only purpose is to help you categorize the settings that you are migrating. You can nest these <role> elements, but each nested element must be of the same role parameter.

                          2. +

                        2. Specify one “Container” <role> element within a <component> element. In this case, you cannot specify any child <rules> elements, only other <component> elements. And each child <component> element must have the same type as that of parent <component> element. For example:

                          3. +
                        +
                        <component context="UserAndSystem" type="Application">
+  <displayName _locID="migapp.msoffice2003">Microsoft Office 2003</displayName> 
+  <environment name="GlobalEnv" /> 
+  <role role="Container">
+    <detection name="AnyOffice2003Version" /> 
+    <detection name="FrontPage2003" /> 
+    <!-- 
+ Office 2003 Common Settings 
+  --> 
+    <component context="UserAndSystem" type="Application">
                        + + + +The following example is from the MigUser.xml file. For more examples, see the MigApp.xml file: + +``` xml + + Start Menu + + %CSIDL_STARTMENU% + + + + + MigXmlHelper.DoesObjectExist("File","%CSIDL_STARTMENU%") + + + + + + %CSIDL_STARTMENU%\* [*] + + + + + %CSIDL_STARTMENU% [desktop.ini] + %CSIDL_STARTMENU%\* [*] + + + + + +``` + +## <rules> + + +The <rules> element is required in a custom .xml file. This element contains rules that will run during the migration if the parent <component> element is selected, unless the child <conditions> element, if present, evaluates to FALSE. For each <rules> element there can be multiple child <rules> elements. + +- **Number of occurrences:** unlimited + +- **Parent elements:**[<role>](#role), [<rules>](#rules), [<namedElements>](#namedelements) + +- **Required child elements:**[<include>](#include) + +- **Optional child elements:**[<rules>](#rules), [<exclude>](#exclude), [<unconditionalExclude>](#unconditionalexclude),[<merge>](#merge), [<contentModify>](#contentmodify), [<locationModify>](#locationmodify), [<destinationCleanup>](#destinationcleanup), [<addObjects>](#addobjects), [<externalProcess>](#externalprocess), [<processing>](#processing), [<includeAttributes>](#includeattributes), [<excludeAttributes>](#excludeattributes), [conditions](#conditions), <detects> + +Syntax: + +<rules name="*ID*" context="User|System|UserAndSystem"> + +</rules> + + +++++ + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        name

                        Yes, when <rules> is a child to <namedElements>

                        +

                        No, when <rules> is a child to any other element

                        When ID is specified, any child elements are not processed. Instead, any other <rules> elements with the same name that are declared within <namedElements> are processed.

                        context

                        No

                        +

                        (default = UserAndSystem)

                        Defines the scope of this parameter — whether to process this component in the context of the specific user, across the entire operating system, or both.

                        +

                        The largest possible scope is set by the component element. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it has a context of User. If <rules> had a context of System, it would act as though <rules> was not there.

                        +
                          +

                        • User. Evaluates the variables for each user.

                          • +

                        • System. Evaluates the variables only once for the system.

                          • +

                        • UserAndSystem. Evaluates the variables for the entire operating system and each user.

                          • +
                        + + + +The following example is from the MigUser.xml file: + +``` xml + + My Music + + %CSIDL_MYMUSIC% + + + + + MigXmlHelper.DoesObjectExist("File","%CSIDL_MYMUSIC%") + + + + + + %CSIDL_MYMUSIC%\* [*] + + + + + %CSIDL_MYMUSIC%\ [desktop.ini] + + + + + +``` + +## <script> + + +The return value that is required by <script> depends on the parent element. + +**Number of occurrences:** Once for [<variable>](#variable), unlimited for [<objectSet>](#objectset) and [<processing>](#processing) + +**Parent elements:**[<objectSet>](#objectset), [<variable>](#variable), [<processing>](#processing) + +**Child elements:** none + +**Syntax and helper functions:** + +- General Syntax: <script>*ScriptWithArguments*</script> + +- You can use [GetStringContent](#scriptfunctions) when <script> is within <variable>. + + Syntax: <script>MigXmlHelper.GetStringContent("*ObjectType*","*EncodedLocationPattern*", "*ExpandContent*")</script> + + Example: `` + +- You can use [GenerateUserPatterns](#scriptfunctions) when <script> is within <objectSet>. + + Syntax: <script>MigXmlHelper.GenerateUserPatterns("*ObjectType*","*EncodedLocationPattern*","*ProcessCurrentUser*")</script> + + Example: `` + +- You can use [GenerateDrivePatterns](#scriptfunctions) when <script> is within <objectSet>. + + Syntax: <script>MigXmlHelper.GenerateDrivePatterns("*PatternSegment*","*DriveType*")</script> + + Example: `` + +- You can use the [Simple executing scripts](#scriptfunctions) with <script> elements that are within <processing> elements: AskForLogoff, ConvertToShortFileName, KillExplorer, RemoveEmptyDirectories, RestartExplorer, RegisterFonts, StartService, StopService, SyncSCM. + + Syntax: <script>MigXmlHelper.*ExecutingScript*</script> + + Example: `` + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        ScriptWithArguments

                        Yes

                        A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

                        +

                        The script will be called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

                        +

                        The return value that is required by <script> depends on the parent element.

                        +
                          +

                        • When used within <variable>, the return value must be a string.

                          • +

                        • When used within <objectSet>, the return value must be a two-dimensional array of strings.

                          • +

                        • When used within <location>, the return value must be a valid location that aligns with the type attribute of <location>. For example, if <location type="File">, the child script element, if specified, must be a valid file location.

                          +
                          +Note

                          If you are migrating a file that has a bracket character ([ or ]) in the file name, insert the carrot (^) character directly before the bracket for it to be valid. For example, if there is a file named "file].txt", specify <pattern type="File">c:\documents\mydocs [file^].txt]</pattern> instead of <pattern type="File">c:\documents\mydocs [file].txt]</pattern>.

                          +
                          +
                          + +
                          • +
                        + + + +Examples: + +To migrate the Sample.doc file from any drive on the source computer, use <script> as follows. If multiple files exist with the same name, all such files will get migrated. + +``` xml + +``` + +For more examples of how to use this element, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md), [Reroute Files and Settings](usmt-reroute-files-and-settings.md), and [Custom XML Examples](usmt-custom-xml-examples.md). + +### <script> functions + +You can use the following functions with the <script> element + +- [String and pattern generating functions](#stringgeneratingfunctions) + +- [Simple executing scripts](#simple) + +### String and pattern generating functions + +These functions return either a string or a pattern. + +- **GetStringContent** + + You can use GetStringContent with <script> elements that are within <variable> elements. If possible, this function returns the string representation of the given object. Otherwise, it returns NULL. For file objects this function always returns NULL. + + Syntax: GetStringContent("*ObjectType*","*EncodedLocationPattern*", "*ExpandContent*") + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        ObjectType

                        Yes

                        The type of object. Can be Registry or Ini (for an .ini file).

                        EncodedLocationPattern

                        Yes

                          +

                        • If type of object is Registry, EncodedLocationPattern must be a valid registry path. For example, HKLM\SOFTWARE\MyKey[].

                          • +

                        • If the type of object is Ini, then EncodedLocationPattern must be in the following format:

                          +

                          IniFilePath|SectionName[SettingName]

                          • +

                        ExpandContent

                        No (default=TRUE)

                        Can be TRUE or FALSE. If FALSE, then the given location will not be expanded before it is returned.

                        + + + +~~~ +For example: + +``` xml + + + +``` +~~~ + +- **GenerateDrivePatterns** + + The GenerateDrivePatterns function will iterate all of the available drives and select the ones that match the requested drive type. It will then concatenate the selected drives with the end part of *PatternSegment* to form a full encoded file pattern. For example, if *PatternSegment* is `Path [file.txt]` and DriveType is `Fixed`, then the function will generate `C:\Path [file.txt]`, and other patterns if there are fixed drives other than C:. You cannot specify environment variables with this function. You can use GenerateDrivePatterns with <script> elements that are within [<objectSet>](#objectset) that are within <include>/<exclude>. + + Syntax: GenerateDrivePatterns("*PatternSegment*","*DriveType*") + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        PatternSegment

                        Yes

                        The suffix of an encoded pattern. It will be concatenated with a drive specification, such as "c:&quot;, to form a complete encoded file pattern. For example, "* [*.doc]". PatternSegment cannot be an environment variable.

                        DriveType

                        Yes

                        The drive type for which the patterns are to be generated. You can specify one of:

                        +
                          +

                        • Fixed

                          • +

                        • CDROM

                          • +

                        • Removable

                          • +

                        • Remote

                          • +
                        + + + +~~~ +See the last component in the MigUser.xml file for an example of this element. +~~~ + +- **GenerateUserPatterns** + + The function will iterate through all users that are being migrated, excluding the currently processed user if <ProcessCurrentUser> is FALSE, and will expand the specified pattern in the context of each user. For example, if users A, B and C have profiles in C:\\Documents and Settings), by calling `GenerateUserPattens('File','%userprofile% [*.doc]','TRUE')`, the helper function will generate the following three patterns: + + - "C:\\Documents and Settings\\A\\\* \[\*.doc\]" + + - "C:\\Documents and Settings\\B\\\* \[\*.doc\]" + + - "C:\\Documents and Settings\\C\\\* \[\*.doc\]" + + Syntax:GenerateUserPatterns("*ObjectType*","*EncodedLocationPattern*","*ProcessCurrentUser*") + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        ObjectType

                        Yes

                        Defines the object type. Can be File or Registry.

                        EncodedLocationPattern

                        Yes

                        The location pattern. Environment variables are allowed.

                        ProcessCurrentUser

                        Yes

                        Can be TRUE or FALSE. Indicates if the patterns should be generated for the current user.

                        + + + +~~~ +**Example:** + +If GenerateUserPattens('File','%userprofile% \[\*.doc\]','FALSE') is called while USMT is processing user A, then this function will only generate patterns for users B and C. You can use this helper function to build complex rules. For example, to migrate all .doc files from the source computer — but if user X is not migrated, then do not migrate any of the .doc files from user X’s profile. + +The following is example code for this scenario. The first <rules> element migrates all.doc files on the source computer with the exception of those inside C:\\Documents and Settings. The second <rules> elements will migrate all .doc files from C:\\Documents and Settings with the exception of the .doc files in the profiles of the other users. Because the second <rules> element will be processed in each migrated user context, the end result will be the desired behavior. The end result is the one we expected. + +``` xml + + + + + + + + + %ProfilesFolder%\* [*.doc] + + + + + + + %ProfilesFolder%\* [*.doc] + + + + + + + + +``` +~~~ + +### MigXmlHelper.GenerateDocPatterns + +This helper function invokes the document finder to scan the system for all files that can be migrated. It can be invoked in either System or User context to focus the scan. + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        ScanProgramFiles

                        No (default = FALSE)

                        Can be TRUE or FALSE. The ScanProgramFiles parameter determines whether or not the document finder scans the Program Files directory to gather registered file extensions for known applications. For example, when set to TRUE it will discover and migrate .jpg files under the Photoshop directory, if .jpg is a file extension registered to Photoshop.

                        IncludePatterns

                        No (default = TRUE)

                        Can be TRUE or FALSE. TRUE will generate include patterns and can be added under the <include> element. FALSE will generate exclude patterns and can be added under the <exclude> element.

                        SystemDrive

                        No (default = FALSE)

                        Can be TRUE or FALSE. If TRUE, restricts all patterns to the system drive.

                        + + + +``` xml + + + MigDocUser + + + + + + + + + + + + + + + +``` + +### Simple executing scripts + +The following scripts have no return value. You can use the following errors with <script> elements that are within <processing> elements + +- **AskForLogoff()**. Prompts the user to log off at the end of the migration. For example: + + ``` xml + + + + ``` + +- **ConvertToShortFileName(RegistryEncodedLocation)**. If *RegistryEncodedLocation* is the full path of an existing file, this function will convert the file to its short file name and then it will update the registry value. + +- **KillExplorer()**. Stops Explorer.exe for the current user context. This allows access to certain keys and files that are kept open when Explorer.exe is running. For example: + + ``` xml + + + + ``` + +- **RegisterFonts(FileEncodedLocation)**. Registers the given font or all of the fonts in the given directory. For example: + + ``` xml + + + + ``` + +- **RemoveEmptyDirectories (DirectoryEncodedPattern).** Deletes any empty directories that match *DirectoryEncodedPattern* on the destination computer. + +- **RestartExplorer().** Restarts Explorer.exe at the end of the migration. For example: + + ``` xml + + + + ``` + +- **StartService (ServiceName, OptionalParam1, OptionalParam2,…).** Starts the service identified by *ServiceName. ServiceName* is the subkey in HKLM\\System\\CurrentControlSet\\Services that holds the data for the given service. The optional parameters, if any, will be passed to the StartService API. For more information, see [this Microsoft Web site](https://go.microsoft.com/fwlink/p/?LinkId=267898). + +- **StopService (ServiceName)**. Stops the service that is identified by *ServiceName. ServiceName* is the subkey in HKLM\\System\\CurrentControlSet\\Services that holds the data for the given service. + +- **SyncSCM(ServiceShortName).** Reads the Start type value from the registry (HKLM\\System\\CurrentControlSet\\Services\\ServiceShortName \[Start\]) after it is changed by the migration engine, and then synchronizes Service Control Manager (SCM) with the new value. + +## <text> + + +You can use the <text> element to set a value for any environment variables that are inside one of the migration .xml files. + +- **Number of occurrences:** Once in each [<variable>](#variable) element. + +- **Parent elements:**[<variable>](#variable) + +- **Child elements:** None. + +Syntax: + +<text>*NormalText*</text> + + ++++ + + + + + + + + + + + + +
                        SettingValue

                        NormalText

                        This is interpreted as normal text.

                        + + + +For example: + +``` xml + + %CSIDL_COMMON_APPDATA%\QuickTime + +``` + +## <unconditionalExclude> + + +The <unconditionalExclude> element excludes the specified files and registry values from the migration, regardless of the other include rules in any of the migration .xml files or in the Config.xml file. The objects declared here will not be migrated because this element takes precedence over all other rules. For example, even if there are explicit <include> rules to include .mp3 files, if you specify to exclude them with this option, then they will not be migrated. + +Use this element if you want to exclude all .mp3 files from the source computer. Or, if you are backing up C:\\UserData using another method, you can exclude the entire folder from the migration. Use this element with caution, however, because if an application needs a file that you exclude, the application may not function properly on the destination computer. + +- **Number of occurrences:** Unlimited. + +- **Parent elements:**[<rules>](#rules) + +- **Child elements:**[<objectSet>](#objectset) + +Syntax: + +<unconditionalExclude></unconditionalExclude> + +The following .xml file excludes all .mp3 files from migration. For additional examples of how to use this element, see the [Exclude Files and Settings](usmt-exclude-files-and-settings.md). + +``` xml + + + Test + + + + + + + + + + + +``` + +## <variable> + + +The <variable> element is required in an <environment> element. For each <variable> element there must be one <objectSet>, <script>, or <text> element. The content of the <variable> element assigns a text value to the environment variable. This element has the following three options: + +1. If the <variable> element contains a <text> element, then the value of the variable element will be the value of the <text> element. + +2. If the <variable> element contains a <script> element and the invocation of the script produces a non-null string, then the value of the <variable> element will be the result of the script invocation. + +3. If the <variable> element contains an <objectSet> element and the evaluation of the <objectSet> element produces at least one object pattern, then the value of the first object to match the resulting object pattern will be the value of the variable element. + +- **Number of occurrences:** Unlimited + +- **Parent elements:**[<environment>](#bkmk-environment) + +- **Required child elements:** either [<text>](#text), or [<script>](#script), or [<objectSet>](#objectset) + +Syntax: + +<variable name="*ID*" remap=TRUE|FALSE> + +</variable> + + +++++ + + + + + + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        name

                        Yes

                        ID is a string value that is the name used to reference the environment variable. We recommend that ID start with the component’s name to avoid namespace collisions. For example, if your component’s name is MyComponent, and you want a variable that is your component’s install path, you could specify MyComponent.InstallPath.

                        remap

                        No, default = FALSE

                        Specifies whether to evaluate this environment variable as a remapping environment variable. Objects that are located in a path that is underneath this environment variable’s value are automatically moved to where the environment variable points on the destination computer.

                        + + + +The following example is from the MigApp.xml file: + +``` xml + + + HKLM\Software + + + + + +``` + +## <version> + + +The <version> element defines the version for the component, but does not affect the migration. + +- **Number of occurrences:** zero or one + +- **Parent elements:**[<component>](#component) + +- **Child elements:** none + +Syntax: + +<version>*ComponentVersion*</version> + + +++++ + + + + + + + + + + + + + + +
                        SettingRequired?Value

                        ComponentVersion

                        Yes

                        The version of the component, which can contain patterns.

                        + + + +For example: + +``` xml +4.* +``` + +## <windowsObjects> + + +The <windowsObjects> element is for USMT internal use only. Do not use this element. + +## Appendix + + +### Specifying locations + +- **Specifying encoded locations**. The encoded location used in all of the helper functions is an unambiguous string representation for the name of an object. It is composed of the node part, optionally followed by the leaf enclosed in square brackets. This makes a clear distinction between nodes and leaves. + + For example, specify the file C:\\Windows\\Notepad.exe like this: `c:\Windows[Notepad.exe]`. Similarly, specify the directory C:\\Windows\\System32 like this: `c:\Windows\System32`. (Notice the absence of the \[\] construct.) + + Representing the registry is very similar. The default value of a registry key is represented as an empty \[\] construct. For example, the default value for the HKLM\\SOFTWARE\\MyKey registry key will be `HKLM\SOFTWARE\MyKey[]`. + +- **Specifying location patterns**. You specify a location pattern in a way that is similar to how you specify an actual location. The exception is that both the node and leaf part accept patterns. However, a pattern from the node does not extend to the leaf. + + For example, the pattern `c:\Windows\*` will match the Windows directory and all subdirectories. But it will not match any of the files in those directories. To match the files as well, you must specify `c:\Windows\*[*]`. + +### Internal USMT functions + +The following functions are for internal USMT use only. Do not use them in an .xml file. + +- AntiAlias + +- ConvertScreenSaver + +- ConvertShowIEOnDesktop + +- ConvertToOfficeLangID + +- MigrateActiveDesktop + +- MigrateAppearanceUPM + +- MigrateDisplayCS + +- MigrateDisplaySS + +- MigrateIEAutoSearch + +- MigrateMouseUPM + +- MigrateSoundSysTray + +- MigrateTaskBarSS + +- SetPstPathInMapiStruc + +### Valid version tags + +You can use the following version tags with various helper functions: + +- “CompanyName” + +- “FileDescription” + +- “FileVersion” + +- “InternalName” + +- “LegalCopyright” + +- “OriginalFilename” + +- “ProductName” + +- “ProductVersion” + +The following version tags contain values that can be compared: + +- “FileVersion” + +- “ProductVersion” + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/xml-file-requirements.md b/windows/deployment/usmt/xml-file-requirements.md index 5038bb98be..aeae8b54ae 100644 --- a/windows/deployment/usmt/xml-file-requirements.md +++ b/windows/deployment/usmt/xml-file-requirements.md @@ -1,49 +1,50 @@ ---- -title: XML File Requirements (Windows 10) -description: XML File Requirements -ms.assetid: 4b567b50-c50a-4a4f-8684-151fe3f8275f -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# XML File Requirements - - -When creating custom .xml files, note the following requirements: - -- **The file must be in Unicode Transformation Format-8 (UTF-8).** You must save the file in this format, and you must specify the following syntax at the beginning of each .xml file: - - ``` syntax - - ``` - -- **The file must have a unique migration urlid**. The urlid of each file that you specify on the command line must be different. If two migration .xml files have the same urlid, the second .xml file that is specified on the command line will not be processed. This is because USMT uses the urlid to define the components within the file. For example, you must specify the following syntax at the beginning of each file: - - ``` syntax - - - ``` - -- **Each component in the file must have a display name in order for it to appear in the Config.xml file.** This is because the Config.xml file defines the components by the display name and the migration urlid. For example, specify the following syntax: - - ``` syntax - My Application - ``` - -For examples of custom .xml files, see [Custom XML Examples](usmt-custom-xml-examples.md). - -  - -  - - - - - +--- +title: XML File Requirements (Windows 10) +description: XML File Requirements +ms.assetid: 4b567b50-c50a-4a4f-8684-151fe3f8275f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# XML File Requirements + + +When creating custom .xml files, note the following requirements: + +- **The file must be in Unicode Transformation Format-8 (UTF-8).** You must save the file in this format, and you must specify the following syntax at the beginning of each .xml file: + + ``` xml + + ``` + +- **The file must have a unique migration urlid**. The urlid of each file that you specify on the command line must be different. If two migration .xml files have the same urlid, the second .xml file that is specified on the command line will not be processed. This is because USMT uses the urlid to define the components within the file. For example, you must specify the following syntax at the beginning of each file: + + ``` xml + + + ``` + +- **Each component in the file must have a display name in order for it to appear in the Config.xml file.** This is because the Config.xml file defines the components by the display name and the migration urlid. For example, specify the following syntax: + + ``` xml + My Application + ``` + +For examples of custom .xml files, see [Custom XML Examples](usmt-custom-xml-examples.md). + +  + +  + + + + + diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md index 1ed8638bcc..7ba4d88b2d 100644 --- a/windows/deployment/vda-subscription-activation.md +++ b/windows/deployment/vda-subscription-activation.md @@ -29,13 +29,13 @@ Deployment instructions are provided for the following scenarios: - VMs must be running Windows 10 Pro, version 1703 (also known as the Creator's Update) or later. - VMs must be Active Directory-joined or Azure Active Directory (AAD)-joined. - VMs must be generation 1. -- VMs must hosted by a [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH). +- VMs must hosted by a [Qualified Multitenant Hoster](https://www.microsoft.com/CloudandHosting/licensing_sca.aspx) (QMTH). ## Activation ### Scenario 1 - The VM is running Windows 10, version 1803 or later. -- The VM is hosted in Azure or another [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH). +- The VM is hosted in Azure or another [Qualified Multitenant Hoster](https://www.microsoft.com/CloudandHosting/licensing_sca.aspx) (QMTH). When a user with VDA rights signs in to the VM using their AAD credentials, the VM is automatically stepped-up to Enterprise and activated. There is no need to perform Windows 10 Pro activation. This eliminates the need to maintain KMS or MAK in the qualifying cloud infrastructure. @@ -45,7 +45,7 @@ Deployment instructions are provided for the following scenarios: [Inherited Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation#inherited-activation) is enabled. All VMs created by a user with a Windows 10 E3 or E5 license are automatically activated independent of whether a user signs in with a local account or using an Azure Active Directory account. ### Scenario 3 -- The VM is running Windows 10, version 1703 or 1709, or the hoster is not an authorized [QMTH](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) partner. +- The VM is running Windows 10, version 1703 or 1709, or the hoster is not an authorized [QMTH](https://www.microsoft.com/CloudandHosting/licensing_sca.aspx) partner. In this scenario, the underlying Windows 10 Pro license must be activated prior to Subscription Activation of Windows 10 Enterprise. Activation is accomplished using a Windows 10 Pro Generic Volume License Key (GVLK) and a Volume License KMS activation server provided by the hoster. Alternatively, a KMS activation server on your corporate network can be used if you have configured a private connection, such as [ExpressRoute](https://azure.microsoft.com/services/expressroute/) or [VPN Gateway](https://azure.microsoft.com/services/vpn-gateway/). diff --git a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md index 14fc64361b..3c52c27790 100644 --- a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md @@ -1,170 +1,171 @@ ---- -title: Scenario 2 Proxy Activation (Windows 10) -description: Scenario 2 Proxy Activation -ms.assetid: ed5a8a56-d9aa-4895-918f-dd1898cb2c1a -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Scenario 2: Proxy Activation - -In this scenario, the Volume Activation Management Tool (VAMT) is used to activate products that are installed on workgroup computers in an isolated lab environment. For workgroups which are isolated from the larger network, you can perform proxy activation of Multiple Activation Keys (MAKs), KMS Host keys (CSVLKs), Generic Volume License Keys (GVLKs) (or KMS client keys), or retail keys. Proxy activation is performed by installing a second instance of VAMT on a computer in the isolated workgroup. You can then use removable media to transfer VAMT Computer Information Lists (CILXs) between the instance of VAMT in the isolated workgroup and another VAMT host that has Internet access. The following diagram shows a Multiple Activation Key (MAK) proxy activation scenario: - -![VAMT MAK proxy activation scenario](images/dep-win8-l-vamt-makproxyactivationscenario.jpg) - -## Step 1: Install VAMT on a Workgroup Computer in the Isolated Lab - -1. Install VAMT on a host computer in the isolated lab workgroup. This computer can be running Windows 7, Windows 8, Windows 10, Windows Server 2008 R2, or Windows Server® 2012. -2. Click the VAMT icon in the **Start** menu to open VAMT. - -## Step 2: Configure the Windows Management Instrumentation Firewall Exception on Target Computers - -- Ensure that the Windows Management Instrumentation (WMI) firewall exception has been enabled for all target computers. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - - **Note**   - To retrieve the license status on the selected computers, VAMT must have administrative permissions on the remote computers and WMI must be accessible through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - -## Step 3: Connect to a VAMT Database - -1. If the host computer in the isolated lab workgroup is not already connected to the database, the **Database Connection Settings** dialog box appears when you open VAMT. Select the server and database that contains the computers in the workgroup. -2. Click **Connect**. -3. If you are already connected to a database, in the center pane VAMT displays an inventory of the products and product keys, and a license overview of the computers in the database. If you need to connect to a different database, click **Successfully connected to the Server** to open the **Database Connection Settings** dialog box. For more information about how to create VAMT databases and adding VAMT data, see [Manage VAMT Data.](manage-vamt-data.md) - -## Step 4: Discover Products - -1. In the left-side pane, in the **Products** node, click the product that you want to activate. -2. To open the **Discover Products** dialog box, click **Discover products** in the right-side pane. -3. In the **Discover Products** dialog box, click **Search for computers in the Active Directory** to display the search options, and then click the search options that you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query: - - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**. Then under **Domain Filter Criteria**, in the list of domain names, click the name of the domain that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for specific computers in the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". - - To search by individual computer name or IP address, click **Manually enter name or IP address**. Then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that both IPv4 and IPv6addressing are supported. - - To search for computers in a workgroup, click **Search for computers in the workgroup**. Then under **Workgroup Filter Criteria**, in the list of workgroup names, click the name of the workgroup that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer in the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only those computer names that start with the letter "a". - - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box that appears. VAMT will validate the LDAP query syntax, but will otherwise run the query without additional checks. -4. Click **Search**. - - The **Finding Computers** window appears and displays the search progress as the computers are located. - -When the search is complete, the products that VAMT discovers appear in the list view in the center pane. - -## Step 5: Sort and Filter the List of Computers - -You can sort the list of products so that it is easier to find the computers that require product keys to be activated: - -1. On the menu bar at the top of the center pane, click **Group by**, and then click **Product**, **Product Key Type**, or **License Status**. -2. To sort the list further, you can click one of the column headings to sort by that column. -3. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by product name, product key type, or license status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. VAMT displays the filtered list in the product list view in the center pane. - -## Step 6: Collect Status Information from the Computers in the Isolated Lab - -To collect the status from select computers in the database, you can select computers in the product list view by using one of the following methods: -- To select a block of consecutively listed computers, click the first computer that you want to select, and then click the last computer while pressing the **Shift** key. -- To select computers which are not listed consecutively, hold down the **Ctrl** ley and select each computer for which you want to collect the status information. - **To collect status information from the selected computers** -- In the right-side **Actions** pane, click **Update license status** in the **Selected Items** menu and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials that are different from the ones that you used to log on to the computer. Otherwise, click **Current Credentials** and continue to step 2.If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and then click **OK**. -- VAMT displays the **Collecting product information** dialog box while it collects the license status of all supported products on the selected computers. When the process is finished, the updated license status of each product will appear in the product list view in the center pane. - - **Note** - If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. - -## Step 7: Add Product Keys - -1. Click the **Product Keys** node in the left-side pane, and then click **Add Product Keys** in the right-side pane to open the **Add Product Keys** dialog box. -2. In the **Add Product Keys** dialog box, you can select from one of the following methods to add product keys: - - To add a single product key, click **Enter product key(s) separated by line breaks**, enter one or more product keys, and then click **Add key(s)**. - - To import a Comma Separated Values File (CSV) that contains a list of product keys, click **Select a product key to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. - - The keys that you have added appear in the **Product Keys** list view in the center pane. - -## Step 8: Install the Product Keys on the Isolated Lab Computers - -1. In the left-side pane, in the **Products** node click the product that you want to install keys onto. -2. If necessary, sort and filter the list of products so that it is easier to find the computers that must have a product key installed. See [Step 5: Sort and Filter the List of Computers](#step-5-sort-and-filter-the-list-of-computers). -3. In the **Products** list view pane, select the individual products which must have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. -4. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. -5. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAKs based on the selected products. If you are installing a MAK you can select a recommended product key or any other MAK from the **All Product Keys List**. If you are not installing a MAK, select a product key from the **All Product Keys** list. Use the scroll bar if you need to view the **Description** for each key. When you have selected the product key that you want to install, click **Install Key**. Note that only one key can be installed at a time. -6. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - - The same status appears under the **Status of Last Action** column in the product list view in the center pane. - - **Note**   - Product key installation will fail if VAMT finds mismatched key types or editions. VAMT displays the failure status and continues the installation for the next product in the list. For more information on choosing the correct product key, see [How to Choose the Right Volume License Key for Windows.](https://go.microsoft.com/fwlink/p/?linkid=238382) - - **Note**   - Installing a MAK and overwriting the GVLK on client products must be done with care. If the RTM version of Windows Vista has been installed on the computer for more than 30 days, then its initial grace period has expired. As a result, it will enter Reduced Functionality Mode (RFM) if online activation is not completed successfully before the next logon attempt. However, you can use online activation to recover properly configured computers from RFM, as long as the computers are available on the network. RFM only applies to the RTM version of Windows Vista or the retail editions of Microsoft Office 2010. Windows Vista with SP1 or later, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012, and volume editions of Office 2010 will not enter RFM. - -## Step 9: Export VAMT Data to a .cilx File - -In this step, you export VAMT from the workgroup’s host computer and save it in a .cilx file. Then you copy the .cilx file to removable media so that you can take it to a VAMT host computer that is connected to the Internet. In MAK proxy activation, it is critical to retain this file, because VAMT uses it to apply the Confirmation IDs (CIDs) to the proper products. - -1. Select the individual products that successfully received a product key in Step 8. If needed, sort and filter the list to find the products. -2. In the right-side **Actions** pane, click **Export list** to open the **Export List** dialog box. -3. In the **Export List** dialog box, click **Browse** to navigate to the .cilx file, or enter the name of the .cilx file to which you want to export the data. -4. Under **Export options**, select one of the following data-type options: - - Export products and product keys. - - Export products only. - - Export proxy activation data only. Selecting this option ensures that the export contains only the license information required for the proxy web service to obtain CIDs from Microsoft. No Personally Identifiable Information (PII) is contained in the exported .cilx file when this selection is selected. This option should be used when an enterprise’s security policy states that no information that could identify a specific computer or user may be transferred out of the isolated lab and, therefore, this type of data must be excluded from the .cilx file that is transferred to the Core Network VAMT host. -5. If you have selected products to export, and not the entire set of data from the database, select the **Export selected product rows only** check box. -6. Click **Save**. VAMT displays a progress message while the data is being exported. Click **OK** when a message appears and confirms that the export has completed successfully. -7. If you exported the list to a file on the host computer’s hard drive, copy the file to removable media, such as a disk drive, CD/DVD, or USB storage device. - - **Important**   - Choosing the **Export proxy activation data only** option excludes Personally Identifiable Information (PII) from being saved in the .cilx file. Therefore, the .cilx file must be re-imported into the SQL Server database on the isolated lab workgroup’s VAMT host computer, so that the CIDs that are requested from Microsoft (discussed in Step 10) can be correctly assigned to the computers in the isolated lab group. - -## Step 10: Acquire Confirmation IDs from Microsoft on the Internet-Connected Host Computer - -1. Insert the removable media into the VAMT host that has Internet access. -2. Open VAMT. Make sure you are on the root node, and that the **Volume Activation Management Tool** view is displayed in the center pane. -3. In the right-side **Actions** pane, click **Acquire confirmation IDs for CILX** to open the **Acquire confirmation IDs for file** dialog box. -4. In the **Acquire confirmation IDs for file** dialog box, browse to the location of the .cilx file that you exported from the isolated lab host computer, select the file, and then click **Open**. VAMT displays an **Acquiring Confirmation IDs** message while it contacts Microsoft and collects the CIDs. -5. When the CID collection process is complete, VAMT displays a **Volume Activation Management Tool** message that shows the number of confirmation IDs that were successfully acquired, and the name of the file where the IDs were saved. Click **OK** to close the message. - -## Step 11: Import the .cilx File onto the VAMT Host within the Isolated Lab Workgroup - -1. Remove the storage device that contains the .cilx file from the Internet-connected VAMT host computer and insert it into the VAMT host computer in the isolated lab. -2. Open VAMT and verify that you are connected to the database that contains the computer with the product keys that you are activating. -3. In the right-side **Actions** pane, click **Import list** to open the **Import List** dialog box. -4. In the **Import list** dialog box, browse to the location of the .cilx file that contains the CIDs, select the file, and then click **Open**. -5. Click **OK** to import the file and to overwrite any conflicting data in the database with data from the file. -6. VAMT displays a progress message while the data is being imported. Click **OK** when a message appears and confirms that the data has been successfully imported. - -## Step 12: Apply the CIDs and Activate the Isolated Lab Computers - -1. Select the products to which you want to apply CIDs. If needed, sort and filter the list to find the products. -2. In the right-side **Selected Items** menu, click **Activate**, click **Apply Confirmation ID**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. - - VAMT displays the **Applying Confirmation Id** dialog box while it installs the CIDs on the selected products. When VAMT finishes installing the CIDs, the status appears in the **Action Sataus** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - The same status appears under the **Status of Last Action** column in the product list view in the center pane. - -## Step 13: (Optional) Reactivating Reimaged Computers in the Isolated Lab - -If you have captured new images of the computers in the isolated lab, but the underlying hardware of those computers has not changed, VAMT can reactivate those computers using the CIDs that are stored in the database. -1. Redeploy products to each computer, using the same computer names as before. -2. Open VAMT. -3. In the right-side **Selected Items** menu, click **Activate**, click **Apply Confirmation ID**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. - - VAMT displays the **Applying Confirmation Id** dialog box while it installs the CIDs on the selected products. When VAMT finishes installing the CIDs, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - The same status appears under the **Status of Last Action** column in the product list view in the center pane. - - **Note**   - Installing a MAK and overwriting the GVLK on the client products must be done with care. If the Windows activation initial grace period has expired, Windows will enter Reduced Functionality Mode (RFM) if online activation is not completed successfully before the next logon attempt. However, you can use online activation to recover properly configured computers from RFM, as long as the computers are accessible on the network. - - RFM only applies to the RTM version of Windows Vista or the retail editions of Microsoft Office 2010. Windows Vista with SP1 or later, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012, and volume editions of Office 2010 will not enter RFM. - - **Note**   - Reapplying the same CID conserves the remaining activations on the MAK. - -## Related topics -- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) - - +--- +title: Scenario 2 Proxy Activation (Windows 10) +description: Scenario 2 Proxy Activation +ms.assetid: ed5a8a56-d9aa-4895-918f-dd1898cb2c1a +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Scenario 2: Proxy Activation + +In this scenario, the Volume Activation Management Tool (VAMT) is used to activate products that are installed on workgroup computers in an isolated lab environment. For workgroups which are isolated from the larger network, you can perform proxy activation of Multiple Activation Keys (MAKs), KMS Host keys (CSVLKs), Generic Volume License Keys (GVLKs) (or KMS client keys), or retail keys. Proxy activation is performed by installing a second instance of VAMT on a computer in the isolated workgroup. You can then use removable media to transfer VAMT Computer Information Lists (CILXs) between the instance of VAMT in the isolated workgroup and another VAMT host that has Internet access. The following diagram shows a Multiple Activation Key (MAK) proxy activation scenario: + +![VAMT MAK proxy activation scenario](images/dep-win8-l-vamt-makproxyactivationscenario.jpg) + +## Step 1: Install VAMT on a Workgroup Computer in the Isolated Lab + +1. Install VAMT on a host computer in the isolated lab workgroup. This computer can be running Windows 7, Windows 8, Windows 10, Windows Server 2008 R2, or Windows Server® 2012. +2. Click the VAMT icon in the **Start** menu to open VAMT. + +## Step 2: Configure the Windows Management Instrumentation Firewall Exception on Target Computers + +- Ensure that the Windows Management Instrumentation (WMI) firewall exception has been enabled for all target computers. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + + **Note**   + To retrieve the license status on the selected computers, VAMT must have administrative permissions on the remote computers and WMI must be accessible through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + +## Step 3: Connect to a VAMT Database + +1. If the host computer in the isolated lab workgroup is not already connected to the database, the **Database Connection Settings** dialog box appears when you open VAMT. Select the server and database that contains the computers in the workgroup. +2. Click **Connect**. +3. If you are already connected to a database, in the center pane VAMT displays an inventory of the products and product keys, and a license overview of the computers in the database. If you need to connect to a different database, click **Successfully connected to the Server** to open the **Database Connection Settings** dialog box. For more information about how to create VAMT databases and adding VAMT data, see [Manage VAMT Data.](manage-vamt-data.md) + +## Step 4: Discover Products + +1. In the left-side pane, in the **Products** node, click the product that you want to activate. +2. To open the **Discover Products** dialog box, click **Discover products** in the right-side pane. +3. In the **Discover Products** dialog box, click **Search for computers in the Active Directory** to display the search options, and then click the search options that you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query: + - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**. Then under **Domain Filter Criteria**, in the list of domain names, click the name of the domain that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for specific computers in the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". + - To search by individual computer name or IP address, click **Manually enter name or IP address**. Then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that both IPv4 and IPv6addressing are supported. + - To search for computers in a workgroup, click **Search for computers in the workgroup**. Then under **Workgroup Filter Criteria**, in the list of workgroup names, click the name of the workgroup that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer in the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only those computer names that start with the letter "a". + - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box that appears. VAMT will validate the LDAP query syntax, but will otherwise run the query without additional checks. +4. Click **Search**. + + The **Finding Computers** window appears and displays the search progress as the computers are located. + +When the search is complete, the products that VAMT discovers appear in the list view in the center pane. + +## Step 5: Sort and Filter the List of Computers + +You can sort the list of products so that it is easier to find the computers that require product keys to be activated: + +1. On the menu bar at the top of the center pane, click **Group by**, and then click **Product**, **Product Key Type**, or **License Status**. +2. To sort the list further, you can click one of the column headings to sort by that column. +3. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by product name, product key type, or license status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. VAMT displays the filtered list in the product list view in the center pane. + +## Step 6: Collect Status Information from the Computers in the Isolated Lab + +To collect the status from select computers in the database, you can select computers in the product list view by using one of the following methods: +- To select a block of consecutively listed computers, click the first computer that you want to select, and then click the last computer while pressing the **Shift** key. +- To select computers which are not listed consecutively, hold down the **Ctrl** ley and select each computer for which you want to collect the status information. + **To collect status information from the selected computers** +- In the right-side **Actions** pane, click **Update license status** in the **Selected Items** menu and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials that are different from the ones that you used to log on to the computer. Otherwise, click **Current Credentials** and continue to step 2.If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and then click **OK**. +- VAMT displays the **Collecting product information** dialog box while it collects the license status of all supported products on the selected computers. When the process is finished, the updated license status of each product will appear in the product list view in the center pane. + + **Note** + If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. + +## Step 7: Add Product Keys + +1. Click the **Product Keys** node in the left-side pane, and then click **Add Product Keys** in the right-side pane to open the **Add Product Keys** dialog box. +2. In the **Add Product Keys** dialog box, you can select from one of the following methods to add product keys: + - To add a single product key, click **Enter product key(s) separated by line breaks**, enter one or more product keys, and then click **Add key(s)**. + - To import a Comma Separated Values File (CSV) that contains a list of product keys, click **Select a product key to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. + + The keys that you have added appear in the **Product Keys** list view in the center pane. + +## Step 8: Install the Product Keys on the Isolated Lab Computers + +1. In the left-side pane, in the **Products** node click the product that you want to install keys onto. +2. If necessary, sort and filter the list of products so that it is easier to find the computers that must have a product key installed. See [Step 5: Sort and Filter the List of Computers](#step-5-sort-and-filter-the-list-of-computers). +3. In the **Products** list view pane, select the individual products which must have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. +4. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. +5. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAKs based on the selected products. If you are installing a MAK you can select a recommended product key or any other MAK from the **All Product Keys List**. If you are not installing a MAK, select a product key from the **All Product Keys** list. Use the scroll bar if you need to view the **Description** for each key. When you have selected the product key that you want to install, click **Install Key**. Note that only one key can be installed at a time. +6. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + + The same status appears under the **Status of Last Action** column in the product list view in the center pane. + + **Note**   + Product key installation will fail if VAMT finds mismatched key types or editions. VAMT displays the failure status and continues the installation for the next product in the list. For more information on choosing the correct product key, see [How to Choose the Right Volume License Key for Windows.](https://go.microsoft.com/fwlink/p/?linkid=238382) + + **Note**   + Installing a MAK and overwriting the GVLK on client products must be done with care. If the RTM version of Windows Vista has been installed on the computer for more than 30 days, then its initial grace period has expired. As a result, it will enter Reduced Functionality Mode (RFM) if online activation is not completed successfully before the next logon attempt. However, you can use online activation to recover properly configured computers from RFM, as long as the computers are available on the network. RFM only applies to the RTM version of Windows Vista or the retail editions of Microsoft Office 2010. Windows Vista with SP1 or later, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012, and volume editions of Office 2010 will not enter RFM. + +## Step 9: Export VAMT Data to a .cilx File + +In this step, you export VAMT from the workgroup’s host computer and save it in a .cilx file. Then you copy the .cilx file to removable media so that you can take it to a VAMT host computer that is connected to the Internet. In MAK proxy activation, it is critical to retain this file, because VAMT uses it to apply the Confirmation IDs (CIDs) to the proper products. + +1. Select the individual products that successfully received a product key in Step 8. If needed, sort and filter the list to find the products. +2. In the right-side **Actions** pane, click **Export list** to open the **Export List** dialog box. +3. In the **Export List** dialog box, click **Browse** to navigate to the .cilx file, or enter the name of the .cilx file to which you want to export the data. +4. Under **Export options**, select one of the following data-type options: + - Export products and product keys. + - Export products only. + - Export proxy activation data only. Selecting this option ensures that the export contains only the license information required for the proxy web service to obtain CIDs from Microsoft. No Personally Identifiable Information (PII) is contained in the exported .cilx file when this selection is selected. This option should be used when an enterprise’s security policy states that no information that could identify a specific computer or user may be transferred out of the isolated lab and, therefore, this type of data must be excluded from the .cilx file that is transferred to the Core Network VAMT host. +5. If you have selected products to export, and not the entire set of data from the database, select the **Export selected product rows only** check box. +6. Click **Save**. VAMT displays a progress message while the data is being exported. Click **OK** when a message appears and confirms that the export has completed successfully. +7. If you exported the list to a file on the host computer’s hard drive, copy the file to removable media, such as a disk drive, CD/DVD, or USB storage device. + + **Important**   + Choosing the **Export proxy activation data only** option excludes Personally Identifiable Information (PII) from being saved in the .cilx file. Therefore, the .cilx file must be re-imported into the SQL Server database on the isolated lab workgroup’s VAMT host computer, so that the CIDs that are requested from Microsoft (discussed in Step 10) can be correctly assigned to the computers in the isolated lab group. + +## Step 10: Acquire Confirmation IDs from Microsoft on the Internet-Connected Host Computer + +1. Insert the removable media into the VAMT host that has Internet access. +2. Open VAMT. Make sure you are on the root node, and that the **Volume Activation Management Tool** view is displayed in the center pane. +3. In the right-side **Actions** pane, click **Acquire confirmation IDs for CILX** to open the **Acquire confirmation IDs for file** dialog box. +4. In the **Acquire confirmation IDs for file** dialog box, browse to the location of the .cilx file that you exported from the isolated lab host computer, select the file, and then click **Open**. VAMT displays an **Acquiring Confirmation IDs** message while it contacts Microsoft and collects the CIDs. +5. When the CID collection process is complete, VAMT displays a **Volume Activation Management Tool** message that shows the number of confirmation IDs that were successfully acquired, and the name of the file where the IDs were saved. Click **OK** to close the message. + +## Step 11: Import the .cilx File onto the VAMT Host within the Isolated Lab Workgroup + +1. Remove the storage device that contains the .cilx file from the Internet-connected VAMT host computer and insert it into the VAMT host computer in the isolated lab. +2. Open VAMT and verify that you are connected to the database that contains the computer with the product keys that you are activating. +3. In the right-side **Actions** pane, click **Import list** to open the **Import List** dialog box. +4. In the **Import list** dialog box, browse to the location of the .cilx file that contains the CIDs, select the file, and then click **Open**. +5. Click **OK** to import the file and to overwrite any conflicting data in the database with data from the file. +6. VAMT displays a progress message while the data is being imported. Click **OK** when a message appears and confirms that the data has been successfully imported. + +## Step 12: Apply the CIDs and Activate the Isolated Lab Computers + +1. Select the products to which you want to apply CIDs. If needed, sort and filter the list to find the products. +2. In the right-side **Selected Items** menu, click **Activate**, click **Apply Confirmation ID**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. + + VAMT displays the **Applying Confirmation Id** dialog box while it installs the CIDs on the selected products. When VAMT finishes installing the CIDs, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + The same status appears under the **Status of Last Action** column in the product list view in the center pane. + +## Step 13: (Optional) Reactivating Reimaged Computers in the Isolated Lab + +If you have captured new images of the computers in the isolated lab, but the underlying hardware of those computers has not changed, VAMT can reactivate those computers using the CIDs that are stored in the database. +1. Redeploy products to each computer, using the same computer names as before. +2. Open VAMT. +3. In the right-side **Selected Items** menu, click **Activate**, click **Apply Confirmation ID**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. + + VAMT displays the **Applying Confirmation Id** dialog box while it installs the CIDs on the selected products. When VAMT finishes installing the CIDs, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + The same status appears under the **Status of Last Action** column in the product list view in the center pane. + + **Note**   + Installing a MAK and overwriting the GVLK on the client products must be done with care. If the Windows activation initial grace period has expired, Windows will enter Reduced Functionality Mode (RFM) if online activation is not completed successfully before the next logon attempt. However, you can use online activation to recover properly configured computers from RFM, as long as the computers are accessible on the network. + + RFM only applies to the RTM version of Windows Vista or the retail editions of Microsoft Office 2010. Windows Vista with SP1 or later, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012, and volume editions of Office 2010 will not enter RFM. + + **Note**   + Reapplying the same CID conserves the remaining activations on the MAK. + +## Related topics +- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) + + diff --git a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md index f23e9037a3..e54f6338f1 100644 --- a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md +++ b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md @@ -1,75 +1,76 @@ ---- -title: Use VAMT in Windows PowerShell (Windows 10) -description: Use VAMT in Windows PowerShell -ms.assetid: 13e0ceec-d827-4681-a5c3-8704349e3ba9 -ms.reviewer: -manager: laurawi -ms.author: greglin -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -audience: itpro author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Use VAMT in Windows PowerShell - -The Volume Activation Management Tool (VAMT) PowerShell cmdlets can be used to perform the same functions as the Vamt.exe command-line tool. -**To install PowerShell 3.0** -- VAMT PowerShell cmdlets require Windows PowerShell, which is included in Windows 10, Windows 8 and Windows Server® 2012. You can download PowerShell for Windows 7 or other operating systems from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=218356). - **To install the Windows Assessment and Deployment Kit** -- In addition to PowerShell, you must import the VAMT PowerShell module. The module is included in the VAMT 3.0 folder after you install the Windows Assessment and Deployment Kit (Windows ADK). - **To prepare the VAMT PowerShell environment** -- To open PowerShell with administrative credentials, click **Start** and type “PowerShell” to locate the program. Right-click **Windows PowerShell**, and then click **Run as administrator**. To open PowerShell in Windows 7, click **Start**, click **All Programs**, click **Accessories**, click **Windows PowerShell**, right-click **Windows PowerShell**, and then click **Run as administrator**. - - **Important** - If you are using a computer that has an 64-bit processor, select **Windows PowerShell (x86)**. VAMT PowerShell cmdlets are supported for the x86 architecture only. You must use an x86 version of Windows PowerShell to import the VAMT module, which are available in these directories: - - The x86 version of PowerShell is available in C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe - - The x86 version of the PowerShell ISE is available in C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell\_ise.exe -- For all supported operating systems you can use the VAMT PowerShell module included with the Windows ADK. By default, the module is installed with the Windows ADK in the VAMT folder. Change directories to the directory where VAMT is located. - - For example, if the Windows ADK is installed in the default location of `C:\Program Files(x86)\Windows Kits\10`, type: - - ``` ps1 - cd “C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\VAMT 3.0” - ``` -- Import the VAMT PowerShell module. To import the module, type the following at a command prompt: - ``` syntax - Import-Module .\VAMT.psd1 - ``` - Where **Import-Module** imports a module only into the current session. To import the module into all sessions, add an **Import-Module** command to a Windows PowerShell profile. For more information about profiles, type `get-help about_profiles`. - -## To Get Help for VAMT PowerShell cmdlets - -You can view all of the help sections for a VAMT PowerShell cmdlet, or you can view only the section that you are interested in. To view all of the Help content for a VAMT cmdlet, type: -``` ps1 -get-help -all -``` -For example, type: -``` ps1 -get-help get-VamtProduct -all -``` - -**Warning** -The update-help cmdlet is not supported for VAMT PowerShell cmdlets. To view online help for VAMT cmdlets, you can use the -online option with the get-help cmdlet. For more information, see [Volume Activation Management Tool (VAMT) Cmdlets in Windows PowerShell](https://go.microsoft.com/fwlink/p/?LinkId=242278). - -**To view VAMT PowerShell Help sections** - -1. To get the syntax to use with a cmdlet, type the following at a command prompt: - ``` ps1 - get-help - ``` - For example, type: - ``` ps1 - get-help get-VamtProduct - ``` -2. To see examples using a cmdlet, type: - ``` ps1 - get-help -examples - ``` - For example, type: - ``` ps1 - get-help get-VamtProduct -examples - ``` +--- +title: Use VAMT in Windows PowerShell (Windows 10) +description: Use VAMT in Windows PowerShell +ms.assetid: 13e0ceec-d827-4681-a5c3-8704349e3ba9 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Use VAMT in Windows PowerShell + +The Volume Activation Management Tool (VAMT) PowerShell cmdlets can be used to perform the same functions as the Vamt.exe command-line tool. +**To install PowerShell 3.0** +- VAMT PowerShell cmdlets require Windows PowerShell, which is included in Windows 10, Windows 8 and Windows Server® 2012. You can download PowerShell for Windows 7 or other operating systems from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=218356). + **To install the Windows Assessment and Deployment Kit** +- In addition to PowerShell, you must import the VAMT PowerShell module. The module is included in the VAMT 3.0 folder after you install the Windows Assessment and Deployment Kit (Windows ADK). + **To prepare the VAMT PowerShell environment** +- To open PowerShell with administrative credentials, click **Start** and type “PowerShell” to locate the program. Right-click **Windows PowerShell**, and then click **Run as administrator**. To open PowerShell in Windows 7, click **Start**, click **All Programs**, click **Accessories**, click **Windows PowerShell**, right-click **Windows PowerShell**, and then click **Run as administrator**. + + **Important** + If you are using a computer that has an 64-bit processor, select **Windows PowerShell (x86)**. VAMT PowerShell cmdlets are supported for the x86 architecture only. You must use an x86 version of Windows PowerShell to import the VAMT module, which are available in these directories: + - The x86 version of PowerShell is available in C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe + - The x86 version of the PowerShell ISE is available in C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell\_ise.exe +- For all supported operating systems you can use the VAMT PowerShell module included with the Windows ADK. By default, the module is installed with the Windows ADK in the VAMT folder. Change directories to the directory where VAMT is located. + + For example, if the Windows ADK is installed in the default location of `C:\Program Files(x86)\Windows Kits\10`, type: + + ``` powershell + cd “C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\VAMT 3.0” + ``` +- Import the VAMT PowerShell module. To import the module, type the following at a command prompt: + ``` powershell + Import-Module .\VAMT.psd1 + ``` + Where **Import-Module** imports a module only into the current session. To import the module into all sessions, add an **Import-Module** command to a Windows PowerShell profile. For more information about profiles, type `get-help about_profiles`. + +## To Get Help for VAMT PowerShell cmdlets + +You can view all of the help sections for a VAMT PowerShell cmdlet, or you can view only the section that you are interested in. To view all of the Help content for a VAMT cmdlet, type: +``` powershell +get-help -all +``` +For example, type: +``` powershell +get-help get-VamtProduct -all +``` + +**Warning** +The update-help cmdlet is not supported for VAMT PowerShell cmdlets. To view online help for VAMT cmdlets, you can use the -online option with the get-help cmdlet. For more information, see [Volume Activation Management Tool (VAMT) Cmdlets in Windows PowerShell](https://go.microsoft.com/fwlink/p/?LinkId=242278). + +**To view VAMT PowerShell Help sections** + +1. To get the syntax to use with a cmdlet, type the following at a command prompt: + ``` powershell + get-help + ``` + For example, type: + ``` powershell + get-help get-VamtProduct + ``` +2. To see examples using a cmdlet, type: + ``` powershell + get-help -examples + ``` + For example, type: + ``` powershell + get-help get-VamtProduct -examples + ``` diff --git a/windows/deployment/windows-10-enterprise-e3-overview.md b/windows/deployment/windows-10-enterprise-e3-overview.md index 6b45127282..e241930c1e 100644 --- a/windows/deployment/windows-10-enterprise-e3-overview.md +++ b/windows/deployment/windows-10-enterprise-e3-overview.md @@ -43,9 +43,9 @@ When you purchase Windows 10 Enterprise E3 via a partner, you get the followin How does the Windows 10 Enterprise E3 in CSP program compare with Microsoft Volume Licensing Agreements and Software Assurance? -- [Microsoft Volume Licensing](https://www.microsoft.com/en-us/licensing/default.aspx) programs are broader in scope, providing organizations with access to licensing for all Microsoft products. +- [Microsoft Volume Licensing](https://www.microsoft.com/licensing/default.aspx) programs are broader in scope, providing organizations with access to licensing for all Microsoft products. -- [Software Assurance](https://www.microsoft.com/en-us/Licensing/licensing-programs/software-assurance-default.aspx) provides organizations with the following categories of benefits: +- [Software Assurance](https://www.microsoft.com/Licensing/licensing-programs/software-assurance-default.aspx) provides organizations with the following categories of benefits: - **Deployment and management**. These benefits include planning services, Microsoft Desktop Optimization (MDOP), Windows Virtual Desktop Access Rights, Windows-To-Go Rights, Windows Roaming Use Rights, Windows Thin PC, Windows RT Companion VDA Rights, and other benefits. diff --git a/windows/deployment/windows-10-media.md b/windows/deployment/windows-10-media.md index 66d5049d31..e46fc7ed24 100644 --- a/windows/deployment/windows-10-media.md +++ b/windows/deployment/windows-10-media.md @@ -77,7 +77,7 @@ Features on demand is a method for adding features to your Windows 10 image that ## Related topics -[Microsoft Volume Licensing Service Center (VLSC) User Guide](https://www.microsoft.com/en-us/download/details.aspx?id=10585) +[Microsoft Volume Licensing Service Center (VLSC) User Guide](https://www.microsoft.com/download/details.aspx?id=10585)
                        [Volume Activation for Windows 10](https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-windows-10)
                        [Plan for volume activation](https://docs.microsoft.com/windows/deployment/volume-activation/plan-for-volume-activation-client)
                        [VLSC downloads FAQ](https://www.microsoft.com/Licensing/servicecenter/Help/FAQDetails.aspx?id=150) diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md index ddb22cbbbb..87eea0e845 100644 --- a/windows/deployment/windows-10-poc-mdt.md +++ b/windows/deployment/windows-10-poc-mdt.md @@ -75,7 +75,7 @@ MDT performs deployments by using the Lite Touch Installation (LTI), Zero Touch Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 0 Stop-Process -Name Explorer ``` -2. Download and install the 64-bit version of [Microsoft Deployment Toolkit (MDT)](https://www.microsoft.com/en-us/download/details.aspx?id=54259) on SRV1 using the default options. As of the writing of this guide, the latest version of MDT was 8443. +2. Download and install the 64-bit version of [Microsoft Deployment Toolkit (MDT)](https://www.microsoft.com/download/details.aspx?id=54259) on SRV1 using the default options. As of the writing of this guide, the latest version of MDT was 8443. 3. Download and install the latest [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) on SRV1 using the default installation settings. The current version is the ADK for Windows 10, version 1703. Installation might require several minutes to acquire all components. @@ -638,7 +638,7 @@ Deployment logs are available on the client computer in the following locations: You can review WDS events in Event Viewer at: **Applications and Services Logs > Microsoft > Windows > Deployment-Services-Diagnostics**. By default, only the **Admin** and **Operational** logs are enabled. To enable other logs, right-click the log and then click **Enable Log**. -Tools for viewing log files, and to assist with troubleshooting are available in the [System Center 2012 R2 Configuration Manager Toolkit](https://www.microsoft.com/en-us/download/details.aspx?id=50012) +Tools for viewing log files, and to assist with troubleshooting are available in the [System Center 2012 R2 Configuration Manager Toolkit](https://www.microsoft.com/download/details.aspx?id=50012) Also see [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) for detailed troubleshooting information. diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index d9a32a74be..929b097d58 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -72,7 +72,7 @@ Topics and procedures in this guide are summarized in the following table. An es >If the request to add features fails, retry the installation by typing the command again. -2. Download [SQL Server 2014 SP2](https://www.microsoft.com/en-us/evalcenter/evaluate-sql-server-2014-sp2) from the Microsoft Evaluation Center as an .ISO file on the Hyper-V host computer. Save the file to the **C:\VHD** directory. +2. Download [SQL Server 2014 SP2](https://www.microsoft.com/evalcenter/evaluate-sql-server-2014-sp2) from the Microsoft Evaluation Center as an .ISO file on the Hyper-V host computer. Save the file to the **C:\VHD** directory. 3. When you have downloaded the file **SQLServer2014SP2-FullSlipstream-x64-ENU.iso** and placed it in the C:\VHD directory, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: ``` @@ -126,7 +126,7 @@ Topics and procedures in this guide are summarized in the following table. An es Stop-Process -Name Explorer ``` -2. Download [System Center Configuration Manager and Endpoint Protection](https://www.microsoft.com/en-us/evalcenter/evaluate-system-center-configuration-manager-and-endpoint-protection) on SRV1 (download the executable file anywhere on SRV1), double-click the file, enter **C:\configmgr** for **Unzip to folder**, and click **Unzip**. The C:\configmgr directory will be automatically created. Click **OK** and then close the **WinZip Self-Extractor** dialog box when finished. +2. Download [System Center Configuration Manager and Endpoint Protection](https://www.microsoft.com/evalcenter/evaluate-system-center-configuration-manager-and-endpoint-protection) on SRV1 (download the executable file anywhere on SRV1), double-click the file, enter **C:\configmgr** for **Unzip to folder**, and click **Unzip**. The C:\configmgr directory will be automatically created. Click **OK** and then close the **WinZip Self-Extractor** dialog box when finished. 3. Before starting the installation, verify that WMI is working on SRV1. See the following examples. Verify that **Running** is displayed under **Status** and **True** is displayed next to **TcpTestSucceeded**: diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index b12b80110d..7a4fb81ed7 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -224,9 +224,9 @@ Starting with Windows 8, the host computer’s microprocessor must support secon ### Download VHD and ISO files -When you have completed installation of Hyper-V on the host computer, begin configuration of Hyper-V by downloading VHD and ISO files to the Hyper-V host. These files will be used to create the VMs used in the lab. Before you can download VHD and ISO files, you will need to register and sign in to the [TechNet Evaluation Center](https://www.microsoft.com/en-us/evalcenter/) using your Microsoft account. +When you have completed installation of Hyper-V on the host computer, begin configuration of Hyper-V by downloading VHD and ISO files to the Hyper-V host. These files will be used to create the VMs used in the lab. Before you can download VHD and ISO files, you will need to register and sign in to the [TechNet Evaluation Center](https://www.microsoft.com/evalcenter/) using your Microsoft account. -1. Create a directory on your Hyper-V host named **C:\VHD** and download a single [Windows Server 2012 R2 VHD](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2012-r2) from the TechNet Evaluation Center to the **C:\VHD** directory. +1. Create a directory on your Hyper-V host named **C:\VHD** and download a single [Windows Server 2012 R2 VHD](https://www.microsoft.com/evalcenter/evaluate-windows-server-2012-r2) from the TechNet Evaluation Center to the **C:\VHD** directory. **Important**: This guide assumes that VHDs are stored in the **C:\VHD** directory on the Hyper-V host. If you use a different directory to store VHDs, you must adjust steps in this guide appropriately. @@ -238,7 +238,7 @@ When you have completed installation of Hyper-V on the host computer, begin conf 2. Download the file to the **C:\VHD** directory. When the download is complete, rename the VHD file that you downloaded to **2012R2-poc-1.vhd**. This is done to make the filename simple to recognize and type. 3. Copy the VHD to a second file also in the **C:\VHD** directory and name this VHD **2012R2-poc-2.vhd**. -4. Download the [Windows 10 Enterprise ISO](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise) from the TechNet Evaluation Center to the **C:\VHD** directory on your Hyper-V host. +4. Download the [Windows 10 Enterprise ISO](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) from the TechNet Evaluation Center to the **C:\VHD** directory on your Hyper-V host. >During registration, you must specify the type, version, and language of installation media to download. In this example, a Windows 10 Enterprise, 64 bit, English ISO is chosen. You can choose a different version if desired. **Note: The evaluation version of Windows 10 does not support in-place upgrade**. diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 198a7e9aa2..11ef79b654 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -105,8 +105,8 @@ If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade ben With Windows 10 Enterprise or Windows 10 Education, businesses and institutions can benefit from enterprise-level security and control. Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Education or Windows 10 Enterprise to their users. Now, with Windows 10 Enterprise E3 or A3 and E5 or A5 being available as a true online service, it is available in select channels thus allowing all organizations to take advantage of enterprise-grade Windows 10 features. To compare Windows 10 editions and review pricing, see the following: -- [Compare Windows 10 editions](https://www.microsoft.com/en-us/windowsforbusiness/compare) -- [Enterprise Mobility + Security Pricing Options](https://www.microsoft.com/en-us/cloud-platform/enterprise-mobility-security-pricing) +- [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare) +- [Enterprise Mobility + Security Pricing Options](https://www.microsoft.com/cloud-platform/enterprise-mobility-security-pricing) You can benefit by moving to Windows as an online service in the following ways: @@ -215,12 +215,12 @@ See [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). ## Virtual Desktop Access (VDA) -Subscriptions to Windows 10 Enterprise are also available for virtualized clients. Windows 10 Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Windows Azure or in another [qualified multitenant hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx). +Subscriptions to Windows 10 Enterprise are also available for virtualized clients. Windows 10 Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Windows Azure or in another [qualified multitenant hoster](https://www.microsoft.com/CloudandHosting/licensing_sca.aspx). Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscriptions for VDA. Active Directory-joined and Azure Active Directory-joined clients are supported. See [Enable VDA for Subscription Activation](vda-subscription-activation.md). ## Related topics [Connect domain-joined devices to Azure AD for Windows 10 experiences](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-devices-group-policy/)
                        -[Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare)
                        -[Windows for business](https://www.microsoft.com/en-us/windowsforbusiness/default.aspx)
                        +[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
                        +[Windows for business](https://www.microsoft.com/windowsforbusiness/default.aspx)
                        diff --git a/windows/deployment/windows-autopilot/add-devices.md b/windows/deployment/windows-autopilot/add-devices.md index a8090d1812..6d2dc8e363 100644 --- a/windows/deployment/windows-autopilot/add-devices.md +++ b/windows/deployment/windows-autopilot/add-devices.md @@ -26,7 +26,7 @@ Before deploying a device using Windows Autopilot, the device must be registered ## OEM registration -When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers" section of the [Windows Autopilot information page](https://www.microsoft.com/en-us/windowsforbusiness/windows-autopilot). +When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers" section of the [Windows Autopilot information page](https://www.microsoft.com/windowsforbusiness/windows-autopilot). Before an OEM can register devices on behalf of an organization, the organization must grant the OEM permission to do so. This process is initiated by the OEM, with approval granted by an Azure AD global administrator from the organization. See the "Customer Consent" section of the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#oem-authorization). diff --git a/windows/deployment/windows-autopilot/autopilot-device-guidelines.md b/windows/deployment/windows-autopilot/autopilot-device-guidelines.md index cc781ed87e..563e086966 100644 --- a/windows/deployment/windows-autopilot/autopilot-device-guidelines.md +++ b/windows/deployment/windows-autopilot/autopilot-device-guidelines.md @@ -1,45 +1,46 @@ ---- -title: Windows Autopilot device guidelines -ms.reviewer: -manager: laurawi -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot device guidelines - -**Applies to** - -- Windows 10 - -## Hardware and firmware best practice guidelines for Windows Autopilot - -All devices used with Windows Autopilot should meet the [minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview) for Windows 10. - -The following additional best practices ensure that devices can easily be provisioned by organizations as part of the Windows Autopilot deployment process: -- Ensure that the TPM 2.0 is enabled and in a good state (not in Reduced Functionality Mode) by default on devices intended for Windows Autopilot self-deploying mode. -- The OEM provisions unique tuple info (SmbiosSystemManufacturer, SmbiosSystemProductName, SmbiosSystemSerialNumber) or PKID + SmbiosSystemSerialNumber into the [SMBIOS fields](https://docs.microsoft.com/windows-hardware/drivers/bringup/smbios) per Microsoft specification (Manufacturer, Product Name and Serial Number stored in SMBIOS Type 1 04h, Type 1 05h and Type 1 07h). -- The OEM uploads 4K Hardware Hashes obtained using OA3 Tool RS3+ run in Audit mode on full OS to Microsoft via CBR report prior to shipping devices to an Autopilot customer or channel partner. -- As a best practice, Microsoft requires that OEM shipping drivers are published to Windows Update within 30 days of the CBR being submitted, and system firmware and driver updates are published to Windows Update within 14 days -- The OEM ensures that the PKID provisioned in the SMBIOS is passed on to the channel. - -## Software best practice guidelines for Windows Autopilot - -- The Windows Autopilot device should be preinstalled with only a Windows 10 base image plus drivers and Office 365 Pro Plus Retail (C2R). -- Unless explicitly requested by the customer, no other preinstalled software should be included. - - Per OEM Policy, Windows 10 features, including built-in apps, should not be disabled or removed. - -## Related topics - -[Windows Autopilot customer consent](registration-auth.md)
                        -[Motherboard replacement scenario guidance](autopilot-mbr.md)
                        +--- +title: Windows Autopilot device guidelines +ms.reviewer: +manager: laurawi +description: Windows Autopilot deployment +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Windows Autopilot device guidelines + +**Applies to** + +- Windows 10 + +## Hardware and firmware best practice guidelines for Windows Autopilot + +All devices used with Windows Autopilot should meet the [minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview) for Windows 10. + +The following additional best practices ensure that devices can easily be provisioned by organizations as part of the Windows Autopilot deployment process: +- Ensure that the TPM 2.0 is enabled and in a good state (not in Reduced Functionality Mode) by default on devices intended for Windows Autopilot self-deploying mode. +- The OEM provisions unique tuple info (SmbiosSystemManufacturer, SmbiosSystemProductName, SmbiosSystemSerialNumber) or PKID + SmbiosSystemSerialNumber into the [SMBIOS fields](https://docs.microsoft.com/windows-hardware/drivers/bringup/smbios) per Microsoft specification (Manufacturer, Product Name and Serial Number stored in SMBIOS Type 1 04h, Type 1 05h and Type 1 07h). +- The OEM uploads 4K Hardware Hashes obtained using OA3 Tool RS3+ run in Audit mode on full OS to Microsoft via CBR report prior to shipping devices to an Autopilot customer or channel partner. +- As a best practice, Microsoft requires that OEM shipping drivers are published to Windows Update within 30 days of the CBR being submitted, and system firmware and driver updates are published to Windows Update within 14 days +- The OEM ensures that the PKID provisioned in the SMBIOS is passed on to the channel. + +## Software best practice guidelines for Windows Autopilot + +- The Windows Autopilot device should be preinstalled with only a Windows 10 base image plus drivers and Office 365 Pro Plus Retail (C2R). +- Unless explicitly requested by the customer, no other preinstalled software should be included. + - Per OEM Policy, Windows 10 features, including built-in apps, should not be disabled or removed. + +## Related topics + +[Windows Autopilot customer consent](registration-auth.md)
                        +[Motherboard replacement scenario guidance](autopilot-mbr.md)
                        diff --git a/windows/deployment/windows-autopilot/autopilot-support.md b/windows/deployment/windows-autopilot/autopilot-support.md index b3e02db65f..b93ac48408 100644 --- a/windows/deployment/windows-autopilot/autopilot-support.md +++ b/windows/deployment/windows-autopilot/autopilot-support.md @@ -7,7 +7,8 @@ ms.mktglfcycl: deploy ms.localizationpriority: low ms.sitesec: library ms.pagetype: deploy -audience: itpro author: greg-lindsay +audience: itpro +author: greg-lindsay ms.author: greglin ms.date: 10/31/2018 ms.reviewer: @@ -29,9 +30,8 @@ Before contacting the resources listed below for Windows Autopilot-related issue |---------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | OEM or Channel Partner registering devices as a CSP (via MPC) | Use the help resources available in MPC. Whether you are a named partner or a channel partner (distributor, reseller, SI, etc.), if you’re a CSP registering Autopilot devices through MPC (either manually or through the MPC API), your first-line of support should be the help resources within MPC. | | OEM registering devices using OEM Direct API | Contact MSOEMOPS@microsoft.com. Response time depends on priority:
                        Low – 120 hours
                        Normal – 72 hours
                        High – 24 hours
                        Immediate – 4 hours | -| OEM with a PFE | Reach out to your PFE for support. | | Partners with a Partner Technology Strategist (PTS) | If you have a PTS (whether you’re a CSP or not), you may first try working through your account’s specific Partner Technology Strategist (PTS). | -| Partners with an Ecosystem PM | If you have an Ecosystem PM (whether you’re a CSP or not), you may first try working through your account’s specific Ecosystem PM, especially for technical issues. | +| Partners with an Ecosystem PM | If you have an Ecosystem PM (whether you’re a CSP or not), you may first try working through your account’s specific Ecosystem PM, especially for technical issues. To learn more about Ecosystem PMs and the services they offer, contact epsoinfo@microsoft.com. | | Enterprise customers | Contact your Technical Account Manager (TAM), or Account Technology Strategist (ATS), or Customer Service Support (CSS) representative. | | End-user | Contact your IT administrator. | | Microsoft Partner Center (MPC) users | Use the [help resources](https://partner.microsoft.com/support) available in MPC. | diff --git a/windows/deployment/windows-autopilot/bitlocker.md b/windows/deployment/windows-autopilot/bitlocker.md index 7e85f7099d..234ae17fcc 100644 --- a/windows/deployment/windows-autopilot/bitlocker.md +++ b/windows/deployment/windows-autopilot/bitlocker.md @@ -1,54 +1,54 @@ ---- -title: Setting the BitLocker encryption algorithm for Autopilot devices -ms.reviewer: -manager: laurawi -description: Microsoft Intune provides a comprehensive set of configuration options to manage BitLocker on Windows 10 devices. -keywords: Autopilot, BitLocker, encryption, 256-bit, Windows 10 -ms.prod: w10 -ms.technology: Windows -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -ms.localizationpriority: medium -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Setting the BitLocker encryption algorithm for Autopilot devices - -**Applies to** - -- Windows 10 - -With Windows Autopilot, you can configure the BitLocker encryption settings to be applied before automatic encryption is started. This ensures that the default encrytion algorithm is not applied automatically when this is not the desired setting. Other BitLocker policies that must be applied prior to encryption can also be delivered before automatic BitLocker encryption begins. - -The BitLocker encryption algorithm is used when BitLocker is first enabled, and sets the strength to which full volume encryption should occur. Available encryption algorithms are: AES-CBC 128-bit, AES-CBC 256-bit, XTS-AES 128-bit or XTS-AES 256-bit encryption. The default value is XTS-AES 128-bit encryption. See [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) for information about the recommended encryption algorithms to use. - -To ensure the desired BitLocker encryption algorithm is set before automatic encryption occurs for Autopilot devices: - -1. Configure the [encryption method settings](https://docs.microsoft.com/intune/endpoint-protection-windows-10#windows-encryption) in the Windows 10 Endpoint Protection profile to the desired encryption algorithm. -2. [Assign the policy](https://docs.microsoft.com/intune/device-profile-assign) to your Autopilot device group. - - **IMPORTANT**: The encryption policy must be assigned to **devices** in the group, not users. -3. Enable the Autopilot [Enrollment Status Page](https://docs.microsoft.com/windows/deployment/windows-autopilot/enrollment-status) (ESP) for these devices. - - **IMPORTANT**: If the ESP is not enabled, the policy will not apply before encryption starts. - -An example of Microsoft Intune Windows Encryption settings is shown below. - - ![BitLocker encryption settings](images/bitlocker-encryption.png) - -Note that a device which is encrypted automatically will need to be decrypted prior to changing the encyption algorithm. - -The settings are available under Device Configuration -> Profiles -> Create profile -> Platform = Windows 10 and later, Profile type = Endpoint protection -> Configure -> Windows Encryption -> BitLocker base settings, Configure encryption methods = Enable. - -Note: It is also recommended to set Windows Encryption -> Windows Settings -> Encrypt = **Require**. - -## Requirements - -Windows 10, version 1809 or later. - -## See also - -[Bitlocker overview](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) +--- +title: Setting the BitLocker encryption algorithm for Autopilot devices +ms.reviewer: +manager: laurawi +description: Microsoft Intune provides a comprehensive set of configuration options to manage BitLocker on Windows 10 devices. +keywords: Autopilot, BitLocker, encryption, 256-bit, Windows 10 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +ms.localizationpriority: medium +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Setting the BitLocker encryption algorithm for Autopilot devices + +**Applies to** + +- Windows 10 + +With Windows Autopilot, you can configure the BitLocker encryption settings to be applied before automatic encryption is started. This ensures that the default encrytion algorithm is not applied automatically when this is not the desired setting. Other BitLocker policies that must be applied prior to encryption can also be delivered before automatic BitLocker encryption begins. + +The BitLocker encryption algorithm is used when BitLocker is first enabled, and sets the strength to which full volume encryption should occur. Available encryption algorithms are: AES-CBC 128-bit, AES-CBC 256-bit, XTS-AES 128-bit or XTS-AES 256-bit encryption. The default value is XTS-AES 128-bit encryption. See [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) for information about the recommended encryption algorithms to use. + +To ensure the desired BitLocker encryption algorithm is set before automatic encryption occurs for Autopilot devices: + +1. Configure the [encryption method settings](https://docs.microsoft.com/intune/endpoint-protection-windows-10#windows-encryption) in the Windows 10 Endpoint Protection profile to the desired encryption algorithm. +2. [Assign the policy](https://docs.microsoft.com/intune/device-profile-assign) to your Autopilot device group. + - **IMPORTANT**: The encryption policy must be assigned to **devices** in the group, not users. +3. Enable the Autopilot [Enrollment Status Page](https://docs.microsoft.com/windows/deployment/windows-autopilot/enrollment-status) (ESP) for these devices. + - **IMPORTANT**: If the ESP is not enabled, the policy will not apply before encryption starts. + +An example of Microsoft Intune Windows Encryption settings is shown below. + + ![BitLocker encryption settings](images/bitlocker-encryption.png) + +Note that a device which is encrypted automatically will need to be decrypted prior to changing the encyption algorithm. + +The settings are available under Device Configuration -> Profiles -> Create profile -> Platform = Windows 10 and later, Profile type = Endpoint protection -> Configure -> Windows Encryption -> BitLocker base settings, Configure encryption methods = Enable. + +Note: It is also recommended to set Windows Encryption -> Windows Settings -> Encrypt = **Require**. + +## Requirements + +Windows 10, version 1809 or later. + +## See also + +[Bitlocker overview](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 5b29de8d83..294a31c04b 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -1,850 +1,850 @@ ---- -title: Demonstrate Autopilot deployment -ms.reviewer: -manager: laurawi -description: Step-by-step instructions on how to set-up a Virtual Machine with a Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, upgrade -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article -ms.custom: autopilot ---- - - -# Demonstrate Autopilot deployment - -**Applies to** - -- Windows 10 - -To get started with Windows Autopilot, you should try it out with a virtual machine (VM) or you can use a physical device that will be wiped and then have a fresh install of Windows 10. - -In this topic you'll learn how to set-up a Windows Autopilot deployment for a VM using Hyper-V. Note: Although there are [multiple platforms](administer.md) available to enable Autopilot, this lab primarily uses Intune. - ->Hyper-V and a VM are not required for this lab. You can also use a physical device. However, the instructions assume that you are using a VM. To use a physical device, skip the instructions to install Hyper-V and create a VM. All references to 'device' in the guide refer to the client device, either physical or virtual. - -The following video provides an overview of the process: - -
                        - - ->For a list of terms used in this guide, see the [Glossary](#glossary) section. - -## Prerequisites - -These are the things you'll need to complete this lab: - - - -
                        Windows 10 installation mediaWindows 10 Professional or Enterprise (ISO file), version 1703 or later is required. If you do not already have an ISO to use, a link is provided to download an evaluation version of Windows 10 Enterprise.
                        Internet accessIf you are behind a firewall, see the detailed networking requirements. Otherwise, just ensure that you have a connection to the Internet.
                        Hyper-V or a physical device running Windows 10The guide assumes that you will use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.
                        A Premium Intune accountThis guide will describe how to obtain a free 30-day trial premium account that can be used to complete the lab.
                        - -## Procedures - -A summary of the sections and procedures in the lab is provided below. Follow each section in the order it is presented, skipping the sections that do not apply to you. Optional procedures are provided in the appendix. - -[Verify support for Hyper-V](#verify-support-for-hyper-v) -
                        [Enable Hyper-V](#enable-hyper-v) -
                        [Create a demo VM](#create-a-demo-vm) -
                            [Set ISO file location](#set-iso-file-location) -
                            [Determine network adapter name](#determine-network-adapter-name) -
                            [Use Windows PowerShell to create the demo VM](#use-windows-powershell-to-create-the-demo-vm) -
                            [Install Windows 10](#install-windows-10) -
                        [Capture the hardware ID](#capture-the-hardware-id) -
                        [Reset the VM back to Out-Of-Box-Experience (OOBE)](#reset-the-vm-back-to-out-of-box-experience-oobe) -
                        [Verify subscription level](#verify-subscription-level) -
                        [Configure company branding](#configure-company-branding) -
                        [Configure Microsoft Intune auto-enrollment](#configure-microsoft-intune-auto-enrollment) -
                        [Register your VM](#register-your-vm) -
                            [Autopilot registration using Intune](#autopilot-registration-using-intune) -
                            [Autopilot registration using MSfB](#autopilot-registration-using-msfb) -
                        [Create and assign a Windows Autopilot deployment profile](#create-and-assign-a-windows-autopilot-deployment-profile) -
                            [Create a Windows Autopilot deployment profile using Intune](#create-a-windows-autopilot-deployment-profile-using-intune) -
                               [Assign the profile](#assign-the-profile) -
                            [Create a Windows Autopilot deployment profile using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb) -
                        [See Windows Autopilot in action](#see-windows-autopilot-in-action) -
                        [Remove devices from Autopilot](#remove-devices-from-autopilot) -
                            [Delete (deregister) Autopilot device](#delete-deregister-autopilot-device) -
                        [Appendix A: Verify support for Hyper-V](#appendix-a-verify-support-for-hyper-v) -
                        [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile) -
                            [Add a Win32 app](#add-a-win32-app) -
                               [Prepare the app for Intune](#prepare-the-app-for-intune) -
                               [Create app in Intune](#create-app-in-intune) -
                               [Assign the app to your Intune profile](#assign-the-app-to-your-intune-profile) -
                            [Add Office 365](#add-office-365) -
                               [Create app in Intune](#create-app-in-intune) -
                               [Assign the app to your Intune profile](#assign-the-app-to-your-intune-profile) -
                        [Glossary](#glossary) - -## Verify support for Hyper-V - -If you don't already have Hyper-V, we must first enable this on a computer running Windows 10 or Windows Server (2012 R2 or later). - ->If you already have Hyper-V enabled, skip to the [create a demo VM](#create-a-demo-vm) step. If you are using a physical device instead of a VM, skip to [Install Windows 10](#install-windows-10). - -If you are not sure that your device supports Hyper-V, or you have problems installing Hyper-V, see [appendix A](#appendix-a-verify-support-for-hyper-v) below for details on verifying that Hyper-V can be successfully installed. - -## Enable Hyper-V - -To enable Hyper-V, open an elevated Windows PowerShell prompt and run the following command: - -```powershell -Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All -``` - -This command works on all operating systems that support Hyper-V, but on Windows Server operating systems you must type an additional command (below) to add the Hyper-V Windows PowerShell module and the Hyper-V Manager console. The following command will also install Hyper-V if it isn't already installed, so if you're using Windows Server, you can just type the following command instead of using the Enable-WindowsOptionalFeature command: - -```powershell -Install-WindowsFeature -Name Hyper-V -IncludeManagementTools -``` - -When you are prompted to restart the computer, choose **Yes**. The computer might restart more than once. - ->Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: - - ![hyper-v feature](../images/hyper-v-feature.png) - - ![hyper-v](../images/svr_mgr2.png) - -

                        If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. - -After installation is complete, open Hyper-V Manager by typing **virtmgmt.msc** at an elevated command prompt, or by typing **Hyper-V** in the Start menu search box. - -To read more about Hyper-V, see [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/virtualization/hyper-v-on-windows/about/) and [Hyper-V on Windows Server](https://docs.microsoft.com/windows-server/virtualization/hyper-v/hyper-v-on-windows-server). - -## Create a demo VM - -Now that Hyper-V is enabled, we need to create a VM running Windows 10. We can [create a VM](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/create-virtual-machine) and [virtual network](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/connect-to-network) using Hyper-V Manager, but it is simpler to use Windows PowerShell. - -To use Windows Powershell we just need to know two things: - -1. The location of the Windows 10 ISO file. - - In the example, we assume the location is **c:\iso\win10-eval.iso**. -2. The name of the network interface that connects to the Internet. - - In the example, we use a Windows PowerShell command to determine this automatically. - -After we have set the ISO file location and determined the name of the appropriate network interface, we can install Windows 10. - -### Set ISO file location - -You can download an ISO file for an evaluation version of the latest release of Windows 10 Enterprise [here](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise). -- When asked to select a platform, choose **64 bit**. - -After you download this file, the name will be extremely long (ex: 17763.107.101029-1455.rs5_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso). - -1. So that it is easier to type and remember, rename the file to **win10-eval.iso**. -2. Create a directory on your computer named **c:\iso** and move the **win10-eval.iso** file there, so the path to the file is **c:\iso\win10-eval.iso**. -3. If you wish to use a different name and location for the file, you must modify the Windows PowerShell commands below to use your custom name and directory. - -### Determine network adapter name - -The Get-NetAdaper cmdlet is used below to automatically find the network adapter that is most likely to be the one you use to connect to the Internet. You should test this command first by running the following at an elevated Windows PowerShell prompt: - -```powershell -(Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name -``` - -The output of this command should be the name of the network interface you use to connect to the Internet. Verify that this is the correct interface name. If it is not the correct interface name, you'll need to edit the first command below to use your network interface name. - -For example, if the command above displays Ethernet but you wish to use Ethernet2, then the first command below would be New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName **Ethernet2**. - -### Use Windows PowerShell to create the demo VM - -All VM data will be created under the current path in your PowerShell prompt. Consider navigating into a new folder before running the following commands. - ->[!IMPORTANT] ->**VM switch**: a VM switch is how Hyper-V connects VMs to a network.

                        If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."

                        If you have never created an external VM switch before, then just run the commands below. - -```powershell -New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name -New-VM -Name WindowsAutopilot -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutopilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutopilotExternal -Add-VMDvdDrive -Path c:\iso\win10-eval.iso -VMName WindowsAutopilot -Start-VM -VMName WindowsAutopilot -``` - -After entering these commands, connect to the VM that you just created and wait for a prompt to press a key and boot from the DVD. You can connect to the VM by double-clicking it in Hyper-V Manager. - -See the sample output below. In this sample, the VM is created under the **c:\autopilot** directory and the vmconnect.exe command is used (which is only available on Windows Server). If you installed Hyper-V on Windows 10, use Hyper-V Manager to connect to your VM. - -

                        -PS C:\autopilot> dir c:\iso
-
-
-    Directory: C:\iso
-
-
-Mode                LastWriteTime         Length Name
-----                -------------         ------ ----
--a----        3/12/2019   2:46 PM     4627343360 win10-eval.iso
-
-PS C:\autopilot> (Get-NetAdapter |?{$.Status -eq "Up" -and !$.Virtual}).Name
-Ethernet
-PS C:\autopilot> New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$.Status -eq "Up" -and !$.Virtual}).Name
-
-Name              SwitchType NetAdapterInterfaceDescription
-----              ---------- ------------------------------
-AutopilotExternal External   Intel(R) Ethernet Connection (2) I218-LM
-
-PS C:\autopilot> New-VM -Name WindowsAutopilot -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutopilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutopilotExternal
-
-Name             State CPUUsage(%) MemoryAssigned(M) Uptime   Status             Version
-----             ----- ----------- ----------------- ------   ------             -------
-WindowsAutopilot Off   0           0                 00:00:00 Operating normally 8.0
-
-PS C:\autopilot> Add-VMDvdDrive -Path c:\iso\win10-eval.iso -VMName WindowsAutopilot
-PS C:\autopilot> Start-VM -VMName WindowsAutopilot
-PS C:\autopilot> vmconnect.exe localhost WindowsAutopilot
-PS C:\autopilot> dir
-
-    Directory: C:\autopilot
-
-Mode                LastWriteTime         Length Name
-----                -------------         ------ ----
-d-----        3/12/2019   3:15 PM                VMData
-d-----        3/12/2019   3:42 PM                VMs
-
-PS C:\autopilot>
-
                        - -### Install Windows 10 - -Ensure the VM booted from the installation ISO, click **Next** then click **Install now** and complete the Windows installation process. See the following examples: - - ![Windows setup](images/winsetup1.png) - ![Windows setup](images/winsetup2.png) - ![Windows setup](images/winsetup3.png) - ![Windows setup](images/winsetup4.png) - ![Windows setup](images/winsetup5.png) - ![Windows setup](images/winsetup6.png) - ->After the VM restarts, during OOBE, it’s fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example: - - ![Windows setup](images/winsetup7.png) - -Once the installation is complete, sign in and verify that you are at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state. You will create multiple checkpoints throughout this lab, which can be used later to go through the process again. - - ![Windows setup](images/winsetup8.png) - -To create your first checkpoint, open an elevated Windows PowerShell prompt on the computer running Hyper-V (not on the VM) and run the following: - -```powershell -Checkpoint-VM -Name WindowsAutopilot -SnapshotName "Finished Windows install" -``` - -Click on the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see **Finished Windows Install** listed in the Checkpoints pane. - -## Capture the hardware ID - ->NOTE: Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you are acting as the OEM (capturing the 4K HH), but you’re not going to use the OA3 Tool to capture the full 4K HH for various reasons (you’d have to install the OA3 tool, your device couldn’t have a volume license version of Windows, it’s a more complicated process than using a PS script, etc.). Instead, you’ll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool. - -Follow these steps to run the PS script: - -1. Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you are using a VM or a physical device: - - ```powershell - md c:\HWID - Set-Location c:\HWID - Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force - Install-Script -Name Get-WindowsAutopilotInfo -Force - $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts" - Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv - ``` - -When you are prompted to install the NuGet package, choose **Yes**. - -See the sample output below. - -
                        -PS C:\> md c:\HWID
-
-    Directory: C:\
-
-Mode                LastWriteTime         Length Name
-----                -------------         ------ ----
-d-----        3/14/2019  11:33 AM                HWID
-
-PS C:\> Set-Location c:\HWID
-PS C:\HWID> Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force
-PS C:\HWID> Install-Script -Name Get-WindowsAutopilotInfo -Force
-
-NuGet provider is required to continue
-PowerShellGet requires NuGet provider version '2.8.5.201' or newer to interact with NuGet-based repositories. The NuGet
- provider must be available in 'C:\Program Files\PackageManagement\ProviderAssemblies' or
-'C:\Users\user1\AppData\Local\PackageManagement\ProviderAssemblies'. You can also install the NuGet provider by running
- 'Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force'. Do you want PowerShellGet to install and
-import the NuGet provider now?
-[Y] Yes  [N] No  [S] Suspend  [?] Help (default is "Y"): Y
-PS C:\HWID> $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
-PS C:\HWID> Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv
-PS C:\HWID> dir
-
-    Directory: C:\HWID
-
-Mode                LastWriteTime         Length Name
-----                -------------         ------ ----
--a----        3/14/2019  11:33 AM           8184 AutopilotHWID.csv
-
-PS C:\HWID>
-
                        - -Verify that there is an **AutopilotHWID.csv** file in the **c:\HWID** directory that is about 8 KB in size. This file contains the complete 4K HH. - -**Note**: Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you are curious. The file format will be validated when it is imported into Autopilot. An example of the data in this file is shown below. - -![Serial number and hardware hash](images/hwid.png) - -You will need to upload this data into Intune to register your device for Autopilot, so it needs to be transferred to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM). - -If you have trouble copying and pasting the file, just view the contents in Notepad on the VM and copy the text into Notepad outside the VM. Do not use another text editor to do this. - ->[!NOTE] ->When copying and pasting to or from VMs, avoid clicking other things with your mouse cursor between the copy and paste process as this can empty or overwrite the clipboard and require that you start over. Go directly from copy to paste. - -## Reset the VM back to Out-Of-Box-Experience (OOBE) - -With the hardware ID captured in a file, prepare your Virtual Machine for Windows Autopilot deployment by resetting it back to OOBE. - -On the Virtual Machine, go to **Settings > Update & Security > Recovery** and click on **Get started** under **Reset this PC**. -Select **Remove everything** and **Just remove my files**. Finally, click on **Reset**. - -![Reset this PC final prompt](images/autopilot-reset-prompt.jpg) - -Resetting the VM or device can take a while. Proceed to the next step (verify subscription level) during the reset process. - -![Reset this PC screen capture](images/autopilot-reset-progress.jpg) - -## Verify subscription level - -For this lab, you need an AAD Premium subscription. You can tell if you have a Premium subscription by navigating to the [MDM enrollment configuration](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) blade. See the following example: - -**Azure Active Directory** > **Mobility (MDM and MAM)** > **Microsoft Intune** - -![MDM and Intune](images/mdm-intune2.png) - -If the configuration blade shown above does not appear, it’s likely that you don’t have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium. - -To convert your Intune trial account to a free Premium trial account, navigate to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5. - -![Reset this PC final prompt](images/aad-lic1.png) - -## Configure company branding - -If you already have company branding configured in Azure Active Directory, you can skip this step. - ->[!IMPORTANT] ->Make sure to sign-in with a Global Administrator account. - -Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding), click on **Configure** and configure any type of company branding you'd like to see during the OOBE. - -![Configure company branding](images/branding.png) - -When you are finished, click **Save**. - ->[!NOTE] ->Changes to company branding can take up to 30 minutes to apply. - -## Configure Microsoft Intune auto-enrollment - -If you already have MDM auto-enrollment configured in Azure Active Directory, you can skip this step. - -Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) and select **Microsoft Intune**. If you do not see Microsoft Intune, click **Add application** and choose **Intune**. - -For the purposes of this demo, select **All** under the **MDM user scope** and click **Save**. - -![MDM user scope in the Mobility blade](images/autopilot-aad-mdm.png) - -## Register your VM - -Your VM (or device) can be registered either via Intune or Microsoft Store for Business (MSfB). Both processes are shown here, but only pick one for purposes of this lab. We highly recommend using Intune rather than MSfB. - -### Autopilot registration using Intune - -1. In Intune in the Azure portal, choose **Device enrollment** > **Windows enrollment** > **Devices** > **Import**. - - ![Intune device import](images/device-import.png) - - >[!NOTE] - >If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared. - -2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It’s okay if other fields (Windows Product ID) are left blank. - - ![HWID CSV](images/hwid-csv.png) - - You should receive confirmation that the file is formatted correctly before uploading it, as shown above. - -3. Click **Import** and wait until the import process completes. This can take up to 15 minutes. - -4. Click **Sync** to sync the device you just registered. Wait a few moments before refreshing to verify your VM or device has been added. See the following example. - - ![Import HWID](images/import-vm.png) - -### Autopilot registration using MSfB - ->[!IMPORTANT] ->If you've already registered your VM (or device) using Intune, then skip this step. - -Optional: see the following video for an overview of the process. - -  - -> [!video https://www.youtube.com/embed/IpLIZU_j7Z0] - -First, you need a MSfB account. You can use the same one you created above for Intune, or follow [these instructions](https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview) to create a new one. - -Next, sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/en-us/store) using your test account by clicking **Sign in** in the upper-right-corner of the main page. - -Select **Manage** from the top menu, then click the **Windows Autopilot Deployment Program** link under the **Devices** card. See the following example: - -![Microsoft Store for Business](images/msfb.png) - -Click the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added. - -![Devices](images/msfb-device.png) - -## Create and assign a Windows Autopilot deployment profile - ->[!IMPORTANT] ->Autopilot profiles can be created and assigned to your registered VM or device either through Intune or MSfB. Both processes are shown here, but only pick one for purposes of this lab: - -Pick one: -- [Create profiles using Intune](#create-a-windows-autopilot-deployment-profile-using-intune) -- [Create profiles using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb) - -### Create a Windows Autopilot deployment profile using Intune - ->[!NOTE] ->Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list first: - -![Devices](images/intune-devices.png) - ->The example above lists both a physical device and a VM. Your list should only include only one of these. - -To create a Windows Autopilot profile, select **Device enrollment** > **Windows enrollment** > **Deployment profiles** - -![Deployment profiles](images/deployment-profiles.png) - -Click on **Create profile**. - -![Create deployment profile](images/create-profile.png) - -On the **Create profile** blade, use the following values: - -| Setting | Value | -|---|---| -| Name | Autopilot Lab profile | -| Description | blank | -| Convert all targeted devices to Autopilot | No | -| Deployment mode | User-driven | -| Join to Azure AD as | Azure AD joined | - -Click on **Out-of-box experience (OOBE)** and configure the following settings: - -| Setting | Value | -|---|---| -| EULA | Hide | -| Privacy Settings | Hide | -| Hide change account options | Hide | -| User account type | Standard | -| Apply device name template | No | - -See the following example: - -![Deployment profile](images/profile.png) - -Click on **OK** and then click on **Create**. - ->If you want to add an app to your profile via Intune, the OPTIONAL steps for doing so can be found in [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile). - -#### Assign the profile - -Profiles can only be assigned to Groups, so first you must create a group that contains the devices to which the profile should be applied. This guide will provide simple instructions to assign a profile, for more detailed instructions, see [Create an Autopilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an Autopilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group), as optional reading. - -To create a Group, open the Azure Portal and select **Azure Active Directory** > **Groups** > **All groups**: - -![All groups](images/all-groups.png) - -Select New group from the Groups blade to open the new groups UI. Select the “Security” group type, name the group, and select the “Assigned” membership type: - -Before clicking **Create**, expand the **Members** panel, click your device's serial number (it will then appear under **Selected members**) and then click **Select** to add that device to this group. - -![New group](images/new-group.png) - -Now click **Create** to finish creating the new group. - -Click on **All groups** and click **Refresh** to verify that your new group has been successfully created. - -With a group created containing your device, you can now go back and assign your profile to that group. Navigate back to the Intune page in the Azure portal (one way is to type **Intune** in the top banner search bar and select **Intune** from the results). - -From Intune, select **Device enrollment** > **Windows enrollment** > **Deployment Profiles** to open the profile blade. Click on the name of the profile you previously created (Autopilot Lab profile) to open the details blade for that profile: - -![Lab profile](images/deployment-profiles2.png) - -Under **Manage**, click **Assignments**, and then with the **Include** tab highlighted, expand the **Select groups** blade and click **AP Lab Group 1** (the group will appear under **Selected members**). - -![Include group](images/include-group.png) - -Click **Select** and then click **Save**. - -![Include group](images/include-group2.png) - -It’s also possible to assign specific users to a profile, but we will not cover this scenario in the lab. For more detailed information, see [Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot). - -### Create a Windows Autopilot deployment profile using MSfB - -If you have already created and assigned a profile via Intune by using the steps immediately above, then skip this section. - -A [video](https://www.youtube.com/watch?v=IpLIZU_j7Z0) is available that covers the steps required to create and assign profiles in MSfB. These steps are also summarized below. - -First, sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/manage/dashboard) using the Intune account you initially created for this lab. - -Click **Manage** from the top menu, then click **Devices** from the left navigation tree. - -![MSfB manage](images/msfb-manage.png) - -Click the **Windows Autopilot Deployment Program** link in the **Devices** tile. - -To CREATE the profile: - -Select your device from the **Devices** list: - -![MSfB create](images/msfb-create1.png) - -On the Autopilot deployment dropdown menu, select **Create new profile**: - -![MSfB create](images/msfb-create2.png) - -Name the profile, choose your desired settings, and then click **Create**: - -![MSfB create](images/msfb-create3.png) - -The new profile is added to the Autopilot deployment list. - -To ASSIGN the profile: - -To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab, then select the profile you want to assign from the **Autopilot deployment** dropdown menu as shown: - -![MSfB assign](images/msfb-assign1.png) - -Confirm the profile was successfully assigned to the intended device by checking the contents of the **Profile** column: - -![MSfB assign](images/msfb-assign2.png) - ->[!IMPORTANT] ->The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device. - -## See Windows Autopilot in action - -If you shut down your VM after the last reset, it’s time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**: - -![Device status](images/device-status.png) - -Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up. - ->[!TIP] ->If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you’re expecting. If you do not see the Autopilot OOBE experience, then reset the device again (Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Click on Reset). - -- Ensure your device has an internet connection. -- Turn on the device -- Verify that the appropriate OOBE screens (with appropriate Company Branding) appear. You should see the region selection screen, the keyboard selection screen, and the second keyboard selection screen (which you can skip). - -![OOBE sign-in page](images/autopilot-oobe.jpg) - -Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device. Go into the Intune Azure portal, and select **Devices > All devices**, then **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated. - -![Device enabled](images/enabled-device.png) - -Once you select a language and a keyboard layout, your company branded sign-in screen should appear. Provide your Azure Active Directory credentials and you're all done. - -Windows Autopilot will now take over to automatically join your device into Azure Active Directory and enroll it to Microsoft Intune. Use the checkpoints you've created to go through this process again with different settings. - -## Remove devices from Autopilot - -To use the device (or VM) for other purposes after completion of this lab, you will need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it. Instructions for deregistering devices can be found [here](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [here](https://docs.microsoft.com/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) and below. - -### Delete (deregister) Autopilot device - -You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into your Intune Azure portal, then navigate to **Intune > Devices > All Devices**. Select the checkbox next to the device you want to delete, then click the Delete button along the top menu. - -![Delete device](images/delete-device1.png) - -Click **X** when challenged to complete the operation: - -![Delete device](images/delete-device2.png) - -This will remove the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot, so the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**. - -![Delete device](images/delete-device3.png) - -The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune. Note: A device will only appear in the All devices list once it has booted. The latter (Windows Autopilot Deployment Program > Devices) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune. - -To remove the device from the Autopilot program, select the device and click Delete. - -![Delete device](images/delete-device4.png) - -A warning message appears reminding you to first remove the device from Intune, which we previously did. - -![Delete device](images/delete-device5.png) - -At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, click the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program: - -![Delete device](images/delete-device6.png) - -Once the device no longer appears, you are free to reuse it for other purposes. - -If you also (optionally) want to remove your device from AAD, navigate to **Azure Active Directory > Devices > All Devices**, select your device, and click the delete button: - -![Delete device](images/delete-device7.png) - -## Appendix A: Verify support for Hyper-V - -Starting with Windows 8, the host computer’s microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information. - -To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, scroll down, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example: - -
                        -C:>systeminfo
-
-...
-Hyper-V Requirements:      VM Monitor Mode Extensions: Yes
-                           Virtualization Enabled In Firmware: Yes
-                           Second Level Address Translation: Yes
-                           Data Execution Prevention Available: Yes
-
                        - -In this example, the computer supports SLAT and Hyper-V. - ->If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting will depend on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings. - -You can also identify Hyper-V support using [tools](https://blogs.msdn.microsoft.com/taylorb/2008/06/19/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v/) provided by the processor manufacturer, the [msinfo32](https://technet.microsoft.com/library/cc731397.aspx) tool, or you can download the [coreinfo](https://technet.microsoft.com/sysinternals/cc835722) utility and run it, as shown in the following example: - -
                        -C:>coreinfo -v
-
-Coreinfo v3.31 - Dump information on system CPU and memory topology
-Copyright (C) 2008-2014 Mark Russinovich
-Sysinternals - www.sysinternals.com
-
-Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
-Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
-Microcode signature: 0000001B
-HYPERVISOR      -       Hypervisor is present
-VMX             *       Supports Intel hardware-assisted virtualization
-EPT             *       Supports Intel extended page tables (SLAT)
-
                        - -Note: A 64-bit operating system is required to run Hyper-V. - -## Appendix B: Adding apps to your profile - -### Add a Win32 app - -#### Prepare the app for Intune - -Before we can pull an application into Intune to make it part of our AP profile, we need to “package” the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool). After downloading the tool, gather the following three bits of information to use the tool: - -1. The source folder for your application -2. The name of the setup executable file -3. The output folder for the new file - -For the purposes of this lab, we’ll use the Notepad++ tool as our Win32 app. - -Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available) and then opy the file to a known location, such as C:\Notepad++msi. - -Run the IntuneWinAppUtil tool, supplying answers to the three questions, for example: - -![Add app](images/app01.png) - -After the tool finishes running, you should have an .intunewin file in the Output folder, which you can now upload into Intune using the following steps. - -#### Create app in Intune - -Log into the Azure portal and select **Intune**. - -Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. - -![Add app](images/app02.png) - -Under **App Type**, select **Windows app (Win32)**: - -![Add app](images/app03.png) - -On the **App package file** blade, browse to the **npp.7.6.3.installer.x64.intunewin** file in your output folder, open it, then click **OK**: - -![Add app](images/app04.png) - -On the **App Information Configure** blade, provide a friendly name, description, and publisher, such as: - -![Add app](images/app05.png) - -On the **Program Configuration** blade, supply the install and uninstall commands: - -Install: msiexec /i "npp.7.6.3.installer.x64.msi" /q -Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q - -NOTE: Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool) automatically generated them when it converted the .msi file into a .intunewin file. - -![Add app](images/app06.png) - -Simply using an install command like “notepad++.exe /S” will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn’t actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). - -Click **OK** to save your input and activate the **Requirements** blade. - -On the **Requirements Configuration** blade, specify the **OS architecture** and the **Minimum OS version**: - -![Add app](images/app07.png) - -Next, configure the **Detection rules**. For our purposes, we will select manual format: - -![Add app](images/app08.png) - -Click **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule: - -![Add app](images/app09.png) - -Click **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration. - -**Return codes**: For our purposes, leave the return codes at their default values: - -![Add app](images/app10.png) - -Click **OK** to exit. - -You may skip configuring the final **Scope (Tags)** blade. - -Click the **Add** button to finalize and save your app package. - -Once the indicator message says the addition has completed. - -![Add app](images/app11.png) - -You will be able to find your app in your app list: - -![Add app](images/app12.png) - -#### Assign the app to your Intune profile - -**NOTE**: The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here. - -In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu: - -![Add app](images/app13.png) - -Select **Add Group** to open the **Add group** pane that is related to the app. - -For our purposes, select *8Required** from the **Assignment type** dropdown menu: - ->**Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. - -Select **Included Groups** and assign the groups you previously created that will use this app: - -![Add app](images/app14.png) - -![Add app](images/app15.png) - -In the **Select groups** pane, click the **Select** button. - -In the **Assign group** pane, select **OK**. - -In the **Add group** pane, select **OK**. - -In the app **Assignments** pane, select **Save**. - -![Add app](images/app16.png) - -At this point, you have completed steps to add a Win32 app to Intune. - -For more information on adding adds to Intune, see [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps-win32-app-management). - -### Add Office 365 - -#### Create app in Intune - -Log into the Azure portal and select **Intune**. - -Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. - -![Add app](images/app17.png) - -Under **App Type**, select **Office 365 Suite > Windows 10**: - -![Add app](images/app18.png) - -Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this labe we have only selected Excel: - -![Add app](images/app19.png) - -Click **OK**. - -In the **App Suite Information** pane, enter a unique suite name, and a suitable description. - ->Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal. - -![Add app](images/app20.png) - -Click **OK**. - -In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection would be fine for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**: - -![Add app](images/app21.png) - -Click **OK** and then click **Add**. - -#### Assign the app to your Intune profile - -**NOTE**: The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here. - -In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu: - -![Add app](images/app22.png) - -Select **Add Group** to open the **Add group** pane that is related to the app. - -For our purposes, select **Required** from the **Assignment type** dropdown menu: - ->**Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. - -Select **Included Groups** and assign the groups you previously created that will use this app: - -![Add app](images/app23.png) - -![Add app](images/app24.png) - -In the **Select groups** pane, click the **Select** button. - -In the **Assign group** pane, select **OK**. - -In the **Add group** pane, select **OK**. - -In the app **Assignments** pane, select **Save**. - -![Add app](images/app25.png) - -At this point, you have completed steps to add Office to Intune. - -For more information on adding Office apps to Intune, see [Assign Office 365 apps to Windows 10 devices with Microsoft Intune](https://docs.microsoft.com/intune/apps-add-office365). - -If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list, although it could take several minutes to populate: - -![Add app](images/app26.png) - -## Glossary - - - - - - - - - - - - - - -
                        OEMOriginal Equipment Manufacturer
                        CSVComma Separated Values
                        MPCMicrosoft Partner Center
                        CSPCloud Solution Provider
                        MSfBMicrosoft Store for Business
                        AADAzure Active Directory
                        4K HH4K Hardware Hash
                        CBRComputer Build Report
                        ECEnterprise Commerce (server)
                        DDSDevice Directory Service
                        OOBEOut of the Box Experience
                        VMVirtual Machine
                        +--- +title: Demonstrate Autopilot deployment +ms.reviewer: +manager: laurawi +description: Step-by-step instructions on how to set-up a Virtual Machine with a Windows Autopilot deployment +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, upgrade +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: deploy +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +ms.custom: autopilot +--- + + +# Demonstrate Autopilot deployment + +**Applies to** + +- Windows 10 + +To get started with Windows Autopilot, you should try it out with a virtual machine (VM) or you can use a physical device that will be wiped and then have a fresh install of Windows 10. + +In this topic you'll learn how to set-up a Windows Autopilot deployment for a VM using Hyper-V. Note: Although there are [multiple platforms](administer.md) available to enable Autopilot, this lab primarily uses Intune. + +>Hyper-V and a VM are not required for this lab. You can also use a physical device. However, the instructions assume that you are using a VM. To use a physical device, skip the instructions to install Hyper-V and create a VM. All references to 'device' in the guide refer to the client device, either physical or virtual. + +The following video provides an overview of the process: + +
                        + + +>For a list of terms used in this guide, see the [Glossary](#glossary) section. + +## Prerequisites + +These are the things you'll need to complete this lab: + + + +
                        Windows 10 installation mediaWindows 10 Professional or Enterprise (ISO file), version 1703 or later is required. If you do not already have an ISO to use, a link is provided to download an evaluation version of Windows 10 Enterprise.
                        Internet accessIf you are behind a firewall, see the detailed networking requirements. Otherwise, just ensure that you have a connection to the Internet.
                        Hyper-V or a physical device running Windows 10The guide assumes that you will use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.
                        A Premium Intune accountThis guide will describe how to obtain a free 30-day trial premium account that can be used to complete the lab.
                        + +## Procedures + +A summary of the sections and procedures in the lab is provided below. Follow each section in the order it is presented, skipping the sections that do not apply to you. Optional procedures are provided in the appendix. + +[Verify support for Hyper-V](#verify-support-for-hyper-v) +
                        [Enable Hyper-V](#enable-hyper-v) +
                        [Create a demo VM](#create-a-demo-vm) +
                            [Set ISO file location](#set-iso-file-location) +
                            [Determine network adapter name](#determine-network-adapter-name) +
                            [Use Windows PowerShell to create the demo VM](#use-windows-powershell-to-create-the-demo-vm) +
                            [Install Windows 10](#install-windows-10) +
                        [Capture the hardware ID](#capture-the-hardware-id) +
                        [Reset the VM back to Out-Of-Box-Experience (OOBE)](#reset-the-vm-back-to-out-of-box-experience-oobe) +
                        [Verify subscription level](#verify-subscription-level) +
                        [Configure company branding](#configure-company-branding) +
                        [Configure Microsoft Intune auto-enrollment](#configure-microsoft-intune-auto-enrollment) +
                        [Register your VM](#register-your-vm) +
                            [Autopilot registration using Intune](#autopilot-registration-using-intune) +
                            [Autopilot registration using MSfB](#autopilot-registration-using-msfb) +
                        [Create and assign a Windows Autopilot deployment profile](#create-and-assign-a-windows-autopilot-deployment-profile) +
                            [Create a Windows Autopilot deployment profile using Intune](#create-a-windows-autopilot-deployment-profile-using-intune) +
                               [Assign the profile](#assign-the-profile) +
                            [Create a Windows Autopilot deployment profile using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb) +
                        [See Windows Autopilot in action](#see-windows-autopilot-in-action) +
                        [Remove devices from Autopilot](#remove-devices-from-autopilot) +
                            [Delete (deregister) Autopilot device](#delete-deregister-autopilot-device) +
                        [Appendix A: Verify support for Hyper-V](#appendix-a-verify-support-for-hyper-v) +
                        [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile) +
                            [Add a Win32 app](#add-a-win32-app) +
                               [Prepare the app for Intune](#prepare-the-app-for-intune) +
                               [Create app in Intune](#create-app-in-intune) +
                               [Assign the app to your Intune profile](#assign-the-app-to-your-intune-profile) +
                            [Add Office 365](#add-office-365) +
                               [Create app in Intune](#create-app-in-intune) +
                               [Assign the app to your Intune profile](#assign-the-app-to-your-intune-profile) +
                        [Glossary](#glossary) + +## Verify support for Hyper-V + +If you don't already have Hyper-V, we must first enable this on a computer running Windows 10 or Windows Server (2012 R2 or later). + +>If you already have Hyper-V enabled, skip to the [create a demo VM](#create-a-demo-vm) step. If you are using a physical device instead of a VM, skip to [Install Windows 10](#install-windows-10). + +If you are not sure that your device supports Hyper-V, or you have problems installing Hyper-V, see [appendix A](#appendix-a-verify-support-for-hyper-v) below for details on verifying that Hyper-V can be successfully installed. + +## Enable Hyper-V + +To enable Hyper-V, open an elevated Windows PowerShell prompt and run the following command: + +```powershell +Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All +``` + +This command works on all operating systems that support Hyper-V, but on Windows Server operating systems you must type an additional command (below) to add the Hyper-V Windows PowerShell module and the Hyper-V Manager console. The following command will also install Hyper-V if it isn't already installed, so if you're using Windows Server, you can just type the following command instead of using the Enable-WindowsOptionalFeature command: + +```powershell +Install-WindowsFeature -Name Hyper-V -IncludeManagementTools +``` + +When you are prompted to restart the computer, choose **Yes**. The computer might restart more than once. + +>Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: + + ![hyper-v feature](../images/hyper-v-feature.png) + + ![hyper-v](../images/svr_mgr2.png) + +

                        If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. + +After installation is complete, open Hyper-V Manager by typing **virtmgmt.msc** at an elevated command prompt, or by typing **Hyper-V** in the Start menu search box. + +To read more about Hyper-V, see [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/virtualization/hyper-v-on-windows/about/) and [Hyper-V on Windows Server](https://docs.microsoft.com/windows-server/virtualization/hyper-v/hyper-v-on-windows-server). + +## Create a demo VM + +Now that Hyper-V is enabled, we need to create a VM running Windows 10. We can [create a VM](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/create-virtual-machine) and [virtual network](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/connect-to-network) using Hyper-V Manager, but it is simpler to use Windows PowerShell. + +To use Windows Powershell we just need to know two things: + +1. The location of the Windows 10 ISO file. + - In the example, we assume the location is **c:\iso\win10-eval.iso**. +2. The name of the network interface that connects to the Internet. + - In the example, we use a Windows PowerShell command to determine this automatically. + +After we have set the ISO file location and determined the name of the appropriate network interface, we can install Windows 10. + +### Set ISO file location + +You can download an ISO file for an evaluation version of the latest release of Windows 10 Enterprise [here](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise). +- When asked to select a platform, choose **64 bit**. + +After you download this file, the name will be extremely long (ex: 17763.107.101029-1455.rs5_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso). + +1. So that it is easier to type and remember, rename the file to **win10-eval.iso**. +2. Create a directory on your computer named **c:\iso** and move the **win10-eval.iso** file there, so the path to the file is **c:\iso\win10-eval.iso**. +3. If you wish to use a different name and location for the file, you must modify the Windows PowerShell commands below to use your custom name and directory. + +### Determine network adapter name + +The Get-NetAdaper cmdlet is used below to automatically find the network adapter that is most likely to be the one you use to connect to the Internet. You should test this command first by running the following at an elevated Windows PowerShell prompt: + +```powershell +(Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name +``` + +The output of this command should be the name of the network interface you use to connect to the Internet. Verify that this is the correct interface name. If it is not the correct interface name, you'll need to edit the first command below to use your network interface name. + +For example, if the command above displays Ethernet but you wish to use Ethernet2, then the first command below would be New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName **Ethernet2**. + +### Use Windows PowerShell to create the demo VM + +All VM data will be created under the current path in your PowerShell prompt. Consider navigating into a new folder before running the following commands. + +>[!IMPORTANT] +>**VM switch**: a VM switch is how Hyper-V connects VMs to a network.

                        If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."

                        If you have never created an external VM switch before, then just run the commands below. + +```powershell +New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name +New-VM -Name WindowsAutopilot -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutopilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutopilotExternal +Add-VMDvdDrive -Path c:\iso\win10-eval.iso -VMName WindowsAutopilot +Start-VM -VMName WindowsAutopilot +``` + +After entering these commands, connect to the VM that you just created and wait for a prompt to press a key and boot from the DVD. You can connect to the VM by double-clicking it in Hyper-V Manager. + +See the sample output below. In this sample, the VM is created under the **c:\autopilot** directory and the vmconnect.exe command is used (which is only available on Windows Server). If you installed Hyper-V on Windows 10, use Hyper-V Manager to connect to your VM. + +

                        +PS C:\autopilot> dir c:\iso
+
+
+    Directory: C:\iso
+
+
+Mode                LastWriteTime         Length Name
+----                -------------         ------ ----
+-a----        3/12/2019   2:46 PM     4627343360 win10-eval.iso
+
+PS C:\autopilot> (Get-NetAdapter |?{$.Status -eq "Up" -and !$.Virtual}).Name
+Ethernet
+PS C:\autopilot> New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$.Status -eq "Up" -and !$.Virtual}).Name
+
+Name              SwitchType NetAdapterInterfaceDescription
+----              ---------- ------------------------------
+AutopilotExternal External   Intel(R) Ethernet Connection (2) I218-LM
+
+PS C:\autopilot> New-VM -Name WindowsAutopilot -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutopilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutopilotExternal
+
+Name             State CPUUsage(%) MemoryAssigned(M) Uptime   Status             Version
+----             ----- ----------- ----------------- ------   ------             -------
+WindowsAutopilot Off   0           0                 00:00:00 Operating normally 8.0
+
+PS C:\autopilot> Add-VMDvdDrive -Path c:\iso\win10-eval.iso -VMName WindowsAutopilot
+PS C:\autopilot> Start-VM -VMName WindowsAutopilot
+PS C:\autopilot> vmconnect.exe localhost WindowsAutopilot
+PS C:\autopilot> dir
+
+    Directory: C:\autopilot
+
+Mode                LastWriteTime         Length Name
+----                -------------         ------ ----
+d-----        3/12/2019   3:15 PM                VMData
+d-----        3/12/2019   3:42 PM                VMs
+
+PS C:\autopilot>
+
                        + +### Install Windows 10 + +Ensure the VM booted from the installation ISO, click **Next** then click **Install now** and complete the Windows installation process. See the following examples: + + ![Windows setup](images/winsetup1.png) + ![Windows setup](images/winsetup2.png) + ![Windows setup](images/winsetup3.png) + ![Windows setup](images/winsetup4.png) + ![Windows setup](images/winsetup5.png) + ![Windows setup](images/winsetup6.png) + +>After the VM restarts, during OOBE, it’s fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example: + + ![Windows setup](images/winsetup7.png) + +Once the installation is complete, sign in and verify that you are at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state. You will create multiple checkpoints throughout this lab, which can be used later to go through the process again. + + ![Windows setup](images/winsetup8.png) + +To create your first checkpoint, open an elevated Windows PowerShell prompt on the computer running Hyper-V (not on the VM) and run the following: + +```powershell +Checkpoint-VM -Name WindowsAutopilot -SnapshotName "Finished Windows install" +``` + +Click on the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see **Finished Windows Install** listed in the Checkpoints pane. + +## Capture the hardware ID + +>NOTE: Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you are acting as the OEM (capturing the 4K HH), but you’re not going to use the OA3 Tool to capture the full 4K HH for various reasons (you’d have to install the OA3 tool, your device couldn’t have a volume license version of Windows, it’s a more complicated process than using a PS script, etc.). Instead, you’ll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool. + +Follow these steps to run the PS script: + +1. Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you are using a VM or a physical device: + + ```powershell + md c:\HWID + Set-Location c:\HWID + Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force + Install-Script -Name Get-WindowsAutopilotInfo -Force + $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts" + Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv + ``` + +When you are prompted to install the NuGet package, choose **Yes**. + +See the sample output below. + +
                        +PS C:\> md c:\HWID
+
+    Directory: C:\
+
+Mode                LastWriteTime         Length Name
+----                -------------         ------ ----
+d-----        3/14/2019  11:33 AM                HWID
+
+PS C:\> Set-Location c:\HWID
+PS C:\HWID> Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force
+PS C:\HWID> Install-Script -Name Get-WindowsAutopilotInfo -Force
+
+NuGet provider is required to continue
+PowerShellGet requires NuGet provider version '2.8.5.201' or newer to interact with NuGet-based repositories. The NuGet
+ provider must be available in 'C:\Program Files\PackageManagement\ProviderAssemblies' or
+'C:\Users\user1\AppData\Local\PackageManagement\ProviderAssemblies'. You can also install the NuGet provider by running
+ 'Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force'. Do you want PowerShellGet to install and
+import the NuGet provider now?
+[Y] Yes  [N] No  [S] Suspend  [?] Help (default is "Y"): Y
+PS C:\HWID> $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
+PS C:\HWID> Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv
+PS C:\HWID> dir
+
+    Directory: C:\HWID
+
+Mode                LastWriteTime         Length Name
+----                -------------         ------ ----
+-a----        3/14/2019  11:33 AM           8184 AutopilotHWID.csv
+
+PS C:\HWID>
+
                        + +Verify that there is an **AutopilotHWID.csv** file in the **c:\HWID** directory that is about 8 KB in size. This file contains the complete 4K HH. + +**Note**: Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you are curious. The file format will be validated when it is imported into Autopilot. An example of the data in this file is shown below. + +![Serial number and hardware hash](images/hwid.png) + +You will need to upload this data into Intune to register your device for Autopilot, so it needs to be transferred to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM). + +If you have trouble copying and pasting the file, just view the contents in Notepad on the VM and copy the text into Notepad outside the VM. Do not use another text editor to do this. + +>[!NOTE] +>When copying and pasting to or from VMs, avoid clicking other things with your mouse cursor between the copy and paste process as this can empty or overwrite the clipboard and require that you start over. Go directly from copy to paste. + +## Reset the VM back to Out-Of-Box-Experience (OOBE) + +With the hardware ID captured in a file, prepare your Virtual Machine for Windows Autopilot deployment by resetting it back to OOBE. + +On the Virtual Machine, go to **Settings > Update & Security > Recovery** and click on **Get started** under **Reset this PC**. +Select **Remove everything** and **Just remove my files**. Finally, click on **Reset**. + +![Reset this PC final prompt](images/autopilot-reset-prompt.jpg) + +Resetting the VM or device can take a while. Proceed to the next step (verify subscription level) during the reset process. + +![Reset this PC screen capture](images/autopilot-reset-progress.jpg) + +## Verify subscription level + +For this lab, you need an AAD Premium subscription. You can tell if you have a Premium subscription by navigating to the [MDM enrollment configuration](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) blade. See the following example: + +**Azure Active Directory** > **Mobility (MDM and MAM)** > **Microsoft Intune** + +![MDM and Intune](images/mdm-intune2.png) + +If the configuration blade shown above does not appear, it’s likely that you don’t have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium. + +To convert your Intune trial account to a free Premium trial account, navigate to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5. + +![Reset this PC final prompt](images/aad-lic1.png) + +## Configure company branding + +If you already have company branding configured in Azure Active Directory, you can skip this step. + +>[!IMPORTANT] +>Make sure to sign-in with a Global Administrator account. + +Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding), click on **Configure** and configure any type of company branding you'd like to see during the OOBE. + +![Configure company branding](images/branding.png) + +When you are finished, click **Save**. + +>[!NOTE] +>Changes to company branding can take up to 30 minutes to apply. + +## Configure Microsoft Intune auto-enrollment + +If you already have MDM auto-enrollment configured in Azure Active Directory, you can skip this step. + +Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) and select **Microsoft Intune**. If you do not see Microsoft Intune, click **Add application** and choose **Intune**. + +For the purposes of this demo, select **All** under the **MDM user scope** and click **Save**. + +![MDM user scope in the Mobility blade](images/autopilot-aad-mdm.png) + +## Register your VM + +Your VM (or device) can be registered either via Intune or Microsoft Store for Business (MSfB). Both processes are shown here, but only pick one for purposes of this lab. We highly recommend using Intune rather than MSfB. + +### Autopilot registration using Intune + +1. In Intune in the Azure portal, choose **Device enrollment** > **Windows enrollment** > **Devices** > **Import**. + + ![Intune device import](images/device-import.png) + + >[!NOTE] + >If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared. + +2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It’s okay if other fields (Windows Product ID) are left blank. + + ![HWID CSV](images/hwid-csv.png) + + You should receive confirmation that the file is formatted correctly before uploading it, as shown above. + +3. Click **Import** and wait until the import process completes. This can take up to 15 minutes. + +4. Click **Sync** to sync the device you just registered. Wait a few moments before refreshing to verify your VM or device has been added. See the following example. + + ![Import HWID](images/import-vm.png) + +### Autopilot registration using MSfB + +>[!IMPORTANT] +>If you've already registered your VM (or device) using Intune, then skip this step. + +Optional: see the following video for an overview of the process. + +  + +> [!video https://www.youtube.com/embed/IpLIZU_j7Z0] + +First, you need a MSfB account. You can use the same one you created above for Intune, or follow [these instructions](https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview) to create a new one. + +Next, sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/en-us/store) using your test account by clicking **Sign in** in the upper-right-corner of the main page. + +Select **Manage** from the top menu, then click the **Windows Autopilot Deployment Program** link under the **Devices** card. See the following example: + +![Microsoft Store for Business](images/msfb.png) + +Click the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added. + +![Devices](images/msfb-device.png) + +## Create and assign a Windows Autopilot deployment profile + +>[!IMPORTANT] +>Autopilot profiles can be created and assigned to your registered VM or device either through Intune or MSfB. Both processes are shown here, but only pick one for purposes of this lab: + +Pick one: +- [Create profiles using Intune](#create-a-windows-autopilot-deployment-profile-using-intune) +- [Create profiles using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb) + +### Create a Windows Autopilot deployment profile using Intune + +>[!NOTE] +>Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list first: + +![Devices](images/intune-devices.png) + +>The example above lists both a physical device and a VM. Your list should only include only one of these. + +To create a Windows Autopilot profile, select **Device enrollment** > **Windows enrollment** > **Deployment profiles** + +![Deployment profiles](images/deployment-profiles.png) + +Click on **Create profile**. + +![Create deployment profile](images/create-profile.png) + +On the **Create profile** blade, use the following values: + +| Setting | Value | +|---|---| +| Name | Autopilot Lab profile | +| Description | blank | +| Convert all targeted devices to Autopilot | No | +| Deployment mode | User-driven | +| Join to Azure AD as | Azure AD joined | + +Click on **Out-of-box experience (OOBE)** and configure the following settings: + +| Setting | Value | +|---|---| +| EULA | Hide | +| Privacy Settings | Hide | +| Hide change account options | Hide | +| User account type | Standard | +| Apply device name template | No | + +See the following example: + +![Deployment profile](images/profile.png) + +Click on **OK** and then click on **Create**. + +>If you want to add an app to your profile via Intune, the OPTIONAL steps for doing so can be found in [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile). + +#### Assign the profile + +Profiles can only be assigned to Groups, so first you must create a group that contains the devices to which the profile should be applied. This guide will provide simple instructions to assign a profile, for more detailed instructions, see [Create an Autopilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an Autopilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group), as optional reading. + +To create a Group, open the Azure Portal and select **Azure Active Directory** > **Groups** > **All groups**: + +![All groups](images/all-groups.png) + +Select New group from the Groups blade to open the new groups UI. Select the “Security” group type, name the group, and select the “Assigned” membership type: + +Before clicking **Create**, expand the **Members** panel, click your device's serial number (it will then appear under **Selected members**) and then click **Select** to add that device to this group. + +![New group](images/new-group.png) + +Now click **Create** to finish creating the new group. + +Click on **All groups** and click **Refresh** to verify that your new group has been successfully created. + +With a group created containing your device, you can now go back and assign your profile to that group. Navigate back to the Intune page in the Azure portal (one way is to type **Intune** in the top banner search bar and select **Intune** from the results). + +From Intune, select **Device enrollment** > **Windows enrollment** > **Deployment Profiles** to open the profile blade. Click on the name of the profile you previously created (Autopilot Lab profile) to open the details blade for that profile: + +![Lab profile](images/deployment-profiles2.png) + +Under **Manage**, click **Assignments**, and then with the **Include** tab highlighted, expand the **Select groups** blade and click **AP Lab Group 1** (the group will appear under **Selected members**). + +![Include group](images/include-group.png) + +Click **Select** and then click **Save**. + +![Include group](images/include-group2.png) + +It’s also possible to assign specific users to a profile, but we will not cover this scenario in the lab. For more detailed information, see [Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot). + +### Create a Windows Autopilot deployment profile using MSfB + +If you have already created and assigned a profile via Intune by using the steps immediately above, then skip this section. + +A [video](https://www.youtube.com/watch?v=IpLIZU_j7Z0) is available that covers the steps required to create and assign profiles in MSfB. These steps are also summarized below. + +First, sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/manage/dashboard) using the Intune account you initially created for this lab. + +Click **Manage** from the top menu, then click **Devices** from the left navigation tree. + +![MSfB manage](images/msfb-manage.png) + +Click the **Windows Autopilot Deployment Program** link in the **Devices** tile. + +To CREATE the profile: + +Select your device from the **Devices** list: + +![MSfB create](images/msfb-create1.png) + +On the Autopilot deployment dropdown menu, select **Create new profile**: + +![MSfB create](images/msfb-create2.png) + +Name the profile, choose your desired settings, and then click **Create**: + +![MSfB create](images/msfb-create3.png) + +The new profile is added to the Autopilot deployment list. + +To ASSIGN the profile: + +To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab, then select the profile you want to assign from the **Autopilot deployment** dropdown menu as shown: + +![MSfB assign](images/msfb-assign1.png) + +Confirm the profile was successfully assigned to the intended device by checking the contents of the **Profile** column: + +![MSfB assign](images/msfb-assign2.png) + +>[!IMPORTANT] +>The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device. + +## See Windows Autopilot in action + +If you shut down your VM after the last reset, it’s time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**: + +![Device status](images/device-status.png) + +Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up. + +>[!TIP] +>If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you’re expecting. If you do not see the Autopilot OOBE experience, then reset the device again (Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Click on Reset). + +- Ensure your device has an internet connection. +- Turn on the device +- Verify that the appropriate OOBE screens (with appropriate Company Branding) appear. You should see the region selection screen, the keyboard selection screen, and the second keyboard selection screen (which you can skip). + +![OOBE sign-in page](images/autopilot-oobe.jpg) + +Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device. Go into the Intune Azure portal, and select **Devices > All devices**, then **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated. + +![Device enabled](images/enabled-device.png) + +Once you select a language and a keyboard layout, your company branded sign-in screen should appear. Provide your Azure Active Directory credentials and you're all done. + +Windows Autopilot will now take over to automatically join your device into Azure Active Directory and enroll it to Microsoft Intune. Use the checkpoints you've created to go through this process again with different settings. + +## Remove devices from Autopilot + +To use the device (or VM) for other purposes after completion of this lab, you will need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it. Instructions for deregistering devices can be found [here](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [here](https://docs.microsoft.com/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) and below. + +### Delete (deregister) Autopilot device + +You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into your Intune Azure portal, then navigate to **Intune > Devices > All Devices**. Select the checkbox next to the device you want to delete, then click the Delete button along the top menu. + +![Delete device](images/delete-device1.png) + +Click **X** when challenged to complete the operation: + +![Delete device](images/delete-device2.png) + +This will remove the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot, so the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**. + +![Delete device](images/delete-device3.png) + +The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune. Note: A device will only appear in the All devices list once it has booted. The latter (Windows Autopilot Deployment Program > Devices) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune. + +To remove the device from the Autopilot program, select the device and click Delete. + +![Delete device](images/delete-device4.png) + +A warning message appears reminding you to first remove the device from Intune, which we previously did. + +![Delete device](images/delete-device5.png) + +At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, click the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program: + +![Delete device](images/delete-device6.png) + +Once the device no longer appears, you are free to reuse it for other purposes. + +If you also (optionally) want to remove your device from AAD, navigate to **Azure Active Directory > Devices > All Devices**, select your device, and click the delete button: + +![Delete device](images/delete-device7.png) + +## Appendix A: Verify support for Hyper-V + +Starting with Windows 8, the host computer’s microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information. + +To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, scroll down, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example: + +
                        +C:>systeminfo
+
+...
+Hyper-V Requirements:      VM Monitor Mode Extensions: Yes
+                           Virtualization Enabled In Firmware: Yes
+                           Second Level Address Translation: Yes
+                           Data Execution Prevention Available: Yes
+
                        + +In this example, the computer supports SLAT and Hyper-V. + +>If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting will depend on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings. + +You can also identify Hyper-V support using [tools](https://blogs.msdn.microsoft.com/taylorb/2008/06/19/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v/) provided by the processor manufacturer, the [msinfo32](https://technet.microsoft.com/library/cc731397.aspx) tool, or you can download the [coreinfo](https://technet.microsoft.com/sysinternals/cc835722) utility and run it, as shown in the following example: + +
                        +C:>coreinfo -v
+
+Coreinfo v3.31 - Dump information on system CPU and memory topology
+Copyright (C) 2008-2014 Mark Russinovich
+Sysinternals - www.sysinternals.com
+
+Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
+Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
+Microcode signature: 0000001B
+HYPERVISOR      -       Hypervisor is present
+VMX             *       Supports Intel hardware-assisted virtualization
+EPT             *       Supports Intel extended page tables (SLAT)
+
                        + +Note: A 64-bit operating system is required to run Hyper-V. + +## Appendix B: Adding apps to your profile + +### Add a Win32 app + +#### Prepare the app for Intune + +Before we can pull an application into Intune to make it part of our AP profile, we need to “package” the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool). After downloading the tool, gather the following three bits of information to use the tool: + +1. The source folder for your application +2. The name of the setup executable file +3. The output folder for the new file + +For the purposes of this lab, we’ll use the Notepad++ tool as our Win32 app. + +Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available) and then opy the file to a known location, such as C:\Notepad++msi. + +Run the IntuneWinAppUtil tool, supplying answers to the three questions, for example: + +![Add app](images/app01.png) + +After the tool finishes running, you should have an .intunewin file in the Output folder, which you can now upload into Intune using the following steps. + +#### Create app in Intune + +Log into the Azure portal and select **Intune**. + +Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. + +![Add app](images/app02.png) + +Under **App Type**, select **Windows app (Win32)**: + +![Add app](images/app03.png) + +On the **App package file** blade, browse to the **npp.7.6.3.installer.x64.intunewin** file in your output folder, open it, then click **OK**: + +![Add app](images/app04.png) + +On the **App Information Configure** blade, provide a friendly name, description, and publisher, such as: + +![Add app](images/app05.png) + +On the **Program Configuration** blade, supply the install and uninstall commands: + +Install: msiexec /i "npp.7.6.3.installer.x64.msi" /q +Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q + +NOTE: Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool) automatically generated them when it converted the .msi file into a .intunewin file. + +![Add app](images/app06.png) + +Simply using an install command like “notepad++.exe /S” will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn’t actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). + +Click **OK** to save your input and activate the **Requirements** blade. + +On the **Requirements Configuration** blade, specify the **OS architecture** and the **Minimum OS version**: + +![Add app](images/app07.png) + +Next, configure the **Detection rules**. For our purposes, we will select manual format: + +![Add app](images/app08.png) + +Click **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule: + +![Add app](images/app09.png) + +Click **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration. + +**Return codes**: For our purposes, leave the return codes at their default values: + +![Add app](images/app10.png) + +Click **OK** to exit. + +You may skip configuring the final **Scope (Tags)** blade. + +Click the **Add** button to finalize and save your app package. + +Once the indicator message says the addition has completed. + +![Add app](images/app11.png) + +You will be able to find your app in your app list: + +![Add app](images/app12.png) + +#### Assign the app to your Intune profile + +**NOTE**: The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here. + +In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu: + +![Add app](images/app13.png) + +Select **Add Group** to open the **Add group** pane that is related to the app. + +For our purposes, select *8Required** from the **Assignment type** dropdown menu: + +>**Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. + +Select **Included Groups** and assign the groups you previously created that will use this app: + +![Add app](images/app14.png) + +![Add app](images/app15.png) + +In the **Select groups** pane, click the **Select** button. + +In the **Assign group** pane, select **OK**. + +In the **Add group** pane, select **OK**. + +In the app **Assignments** pane, select **Save**. + +![Add app](images/app16.png) + +At this point, you have completed steps to add a Win32 app to Intune. + +For more information on adding adds to Intune, see [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps-win32-app-management). + +### Add Office 365 + +#### Create app in Intune + +Log into the Azure portal and select **Intune**. + +Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. + +![Add app](images/app17.png) + +Under **App Type**, select **Office 365 Suite > Windows 10**: + +![Add app](images/app18.png) + +Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this labe we have only selected Excel: + +![Add app](images/app19.png) + +Click **OK**. + +In the **App Suite Information** pane, enter a unique suite name, and a suitable description. + +>Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal. + +![Add app](images/app20.png) + +Click **OK**. + +In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection would be fine for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**: + +![Add app](images/app21.png) + +Click **OK** and then click **Add**. + +#### Assign the app to your Intune profile + +**NOTE**: The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here. + +In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu: + +![Add app](images/app22.png) + +Select **Add Group** to open the **Add group** pane that is related to the app. + +For our purposes, select **Required** from the **Assignment type** dropdown menu: + +>**Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. + +Select **Included Groups** and assign the groups you previously created that will use this app: + +![Add app](images/app23.png) + +![Add app](images/app24.png) + +In the **Select groups** pane, click the **Select** button. + +In the **Assign group** pane, select **OK**. + +In the **Add group** pane, select **OK**. + +In the app **Assignments** pane, select **Save**. + +![Add app](images/app25.png) + +At this point, you have completed steps to add Office to Intune. + +For more information on adding Office apps to Intune, see [Assign Office 365 apps to Windows 10 devices with Microsoft Intune](https://docs.microsoft.com/intune/apps-add-office365). + +If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list, although it could take several minutes to populate: + +![Add app](images/app26.png) + +## Glossary + + + + + + + + + + + + + + +
                        OEMOriginal Equipment Manufacturer
                        CSVComma Separated Values
                        MPCMicrosoft Partner Center
                        CSPCloud Solution Provider
                        MSfBMicrosoft Store for Business
                        AADAzure Active Directory
                        4K HH4K Hardware Hash
                        CBRComputer Build Report
                        ECEnterprise Commerce (server)
                        DDSDevice Directory Service
                        OOBEOut of the Box Experience
                        VMVirtual Machine
                        diff --git a/windows/deployment/windows-autopilot/enrollment-status.md b/windows/deployment/windows-autopilot/enrollment-status.md index 6c5c118bec..11a393eada 100644 --- a/windows/deployment/windows-autopilot/enrollment-status.md +++ b/windows/deployment/windows-autopilot/enrollment-status.md @@ -1,39 +1,39 @@ ---- -title: Windows Autopilot Enrollment Status Page -ms.reviewer: -manager: laurawi -description: Gives an overview of the Enrollment Status Page capabilities, configuration -keywords: Autopilot Plug and Forget, Windows 10 -ms.prod: w10 -ms.technology: Windows -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -ms.localizationpriority: medium -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot Enrollment Status Page - -**Applies to** - -- Windows 10, version 1803 and later - -The Enrollment Status Page (ESP) displays the status of the complete device configuration process when an MDM managed user signs into a device for the very first time. The ESP will help users understand the progress of device provisioning and ensures the device has met the organizations desired state before the user can access the desktop for the first time. - -The ESP will track the installation of applications, security policies, certificates and network connections. Within Intune, an administrator can deploy ESP profiles to a licensed Intune user and configure specific settings within the ESP profile; a few of these settings are: force the installation of specified applications, allow users to collect troubleshooting logs, specify what a user can do if device setup fails. For more information, see how to set up the [Enrollment Status Page in Intune](https://docs.microsoft.com/intune/windows-enrollment-status). - - ![Enrollment Status Page](images/enrollment-status-page.png) - - -## More information - -For more information on configuring the Enrollment Status Page, see the [Microsoft Intune documentation](https://docs.microsoft.com/intune/windows-enrollment-status).
                        -For details about the underlying implementation, see the [FirstSyncStatus details in the DMClient CSP documentation](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp).
                        -For more information about blocking for app installation: -- [Blocking for app installation using Enrollment Status Page](https://blogs.technet.microsoft.com/mniehaus/2018/12/06/blocking-for-app-installation-using-enrollment-status-page/). -- [Support Tip: Office C2R installation is now tracked during ESP](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Office-C2R-installation-is-now-tracked-during-ESP/ba-p/295514). +--- +title: Windows Autopilot Enrollment Status Page +ms.reviewer: +manager: laurawi +description: Gives an overview of the Enrollment Status Page capabilities, configuration +keywords: Autopilot Plug and Forget, Windows 10 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +ms.localizationpriority: medium +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Windows Autopilot Enrollment Status Page + +**Applies to** + +- Windows 10, version 1803 and later + +The Enrollment Status Page (ESP) displays the status of the complete device configuration process when an MDM managed user signs into a device for the very first time. The ESP will help users understand the progress of device provisioning and ensures the device has met the organizations desired state before the user can access the desktop for the first time. + +The ESP will track the installation of applications, security policies, certificates and network connections. Within Intune, an administrator can deploy ESP profiles to a licensed Intune user and configure specific settings within the ESP profile; a few of these settings are: force the installation of specified applications, allow users to collect troubleshooting logs, specify what a user can do if device setup fails. For more information, see how to set up the [Enrollment Status Page in Intune](https://docs.microsoft.com/intune/windows-enrollment-status). + + ![Enrollment Status Page](images/enrollment-status-page.png) + + +## More information + +For more information on configuring the Enrollment Status Page, see the [Microsoft Intune documentation](https://docs.microsoft.com/intune/windows-enrollment-status).
                        +For details about the underlying implementation, see the [FirstSyncStatus details in the DMClient CSP documentation](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp).
                        +For more information about blocking for app installation: +- [Blocking for app installation using Enrollment Status Page](https://blogs.technet.microsoft.com/mniehaus/2018/12/06/blocking-for-app-installation-using-enrollment-status-page/). +- [Support Tip: Office C2R installation is now tracked during ESP](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Office-C2R-installation-is-now-tracked-during-ESP/ba-p/295514). diff --git a/windows/deployment/windows-autopilot/existing-devices.md b/windows/deployment/windows-autopilot/existing-devices.md index f514184445..0e14ae0b89 100644 --- a/windows/deployment/windows-autopilot/existing-devices.md +++ b/windows/deployment/windows-autopilot/existing-devices.md @@ -55,7 +55,7 @@ See the following examples. ### Create the JSON file >[!TIP] ->To run the following commands on a computer running Windows Server 2012/2012 R2 or Windows 7/8.1, you must first download and install the [Windows Management Framework](https://www.microsoft.com/en-us/download/details.aspx?id=54616). +>To run the following commands on a computer running Windows Server 2012/2012 R2 or Windows 7/8.1, you must first download and install the [Windows Management Framework](https://www.microsoft.com/download/details.aspx?id=54616). 1. On an Internet connected Windows PC or Server open an elevated Windows PowerShell command window 2. Enter the following lines to install the necessary modules diff --git a/windows/deployment/windows-autopilot/index.md b/windows/deployment/windows-autopilot/index.md index 61d676afdc..efeffc2e04 100644 --- a/windows/deployment/windows-autopilot/index.md +++ b/windows/deployment/windows-autopilot/index.md @@ -1,76 +1,77 @@ ---- -title: Windows Autopilot deployment -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot deployment - -**Applies to** - -- Windows 10 - -Windows Autopilot is a zero-touch, self-service Windows deployment platform introduced with Windows 10, version 1703. The Windows Autopilot process runs immediately after powering on a new computer for the first time, enabling employees to configure new devices to be business-ready with just a few clicks. - -This guide is intended for use by an IT-specialist, system architect, or business decision maker. The guide provides information about how Windows Autopilot deployment works, including detailed requirements, deployment scenarios, and platform capabilities. The document highlights options that are available to you when planning a modern, cloud-joined Windows 10 deployment strategy. Links are provided to detailed step by step configuration procedures. - -## In this guide - - -
                        What's new Windows Autopilot is always being updated with new features! Check this topic to read about the latests capabilities. -
                        - -### Understanding Windows Autopilot - - -
                        Overview of Windows AutopilotA review of Windows Autopilot is provided with a video walkthrough. Benefits and general requirements are discussed. -
                        RequirementsDetailed software, network, licensiing, and configuration requirments are provided. -
                        Scenarios and CapabilitiesA summary of Windows Autopilot deployment scenarios and capabilities. -
                        Get startedInterested in trying out Autopilot? See this step-by-step walkthrough to test Windows Autopilot on a virtual machine or physical device with a free 30-day trial premium Intune account. -
                        - -### Deployment scenarios - - -
                        User-driven modeRequirements and validation steps for deploying a new Azure Active Directory (AAD) joined or hybrid AAD-joined Windows 10 device are provided. -
                        Self-deploying modeRequirements and validation steps for deploying a new Windows 10 device with little to no user interaction are provided. -
                        Windows Autopilot ResetUsing Windows Autopilot Reset, a device can be restored to its original settings, taking it back to a business-ready state. Both local and remote reset scenarios are discussed. -
                        Windows Autopilot for white glove deploymentRequirements and procedures are described that enable additional policies and apps to be delivered to a Windows Autopilot device. -
                        Support for existing devicesThis topic describes how Windows Autopilot can be used to convert Windows 7 or Windows 8.1 domain-joined computers to AAD-joined computers running Windows 10. -
                        - -### Using Windows Autopilot - - -
                        Registering devicesThe process of registering a device with the Windows Autopilot deployment service is described. -
                        Configuring device profilesThe device profile settings that specifie its behavior when it is deployed are described. -
                        Enrollment status pageSettings that are available on the Enrollment Status Page are described. -
                        Bitlocker encryption Available options for configuring BitLocker on Windows Autopilot devices are described. -
                        Troubleshooting Windows AutopilotDiagnotic event information and troubleshooting procedures are provided. -
                        Known issuesA list of current known issues and solutions is provided. -
                        - -### Support topics - - -
                        FAQFrequently asked questions on several topics are provided. -
                        Support contactsSupport information is provided. -
                        Registration authorizationThis article discusses how a CSP partner or OEM can obtain customer authorization to register Windows Autopilot devices. -
                        Motherboard replacementInformation about how to deal with Autopilot registration and device repair issues is provided. -
                        - -## Related topics - -[Windows Autopilot](https://www.microsoft.com/windowsforbusiness/windows-autopilot) +--- +title: Windows Autopilot deployment +description: Windows Autopilot deployment +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +ms.reviewer: mniehaus +manager: laurawi +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Windows Autopilot deployment + +**Applies to** + +- Windows 10 + +Windows Autopilot is a zero-touch, self-service Windows deployment platform introduced with Windows 10, version 1703. The Windows Autopilot process runs immediately after powering on a new computer for the first time, enabling employees to configure new devices to be business-ready with just a few clicks. + +This guide is intended for use by an IT-specialist, system architect, or business decision maker. The guide provides information about how Windows Autopilot deployment works, including detailed requirements, deployment scenarios, and platform capabilities. The document highlights options that are available to you when planning a modern, cloud-joined Windows 10 deployment strategy. Links are provided to detailed step by step configuration procedures. + +## In this guide + + +
                        What's new Windows Autopilot is always being updated with new features! Check this topic to read about the latests capabilities. +
                        + +### Understanding Windows Autopilot + + +
                        Overview of Windows AutopilotA review of Windows Autopilot is provided with a video walkthrough. Benefits and general requirements are discussed. +
                        RequirementsDetailed software, network, licensiing, and configuration requirments are provided. +
                        Scenarios and CapabilitiesA summary of Windows Autopilot deployment scenarios and capabilities. +
                        Get startedInterested in trying out Autopilot? See this step-by-step walkthrough to test Windows Autopilot on a virtual machine or physical device with a free 30-day trial premium Intune account. +
                        + +### Deployment scenarios + + +
                        User-driven modeRequirements and validation steps for deploying a new Azure Active Directory (AAD) joined or hybrid AAD-joined Windows 10 device are provided. +
                        Self-deploying modeRequirements and validation steps for deploying a new Windows 10 device with little to no user interaction are provided. +
                        Windows Autopilot ResetUsing Windows Autopilot Reset, a device can be restored to its original settings, taking it back to a business-ready state. Both local and remote reset scenarios are discussed. +
                        Windows Autopilot for white glove deploymentRequirements and procedures are described that enable additional policies and apps to be delivered to a Windows Autopilot device. +
                        Support for existing devicesThis topic describes how Windows Autopilot can be used to convert Windows 7 or Windows 8.1 domain-joined computers to AAD-joined computers running Windows 10. +
                        + +### Using Windows Autopilot + + +
                        Registering devicesThe process of registering a device with the Windows Autopilot deployment service is described. +
                        Configuring device profilesThe device profile settings that specifie its behavior when it is deployed are described. +
                        Enrollment status pageSettings that are available on the Enrollment Status Page are described. +
                        BitLocker encryption Available options for configuring BitLocker on Windows Autopilot devices are described. +
                        Troubleshooting Windows AutopilotDiagnotic event information and troubleshooting procedures are provided. +
                        Known issuesA list of current known issues and solutions is provided. +
                        + +### Support topics + + +
                        FAQFrequently asked questions on several topics are provided. +
                        Support contactsSupport information is provided. +
                        Registration authorizationThis article discusses how a CSP partner or OEM can obtain customer authorization to register Windows Autopilot devices. +
                        Motherboard replacementInformation about how to deal with Autopilot registration and device repair issues is provided. +
                        + +## Related topics + +[Windows Autopilot](https://www.microsoft.com/windowsforbusiness/windows-autopilot) diff --git a/windows/deployment/windows-autopilot/known-issues.md b/windows/deployment/windows-autopilot/known-issues.md index d1f538dd46..9ba16cd6f9 100644 --- a/windows/deployment/windows-autopilot/known-issues.md +++ b/windows/deployment/windows-autopilot/known-issues.md @@ -1,46 +1,62 @@ ---- -title: Windows Autopilot known issues -ms.reviewer: -manager: laurawi -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot - known issues - -**Applies to** - -- Windows 10 - - -
                        IssueMore information -
                        The following known issues are resolved by installing the July 26, 2019 KB4505903 update (OS Build 18362.267): - -- Windows Autopilot white glove does not work for a non-English OS and you see a red screen that says "Success." -- Windows Autopilot reports an AUTOPILOTUPDATE error during OOBE after sysprep, reset or other variations. This typically happens if you reset the OS or used a custom sysprepped image. -- BitLocker encryption is not correctly configured. Ex: BitLocker didn’t get an expected notification after policies were applied to begin encryption. -- You are unable to install UWP apps from the Microsoft Store, causing failures during Windows Autopilot. If you are deploying Company Portal as a blocking app during Windows Autopilot ESP, you’ve probably seen this error. -- A user is not granted administrator rights in the Windows Autopilot user-driven Hybrid Azure AD join scenario. This is another non-English OS issue. -Download and install the KB4505903 update.

                        See the section: How to get this update for information on specific release channels you can use to obtain the update. -
                        White glove gives a red screen and the Microsoft-Windows-User Device Registration/Admin event log displays HResult error code 0x801C03F3This can happen if Azure AD can’t find an AAD device object for the device that you are trying to deploy. This will occur if you manually delete the object. To fix it, remove the device from AAD, Intune, and Autopilot, then re-register it with Autopilot, which will recreate the AAD device object.
                        -
                        To obtain troubleshooting logs use: Mdmdiagnosticstool.exe -area Autopilot;TPM -cab c:\autopilot.cab -
                        White glove gives a red screenWhite glove is not supported on a VM. -
                        Error importing Windows Autopilot devices from a .csv fileEnsure that you have not edited the .csv file in Microsoft Excel or an editor other than Notepad. Some of these editors can introduce extra characters causing the file format to be invalid. -
                        Windows Autopilot for existing devices does not follow the Autopilot OOBE experience.Ensure that the JSON profile file is saved in ANSI/ASCII format, not Unicode or UTF-8. -
                        Something went wrong is displayed page during OOBE.The client is likely unable to access all the required AAD/MSA-related URLs. For more information, see Networking requirements. -
                        - -## Related topics - -[Diagnose MDM failures in Windows 10](https://docs.microsoft.com/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10)
                        -[Troubleshooting Windows Autopilot](troubleshooting.md) +--- +title: Windows Autopilot known issues +ms.reviewer: +manager: laurawi +description: Windows Autopilot deployment +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Windows Autopilot - known issues + +**Applies to** + +- Windows 10 + + +
                        IssueMore information +
                        The following known issue will be resolved by installing the KB4517211 update, due to be released in late September 2019: + +- TPM attestation fails on Windows 10 1903 due to missing AKI extension in EK certificate. (An additional validation added in Windows 10 1903 to check that the TPM EK certs had the proper attributes according to the TCG specifications uncovered that a number of them don’t, so that validation will be removed). +Download and install the KB4517211 update.

                        This update is currently pending release. +
                        The following known issues are resolved by installing the August 30, 2019 KB4512941 update (OS Build 18362.329): + +- Windows Autopilot for existing devices feature does not properly suppress “Activities” page during OOBE. (Because of this, you’ll see that extra page during OOBE). +- TPM attestation state is not cleared by sysprep /generalize, causing TPM attestation failure during later OOBE flow. (This isn’t a particularly common issue, but you could run into it while testing if you are running sysprep /generalize and then rebooting or reimaging the device to go back through an Autopilot white glove or self-deploying scenario). +- TPM attestation may fail if the device has a valid AIK cert but no EK cert. (This is related to the previous item). +- If TPM attestation fails during the Windows Autopilot white glove process, the landing page appears to be hung. (Basically, the white glove landing page, where you click “Provision” to start the white glove process, isn’t reporting errors properly). +- TPM attestation fails on newer Infineon TPMs (firmware version > 7.69). (Prior to this fix, only a specific list of firmware versions was accepted). +- Device naming templates may truncate the computer name at 14 characters instead of 15. +- Assigned Access policies cause a reboot which can interfere with the configuration of single-app kiosk devices. +Download and install the KB4512941 update.

                        See the section: How to get this update for information on specific release channels you can use to obtain the update. +
                        The following known issues are resolved by installing the July 26, 2019 KB4505903 update (OS Build 18362.267): + +- Windows Autopilot white glove does not work for a non-English OS and you see a red screen that says "Success." +- Windows Autopilot reports an AUTOPILOTUPDATE error during OOBE after sysprep, reset or other variations. This typically happens if you reset the OS or used a custom sysprepped image. +- BitLocker encryption is not correctly configured. Ex: BitLocker didn’t get an expected notification after policies were applied to begin encryption. +- You are unable to install UWP apps from the Microsoft Store, causing failures during Windows Autopilot. If you are deploying Company Portal as a blocking app during Windows Autopilot ESP, you’ve probably seen this error. +- A user is not granted administrator rights in the Windows Autopilot user-driven Hybrid Azure AD join scenario. This is another non-English OS issue. +Download and install the KB4505903 update.

                        See the section: How to get this update for information on specific release channels you can use to obtain the update. + +
                        White glove gives a red screen and the Microsoft-Windows-User Device Registration/Admin event log displays HResult error code 0x801C03F3This can happen if Azure AD can’t find an AAD device object for the device that you are trying to deploy. This will occur if you manually delete the object. To fix it, remove the device from AAD, Intune, and Autopilot, then re-register it with Autopilot, which will recreate the AAD device object.
                        +
                        To obtain troubleshooting logs use: Mdmdiagnosticstool.exe -area Autopilot;TPM -cab c:\autopilot.cab +
                        White glove gives a red screenWhite glove is not supported on a VM. +
                        Error importing Windows Autopilot devices from a .csv fileEnsure that you have not edited the .csv file in Microsoft Excel or an editor other than Notepad. Some of these editors can introduce extra characters causing the file format to be invalid. +
                        Windows Autopilot for existing devices does not follow the Autopilot OOBE experience.Ensure that the JSON profile file is saved in ANSI/ASCII format, not Unicode or UTF-8. +
                        Something went wrong is displayed page during OOBE.The client is likely unable to access all the required AAD/MSA-related URLs. For more information, see Networking requirements. +
                        + +## Related topics + +[Diagnose MDM failures in Windows 10](https://docs.microsoft.com/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10)
                        +[Troubleshooting Windows Autopilot](troubleshooting.md) diff --git a/windows/deployment/windows-autopilot/self-deploying.md b/windows/deployment/windows-autopilot/self-deploying.md index 34ca5dcbde..939b4ac431 100644 --- a/windows/deployment/windows-autopilot/self-deploying.md +++ b/windows/deployment/windows-autopilot/self-deploying.md @@ -1,73 +1,74 @@ ---- -title: Windows Autopilot Self-Deploying mode -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.reviewer: mniehaus -manager: laurawi -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Windows Autopilot Self-Deploying mode - -**Applies to: Windows 10, version 1903 or later** - -Windows Autopilot self-deploying mode enables a device to be deployed with little to no user interaction. For devices with an Ethernet connection, no user interaction is required; for devices connected via Wi-fi, no interaction is required after making the Wi-fi connection (choosing the language, locale, and keyboard, then making a network connection). - -Self-deploying mode joins the device into Azure Active Directory, enrolls the device in Intune (or another MDM service) leveraging Azure AD for automatic MDM enrollment, and ensures that all policies, applications, certificates, and networking profiles are provisioned on the device, leveraging the enrollment status page to prevent access to the desktop until the device is fully provisioned. - ->[!NOTE] ->Self-deploying mode does not support Active Directory Join or Hybrid Azure AD Join. All devices will be joined to Azure Active Directory. - -Self-deploying mode is designed to deploy Windows 10 as a kiosk, digital signage device, or a shared device. When setting up a kiosk, you can leverage the new Kiosk Browser, an app built on Microsoft Edge that can be used to create a tailored, MDM-managed browsing experience. When combined with MDM policies to create a local account and configure it to automatically log on, the complete configuration of the device can be automated. Find out more about these options by reading simplifying kiosk management for IT with Windows 10. See [Set up a kiosk or digital sign in Intune or other MDM service](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage#set-up-a-kiosk-or-digital-sign-in-intune-or-other-mdm-service) for additional details. - ->[!NOTE] ->Self-deploying mode does not presently associate a user with the device (since no user ID or password is specified as part of the process). As a result, some Azure AD and Intune capabilities (such as BitLocker recovery, installation of apps from the Company Portal, or Conditional Access) may not be available to a user that signs into the device. - -![The user experience with Windows Autopilot self-deploying mode](images/self-deploy-welcome.png) - -## Requirements - -Because self-deploying mode uses a device’s TPM 2.0 hardware to authenticate the device into an organization’s Azure AD tenant, devices without TPM 2.0 cannot be used with this mode. The devices must also support TPM device attestation. (All newly-manufactured Windows devices should meet these requirements.) - ->[!IMPORTANT] ->If you attempt a self-deploying mode deployment on a device that does not have support TPM 2.0 or on a virtual machine, the process will fail when verifying the device with an 0x800705B4 timeout error (Hyper-V virtual TPMs are not supported).. Also note that Window 10, version 1903 or later is required to use self-deploying mode due to issues with TPM device attestation in Windows 10, version 1809. Since Windows 10 Enterprise 2019 LTSC is based on Windows 10 version 1809, self-deploying mode is also not supported on Windows 10 Enterprise 2019 LTSC. - -In order to display an organization-specific logo and organization name during the Autopilot process, Azure Active Directory Company Branding needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details. - -## Step by step - -In order to perform a self-deploying mode deployment using Windows Autopilot, the following preparation steps need to be completed: - -- Create an Autopilot profile for self-deploying mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. (Note that it is not possible to create a profile in the Microsoft Store for Business or Partner Center for self-deploying mode.) -- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. Ensure that the profile has been assigned to the device before attempting to deploy that device. -- Boot the device, connecting it to Wi-fi if required, then wait for the provisioning process to complete. - -## Validation - -When performing a self-deploying mode deployment using Windows Autopilot, the following end-user experience should be observed: - -- Once connected to a network, the Autopilot profile will be downloaded. -- If the Autopilot profile has been configured to automatically configure the language, locale, and keyboard layout, these OOBE screens should be skipped as long as Ethernet connectivity is available. Otherwise, manual steps are required: - - If multiple languages are preinstalled in Windows 10, the user must pick a language. - - The user must pick a locale and a keyboard layout, and optionally a second keyboard layout. -- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network. -- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required). -- The device will join Azure Active Directory. -- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services). -- The [enrollment status page](enrollment-status.md) will be displayed. -- Depending on the device settings deployed, the device will either: - - Remain at the logon screen, where any member of the organization can log on by specifying their Azure AD credentials. - - Automatically sign in as a local account, for devices configured as a kiosk or digital signage. - ->[!NOTE] ->Deploying EAS policies using self-deploying mode for kiosk deployments will cause auto-logon functionality to fail. - -In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation. +--- +title: Windows Autopilot Self-Deploying mode +description: Windows Autopilot deployment +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +ms.reviewer: mniehaus +manager: laurawi +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Windows Autopilot Self-Deploying mode + +**Applies to: Windows 10, version 1903 or later** + +Windows Autopilot self-deploying mode enables a device to be deployed with little to no user interaction. For devices with an Ethernet connection, no user interaction is required; for devices connected via Wi-fi, no interaction is required after making the Wi-fi connection (choosing the language, locale, and keyboard, then making a network connection). + +Self-deploying mode joins the device into Azure Active Directory, enrolls the device in Intune (or another MDM service) leveraging Azure AD for automatic MDM enrollment, and ensures that all policies, applications, certificates, and networking profiles are provisioned on the device, leveraging the enrollment status page to prevent access to the desktop until the device is fully provisioned. + +>[!NOTE] +>Self-deploying mode does not support Active Directory Join or Hybrid Azure AD Join. All devices will be joined to Azure Active Directory. + +Self-deploying mode is designed to deploy Windows 10 as a kiosk, digital signage device, or a shared device. When setting up a kiosk, you can leverage the new Kiosk Browser, an app built on Microsoft Edge that can be used to create a tailored, MDM-managed browsing experience. When combined with MDM policies to create a local account and configure it to automatically log on, the complete configuration of the device can be automated. Find out more about these options by reading simplifying kiosk management for IT with Windows 10. See [Set up a kiosk or digital sign in Intune or other MDM service](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage#set-up-a-kiosk-or-digital-sign-in-intune-or-other-mdm-service) for additional details. + +>[!NOTE] +>Self-deploying mode does not presently associate a user with the device (since no user ID or password is specified as part of the process). As a result, some Azure AD and Intune capabilities (such as BitLocker recovery, installation of apps from the Company Portal, or Conditional Access) may not be available to a user that signs into the device. For more information see [Windows Autopilot scenarios and capabilities](windows-autopilot-scenarios.md) and [Setting the BitLocker encryption algorithm for Autopilot devices](bitlocker.md). + +![The user experience with Windows Autopilot self-deploying mode](images/self-deploy-welcome.png) + +## Requirements + +Because self-deploying mode uses a device’s TPM 2.0 hardware to authenticate the device into an organization’s Azure AD tenant, devices without TPM 2.0 cannot be used with this mode. The devices must also support TPM device attestation. (All newly-manufactured Windows devices should meet these requirements.) + +>[!IMPORTANT] +>If you attempt a self-deploying mode deployment on a device that does not have support TPM 2.0 or on a virtual machine, the process will fail when verifying the device with an 0x800705B4 timeout error (Hyper-V virtual TPMs are not supported).. Also note that Window 10, version 1903 or later is required to use self-deploying mode due to issues with TPM device attestation in Windows 10, version 1809. Since Windows 10 Enterprise 2019 LTSC is based on Windows 10 version 1809, self-deploying mode is also not supported on Windows 10 Enterprise 2019 LTSC. + +In order to display an organization-specific logo and organization name during the Autopilot process, Azure Active Directory Company Branding needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details. + +## Step by step + +In order to perform a self-deploying mode deployment using Windows Autopilot, the following preparation steps need to be completed: + +- Create an Autopilot profile for self-deploying mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. (Note that it is not possible to create a profile in the Microsoft Store for Business or Partner Center for self-deploying mode.) +- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. Ensure that the profile has been assigned to the device before attempting to deploy that device. +- Boot the device, connecting it to Wi-fi if required, then wait for the provisioning process to complete. + +## Validation + +When performing a self-deploying mode deployment using Windows Autopilot, the following end-user experience should be observed: + +- Once connected to a network, the Autopilot profile will be downloaded. +- If the Autopilot profile has been configured to automatically configure the language, locale, and keyboard layout, these OOBE screens should be skipped as long as Ethernet connectivity is available. Otherwise, manual steps are required: + - If multiple languages are preinstalled in Windows 10, the user must pick a language. + - The user must pick a locale and a keyboard layout, and optionally a second keyboard layout. +- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network. +- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required). +- The device will join Azure Active Directory. +- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services). +- The [enrollment status page](enrollment-status.md) will be displayed. +- Depending on the device settings deployed, the device will either: + - Remain at the logon screen, where any member of the organization can log on by specifying their Azure AD credentials. + - Automatically sign in as a local account, for devices configured as a kiosk or digital signage. + +>[!NOTE] +>Deploying EAS policies using self-deploying mode for kiosk deployments will cause auto-logon functionality to fail. + +In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation. diff --git a/windows/deployment/windows-autopilot/white-glove.md b/windows/deployment/windows-autopilot/white-glove.md index 9862d47c2b..b5cc63019b 100644 --- a/windows/deployment/windows-autopilot/white-glove.md +++ b/windows/deployment/windows-autopilot/white-glove.md @@ -1,114 +1,116 @@ ---- -title: Windows Autopilot for white glove deployment -description: Windows Autopilot for white glove deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, pre-provisioning -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: low -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -manager: laurawi -ms.audience: itpro author: greg-lindsay -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Windows Autopilot for white glove deployment - -**Applies to: Windows 10, version 1903** - -Windows Autopilot enables organizations to easily provision new devices - leveraging the preinstalled OEM image and drivers with a simple process that can be performed by the end user to help get their device business-ready. - - ![OEM](images/wg01.png) - -Windows Autopilot can also provide a white glove service that enables partners or IT staff to pre-provision a Windows 10 PC so that it is fully configured and business-ready. From the end user’s perspective, the Windows Autopilot user-driven experience is unchanged, but getting their device to a fully provisioned state is faster. - -With **Windows Autopilot for white glove deployment**, the provisioning process is split. The time-consuming portions are performed by IT, partners, or OEMs. The end user simply completes a few necessary settings and polices and then they can begin using their device. - - ![OEM](images/wg02.png) - -Enabled with Microsoft Intune in Windows 10, version 1903 and later, white glove deployment capabilities build on top of existing Windows Autopilot [user-driven scenarios](user-driven.md), supporting both the user-driven [Azure AD join](user-driven-aad.md) and [Hybrid Azure AD](user-driven-hybrid.md) join scenarios. - -## Prerequisites - -In addition to [Windows Autopilot requirements](windows-autopilot-requirements.md), Windows Autopilot for white glove deployment adds the following: - -- Windows 10, version 1903 or later is required. -- An Intune subscription. -- Physical devices that support TPM 2.0 and device attestation; virtual machines are not supported. The white glove provisioning process leverages Windows Autopilot self-deploying capabilities, hence the TPM 2.0 requirements. -- Physical devices with Ethernet connectivity; Wi-fi connectivity is not supported due to the requirement to choose a language, locale, and keyboard to make that Wi-fi connection; doing that in a pre-provisioning process could prevent the user from choosing their own language, locale, and keyboard when they receive the device. - ->[!IMPORTANT] ->Because the OEM or vendor performs the white glove process, this doesn’t require access to an end-user's on-prem domain infrastructure. This is unlike a typical hybrid Azure AD-joined scenario because rebooting the device is postponed. The device is resealed prior to the time when connectivity to a domain controller is expected, and the domain network is contacted when the device is unboxed on-prem by the end-user. - -## Preparation - -Devices slated for WG provisioning are registered for Autopilot via the normal registration process. - -To be ready to try out Windows Autopilot for white glove deployment, ensure that you can first successfully use existing Windows Autopilot user-driven scenarios: - -- User-driven Azure AD join. Devices can be deployed using Windows Autopilot and joined to an Azure Active Directory tenant. -- User-driven with Hybrid Azure AD join. Devices can be deployed using Windows Autopilot and joined to an on-premises Active Directory domain, then registered with Azure Active Directory to enable the Hybrid Azure AD join features. - -If these scenarios cannot be completed, Windows Autopilot for white glove deployment will also not succeed since it builds on top of these scenarios. - -To enable white glove deployment, an additional Autopilot profile setting must be configured by the customer or IT Admin via their Intune account, prior to beginning the white glove process in the provisioning service facility: - - ![allow white glove](images/allow-white-glove-oobe.png) - -The Windows Autopilot for white glove deployment pre-provisioning process will apply all device-targeted policies from Intune. That includes certificates, security templates, settings, apps, and more – anything targeting the device. Additionally, any apps (Win32 or LOB) that are configured to install in the device context and targeted to the user that has been pre-assigned to the Autopilot device will also be installed. - ->[!NOTE] ->Other user-targeted policies will not apply until the user signs into the device. To verify these behaviors, be sure to create appropriate apps and policies targeted to devices and users. - -## Scenarios - -Windows Autopilot for white glove deployment supports two distinct scenarios: -- User-driven deployments with Azure AD Join. The device will be joined to an Azure AD tenant. -- User-driven deployments with Hybrid Azure AD Join. The device will be joined to an on-premises Active Directory domain, and separately registered with Azure AD. -Each of these scenarios consists of two parts, a technician flow and a user flow. At a high level, these parts are the same for Azure AD Join and Hybrid Azure AD join; differences are primarily seen by the end user in the authentication steps. - -### Technican flow - -After the customer or IT Admin has targeted all the apps and settings they want for their devices through Intune, the white glove technician can begin the white glove process. The technician could be a member of the IT staff, a services partner, or an OEM – each organization can decide who should perform these activities. Regardless of the scenario, the process to be performed by the technician is the same: -- Boot the device (running Windows 10 Pro, Enterprise, or Education SKUs, version 1903 or later). -- From the first OOBE screen (which could be a language selection or locale selection screen), do not click **Next**. Instead, press the Windows key five times to view an additional options dialog. From that screen, choose the **Windows Autopilot provisioning** option and then click **Continue**. - - ![choice](images/choice.png) - -- On the **Windows Autopilot Configuration** screen, information will be displayed about the device: - - The Autopilot profile assigned to the device. - - The organization name for the device. - - The user assigned to the device (if there is one). - - A QR code containing a unique identifier for the device, useful to look up the device in Intune to make any configuration changes needed (e.g. assigning a user, adding the device to any additional groups needed for app or policy targeting). - - **Note**: The QR codes can be scanned using a companion app, which will also configure the device to specify who it belongs to. An [open-source sample of the companion app](https://github.com/Microsoft/WindowsAutopilotCompanion) that integrates with Intune via the Graph API has been published to GitHub by the Autopilot team. -- Validate the information displayed. If any changes are needed, make these and then click **Refresh** to re-download the updated Autopilot profile details. - - ![landing](images/landing.png) - -- Click **Provision** to begin the provisioning process. - -If the pre-provisioning process completes successfully: -- A green status screen will be displayed with information about the device, including the same details presented previously (e.g. Autopilot profile, organization name, assigned user, QR code), as well as the elapsed time for the pre-provisioning steps. - ![white-glove-result](images/white-glove-result.png) -- Click **Reseal** to shut the device down. At that point, the device can be shipped to the end user. - -If the pre-provisioning process fails: -- A red status screen will be displayed with information about the device, including the same details presented previously (e.g. Autopilot profile, organization name, assigned user, QR code), as well as the elapsed time for the pre-provisioning steps. -- Diagnostic logs can be gathered from the device, and then it can be reset to start the process over again. - -### User flow - -If the pre-provisioning process completed successfully and the device was resealed, it can be delivered to the end user to complete the normal Windows Autopilot user-driven process. They will perform a standard set of steps: - -- Power on the device. -- Select the appropriate language, locale, and keyboard layout. -- Connect to a network (if using Wi-Fi). If using Hybrid Azure AD Join, there must be connectivity to a domain controller; if using Azure AD Join, internet connectivity is required. -- On the branded sign-on screen, enter the user’s Azure Active Directory credentials. -- If using Hybrid Azure AD Join, the device will reboot; after the reboot, enter the user’s Active Directory credentials. -- Additional policies and apps will be delivered to the device, as tracked by the Enrollment Status Page (ESP). Once complete, the user will be able to access the desktop. - -## Related topics - -[White glove video](https://youtu.be/nE5XSOBV0rI) +--- +title: Windows Autopilot for white glove deployment +description: Windows Autopilot for white glove deployment +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, pre-provisioning +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: low +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +manager: laurawi +ms.audience: itpro +author: greg-lindsay +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Windows Autopilot for white glove deployment + +**Applies to: Windows 10, version 1903** + +Windows Autopilot enables organizations to easily provision new devices - leveraging the preinstalled OEM image and drivers with a simple process that can be performed by the end user to help get their device business-ready. + + ![OEM](images/wg01.png) + +Windows Autopilot can also provide a white glove service that enables partners or IT staff to pre-provision a Windows 10 PC so that it is fully configured and business-ready. From the end user’s perspective, the Windows Autopilot user-driven experience is unchanged, but getting their device to a fully provisioned state is faster. + +With **Windows Autopilot for white glove deployment**, the provisioning process is split. The time-consuming portions are performed by IT, partners, or OEMs. The end user simply completes a few necessary settings and polices and then they can begin using their device. + + ![OEM](images/wg02.png) + +Enabled with Microsoft Intune in Windows 10, version 1903 and later, white glove deployment capabilities build on top of existing Windows Autopilot [user-driven scenarios](user-driven.md), supporting both the user-driven [Azure AD join](user-driven-aad.md) and [Hybrid Azure AD](user-driven-hybrid.md) join scenarios. + +## Prerequisites + +In addition to [Windows Autopilot requirements](windows-autopilot-requirements.md), Windows Autopilot for white glove deployment adds the following: + +- Windows 10, version 1903 or later is required. +- An Intune subscription. +- Physical devices that support TPM 2.0 and device attestation; virtual machines are not supported. The white glove provisioning process leverages Windows Autopilot self-deploying capabilities, hence the TPM 2.0 requirements. +- Physical devices with Ethernet connectivity; Wi-fi connectivity is not supported due to the requirement to choose a language, locale, and keyboard to make that Wi-fi connection; doing that in a pre-provisioning process could prevent the user from choosing their own language, locale, and keyboard when they receive the device. + +>[!IMPORTANT] +>Because the OEM or vendor performs the white glove process, this doesn’t require access to an end-user's on-prem domain infrastructure. This is unlike a typical hybrid Azure AD-joined scenario because rebooting the device is postponed. The device is resealed prior to the time when connectivity to a domain controller is expected, and the domain network is contacted when the device is unboxed on-prem by the end-user. + +## Preparation + +Devices slated for white glove provisioning are registered for Autopilot via the normal registration process. + +To be ready to try out Windows Autopilot for white glove deployment, ensure that you can first successfully use existing Windows Autopilot user-driven scenarios: + +- User-driven Azure AD join. Devices can be deployed using Windows Autopilot and joined to an Azure Active Directory tenant. +- User-driven with Hybrid Azure AD join. Devices can be deployed using Windows Autopilot and joined to an on-premises Active Directory domain, then registered with Azure Active Directory to enable the Hybrid Azure AD join features. + +If these scenarios cannot be completed, Windows Autopilot for white glove deployment will also not succeed since it builds on top of these scenarios. + +To enable white glove deployment, an additional Autopilot profile setting must be configured by the customer or IT Admin via their Intune account, prior to beginning the white glove process in the provisioning service facility: + + ![allow white glove](images/allow-white-glove-oobe.png) + +The Windows Autopilot for white glove deployment pre-provisioning process will apply all device-targeted policies from Intune. That includes certificates, security templates, settings, apps, and more – anything targeting the device. Additionally, any apps (Win32 or LOB) that are configured to install in the device context and targeted to the user that has been pre-assigned to the Autopilot device will also be installed. + +>[!NOTE] +>Other user-targeted policies will not apply until the user signs into the device. To verify these behaviors, be sure to create appropriate apps and policies targeted to devices and users. + +## Scenarios + +Windows Autopilot for white glove deployment supports two distinct scenarios: +- User-driven deployments with Azure AD Join. The device will be joined to an Azure AD tenant. +- User-driven deployments with Hybrid Azure AD Join. The device will be joined to an on-premises Active Directory domain, and separately registered with Azure AD. +Each of these scenarios consists of two parts, a technician flow and a user flow. At a high level, these parts are the same for Azure AD Join and Hybrid Azure AD join; differences are primarily seen by the end user in the authentication steps. + +### Technician flow + +After the customer or IT Admin has targeted all the apps and settings they want for their devices through Intune, the white glove technician can begin the white glove process. The technician could be a member of the IT staff, a services partner, or an OEM – each organization can decide who should perform these activities. Regardless of the scenario, the process to be performed by the technician is the same: +- Boot the device (running Windows 10 Pro, Enterprise, or Education SKUs, version 1903 or later). +- From the first OOBE screen (which could be a language selection or locale selection screen), do not click **Next**. Instead, press the Windows key five times to view an additional options dialog. From that screen, choose the **Windows Autopilot provisioning** option and then click **Continue**. + + ![choice](images/choice.png) + +- On the **Windows Autopilot Configuration** screen, information will be displayed about the device: + - The Autopilot profile assigned to the device. + - The organization name for the device. + - The user assigned to the device (if there is one). + - A QR code containing a unique identifier for the device, useful to look up the device in Intune to make any configuration changes needed (e.g. assigning a user, adding the device to any additional groups needed for app or policy targeting). + - **Note**: The QR codes can be scanned using a companion app, which will also configure the device to specify who it belongs to. An [open-source sample of the companion app](https://github.com/Microsoft/WindowsAutopilotCompanion) that integrates with Intune via the Graph API has been published to GitHub by the Autopilot team. +- Validate the information displayed. If any changes are needed, make these and then click **Refresh** to re-download the updated Autopilot profile details. + + ![landing](images/landing.png) + +- Click **Provision** to begin the provisioning process. + +If the pre-provisioning process completes successfully: +- A green status screen will be displayed with information about the device, including the same details presented previously (e.g. Autopilot profile, organization name, assigned user, QR code), as well as the elapsed time for the pre-provisioning steps. + ![white-glove-result](images/white-glove-result.png) +- Click **Reseal** to shut the device down. At that point, the device can be shipped to the end user. + +If the pre-provisioning process fails: +- A red status screen will be displayed with information about the device, including the same details presented previously (e.g. Autopilot profile, organization name, assigned user, QR code), as well as the elapsed time for the pre-provisioning steps. +- Diagnostic logs can be gathered from the device, and then it can be reset to start the process over again. + +### User flow + +If the pre-provisioning process completed successfully and the device was resealed, it can be delivered to the end user to complete the normal Windows Autopilot user-driven process. They will perform a standard set of steps: + +- Power on the device. +- Select the appropriate language, locale, and keyboard layout. +- Connect to a network (if using Wi-Fi). If using Hybrid Azure AD Join, there must be connectivity to a domain controller; if using Azure AD Join, internet connectivity is required. +- On the branded sign-on screen, enter the user’s Azure Active Directory credentials. +- If using Hybrid Azure AD Join, the device will reboot; after the reboot, enter the user’s Active Directory credentials. +- Additional policies and apps will be delivered to the device, as tracked by the Enrollment Status Page (ESP). Once complete, the user will be able to access the desktop. + +## Related topics + +[White glove video](https://youtu.be/nE5XSOBV0rI) diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md index c216835569..1baaf03dea 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md @@ -1,121 +1,123 @@ ---- -title: Windows Autopilot requirements -ms.reviewer: -manager: laurawi -description: Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -audience: itpro author: greg-lindsay -ms.author: greglin -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot requirements - -**Applies to: Windows 10** - -Windows Autopilot depends on specific capabilities available in Windows 10, Azure Active Directory, and MDM services such as Microsoft Intune. In order to use Windows Autopilot and leverage these capabilities, some requirements must be met. - -**Note**: For a list of OEMs that currently support Windows Autopilot, see the Participant device manufacturers section at [Windows Autopilot](https://aka.ms/windowsautopilot). - -## Software requirements - -- Windows 10 version 1703 (semi-annual channel) or higher is required. -- The following editions are supported: - - Windows 10 Pro - - Windows 10 Pro Education - - Windows 10 Pro for Workstations - - Windows 10 Enterprise - - Windows 10 Education - - Windows 10 Enterprise 2019 LTSC - -## Networking requirements - -Windows Autopilot depends on a variety of internet-based services. Access to these services must be provided for Autopilot to function properly. In the simplest case, enabling proper functionality can be achieved by ensuring the following: - -- Ensure DNS name resolution for internet DNS names -- Allow access to all hosts via port 80 (HTTP), 443 (HTTPS), and 123 (UDP/NTP) - -In environments that have more restrictive Internet access, or for those that require authentication before internet access can be obtained, additional configuration may be required to whitelist access to the required services. For additional details about each of these services and their specific requirements, review the following details: - -
                        ServiceInformation -
                        Windows Autopilot Deployment Service and Windows ActivationAfter a network connection is in place, each Windows 10 device will contact the Windows Autopilot Deployment Service. With Windows 10 builds 18204 and above, the following URLs are used: https://ztd.dds.microsoft.com, https://cs.dds.microsoft.com.
                        - -For all supported Windows 10 releases, Windows Autopilot also uses Windows Activation services. See Windows activation or validation fails with error code 0x8004FE33 for details about problems that might occur when you connect to the Internet through a proxy server. -
                        Azure Active DirectoryUser credentials are validated by Azure Active Directory, and the device can also be joined to Azure Active Directory. See Office 365 IP Address and URL Web service for more information. -
                        IntuneOnce authenticated, Azure Active Directory will trigger enrollment of the device into the Intune MDM service. See the following link for details about network communication requirements: Intune network configuration requirements and bandwidth. -
                        Windows UpdateDuring the OOBE process, as well as after the Windows 10 OS is fully configured, the Windows Update service is leveraged to retrieve needed updates. If there are problems connecting to Windows Update, see How to solve connection problems concerning Windows Update or Microsoft Update.
                        - -If Windows Update is inaccessible, the AutoPilot process will still continue but critical updates will not be available. - -
                        Delivery OptimizationWhen downloading Windows Updates, Microsoft Store apps and app updates, Office Updates and Intune Win32 Apps, the Delivery Optimization service is contacted to enable peer-to-peer sharing of content so that only a few devices need to download it from the internet.
                        - -If the Delivery Optimization Service is inaccessible, the AutoPilot process will still continue with Delivery Optimization downloads from the cloud (without peer-to-peer). - -
                        Network Time Protocol (NTP) SyncWhen a Windows device starts up, it will talk to a network time server to ensure that the time on the device is accurate. Ensure that UDP port 123 to time.windows.com is accessible. -
                        Domain Name Services (DNS)To resolve DNS names for all services, the device communicates with a DNS server, typically provided via DHCP.  This DNS server must be able to resolve internet names. -
                        Diagnostics dataStarting in Windows 10, 1903, diagnostic data collection will be enabled by default. To disable Windows Analytics and related diagnostics capabilities, see Manage enterprise diagnostic data level.
                        - -If diagnostic data cannot be sent, the Autopilot process will still continue, but services that depend on diagnostic data, such as Windows Analytics, will not work. -
                        Network Connection Status Indicator (NCSI)Windows must be able to tell that the device is able to access the internet. For more information, see Network Connection Status Indicator (NCSI). - -www.msftconnecttest.com must be resolvable via DNS and accessible via HTTP. -
                        Windows Notification Services (WNS)This service is used to enable Windows to receive notifications from apps and services. See Microsoft Store for more information.
                        - -If the WNS services are not available, the Autopilot process will still continue without notifications. -
                        Microsoft Store, Microsoft Store for BusinessApps in the Microsoft Store can be pushed to the device, triggered via Intune (MDM).  App updates and additional apps may also be needed when the user first logs in. For more information, see Prerequisites for Microsoft Store for Business and Education (also includes Azure AD and Windows Notification Services).
                        - -If the Microsoft Store is not accessible, the AutoPilot process will still continue without Microsoft Store apps. - -
                        Office 365As part of the Intune device configuration, installation of Office 365 ProPlus may be required. For more information, see Office 365 URLs and IP address ranges (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above). -
                        Certificate revocation lists (CRLs)Some of these services will also need to check certificate revocation lists (CRLs) for certificates used in the services.  A full list of these is documented at Office 365 URLs and IP address ranges and Office 365 Certificate Chains. -
                        Hybrid AAD joinHybrid AAD can be join, the machine should be on corporate network for hybrid AAD join to work. See details at Windows Autopilot user-driven mode -
                        - -## Licensing requirements - -Windows Autopilot depends on specific capabilities available in Windows 10 and Azure Active Directory. It also requires an MDM service such as Microsoft Intune. These capabilities can be obtained through various editions and subscription programs: - -To provide needed Azure Active Directory (automatic MDM enrollment and company branding features) and MDM functionality, one of the following is required: - - [Microsoft 365 Business subscriptions](https://www.microsoft.com/en-us/microsoft-365/business) - - [Microsoft 365 F1 subscriptions](https://www.microsoft.com/en-us/microsoft-365/enterprise/firstline) - - [Microsoft 365 Academic A1, A3, or A5 subscriptions](https://www.microsoft.com/en-us/education/buy-license/microsoft365/default.aspx) - - [Microsoft 365 Enterprise E3 or E5 subscriptions](https://www.microsoft.com/en-us/microsoft-365/enterprise), which include all Windows 10, Office 365, and EM+S features (Azure AD and Intune). - - [Enterprise Mobility + Security E3 or E5 subscriptions](https://www.microsoft.com/en-us/cloud-platform/enterprise-mobility-security), which include all needed Azure AD and Intune features. - - [Intune for Education subscriptions](https://docs.microsoft.com/intune-education/what-is-intune-for-education), which include all needed Azure AD and Intune features. - - [Azure Active Directory Premium P1 or P2](https://azure.microsoft.com/services/active-directory/) and [Microsoft Intune subscriptions](https://www.microsoft.com/en-us/cloud-platform/microsoft-intune) (or an alternative MDM service). - -Additionally, the following are also recommended (but not required): -- [Office 365 ProPlus](https://www.microsoft.com/en-us/p/office-365-proplus/CFQ7TTC0K8R0), which can be deployed easily via Intune (or other MDM services). -- [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation), to automatically step up devices from Windows 10 Pro to Windows 10 Enterprise. - -## Configuration requirements - -Before Windows Autopilot can be used, some configuration tasks are required to support the common Autopilot scenarios. - -- Configure Azure Active Directory automatic enrollment. For Microsoft Intune, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment) for details. If using a different MDM service, contact the vendor for the specific URLs or configuration needed for those services. -- Configure Azure Active Directory custom branding. In order to display an organization-specific logon page during the Autopilot process, Azure Active Directory needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details. Note that the "square logo" and "sign-in page text" are the key elements for Autopilot, as well as the Azure Active Directory tenant name (configured separately in the Azure AD tenant properties). -- Enable [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation) if desired, in order to automatically step up from Windows 10 Pro to Windows 10 Enterprise. - -Specific scenarios will then have additional requirements. Generally, there are two specific tasks: - -- Device registration. Devices need to be added to Windows Autopilot to support most Windows Autopilot scenarios. See [Adding devices to Windows Autopilot](add-devices.md) for more details. -- Profile configuration. Once devices have been added to Windows Autopilot, a profile of settings needs to be applied to each device. See [Configure Autopilot profiles](profiles.md) for details. Note that Microsoft Intune can automate this profile assignment; see [Create an AutoPilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an AutoPilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group) for more information. - -See [Windows Autopilot Scenarios](windows-autopilot-scenarios.md) for additional details. - -For a walkthrough for some of these and related steps, see this video: -
                         
                        - - -There are no additional hardware requirements to use Windows 10 Autopilot, beyond the [requirements to run Windows 10](https://www.microsoft.com/windows/windows-10-specifications). - -## Related topics - -[Configure Autopilot deployment](configure-autopilot.md) +--- +title: Windows Autopilot requirements +ms.reviewer: +manager: laurawi +description: Windows Autopilot deployment +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Windows Autopilot requirements + +**Applies to: Windows 10** + +Windows Autopilot depends on specific capabilities available in Windows 10, Azure Active Directory, and MDM services such as Microsoft Intune. In order to use Windows Autopilot and leverage these capabilities, some requirements must be met. + +**Note**: For a list of OEMs that currently support Windows Autopilot, see the Participant device manufacturers section at [Windows Autopilot](https://aka.ms/windowsautopilot). + +## Software requirements + +- Windows 10 version 1703 (semi-annual channel) or higher is required. +- The following editions are supported: + - Windows 10 Pro + - Windows 10 Pro Education + - Windows 10 Pro for Workstations + - Windows 10 Enterprise + - Windows 10 Education + - Windows 10 Enterprise 2019 LTSC + +## Networking requirements + +Windows Autopilot depends on a variety of internet-based services. Access to these services must be provided for Autopilot to function properly. In the simplest case, enabling proper functionality can be achieved by ensuring the following: + +- Ensure DNS name resolution for internet DNS names +- Allow access to all hosts via port 80 (HTTP), 443 (HTTPS), and 123 (UDP/NTP) + +In environments that have more restrictive Internet access, or for those that require authentication before internet access can be obtained, additional configuration may be required to whitelist access to the required services. For additional details about each of these services and their specific requirements, review the following details: + +
                        ServiceInformation +
                        Windows Autopilot Deployment ServiceAfter a network connection is in place, each Windows 10 device will contact the Windows Autopilot Deployment Service. With Windows 10 version 1903 and above, the following URLs are used: https://ztd.dds.microsoft.com, https://cs.dds.microsoft.com.
                        + +
                        Windows ActivationWindows Autopilot also requires Windows Activation services. See Windows activation or validation fails with error code 0x8004FE33 for details about the URLs that need to be accessible for the activation services.
                        + +
                        Azure Active DirectoryUser credentials are validated by Azure Active Directory, and the device can also be joined to Azure Active Directory. See Office 365 IP Address and URL Web service for more information. +
                        IntuneOnce authenticated, Azure Active Directory will trigger enrollment of the device into the Intune MDM service. See the following link for details about network communication requirements: Intune network configuration requirements and bandwidth. +
                        Windows UpdateDuring the OOBE process, as well as after the Windows 10 OS is fully configured, the Windows Update service is leveraged to retrieve needed updates. If there are problems connecting to Windows Update, see How to solve connection problems concerning Windows Update or Microsoft Update.
                        + +If Windows Update is inaccessible, the AutoPilot process will still continue but critical updates will not be available. + +
                        Delivery OptimizationWhen downloading Windows Updates, Microsoft Store apps and app updates, Office Updates and Intune Win32 Apps, the Delivery Optimization service is contacted to enable peer-to-peer sharing of content so that only a few devices need to download it from the internet.
                        + +If the Delivery Optimization Service is inaccessible, the AutoPilot process will still continue with Delivery Optimization downloads from the cloud (without peer-to-peer). + +
                        Network Time Protocol (NTP) SyncWhen a Windows device starts up, it will talk to a network time server to ensure that the time on the device is accurate. Ensure that UDP port 123 to time.windows.com is accessible. +
                        Domain Name Services (DNS)To resolve DNS names for all services, the device communicates with a DNS server, typically provided via DHCP.  This DNS server must be able to resolve internet names. +
                        Diagnostics dataStarting in Windows 10, 1903, diagnostic data collection will be enabled by default. To disable Windows Analytics and related diagnostics capabilities, see Manage enterprise diagnostic data level.
                        + +If diagnostic data cannot be sent, the Autopilot process will still continue, but services that depend on diagnostic data, such as Windows Analytics, will not work. +
                        Network Connection Status Indicator (NCSI)Windows must be able to tell that the device is able to access the internet. For more information, see Network Connection Status Indicator (NCSI). + +www.msftconnecttest.com must be resolvable via DNS and accessible via HTTP. +
                        Windows Notification Services (WNS)This service is used to enable Windows to receive notifications from apps and services. See Microsoft Store for more information.
                        + +If the WNS services are not available, the Autopilot process will still continue without notifications. +
                        Microsoft Store, Microsoft Store for BusinessApps in the Microsoft Store can be pushed to the device, triggered via Intune (MDM).  App updates and additional apps may also be needed when the user first logs in. For more information, see Prerequisites for Microsoft Store for Business and Education (also includes Azure AD and Windows Notification Services).
                        + +If the Microsoft Store is not accessible, the AutoPilot process will still continue without Microsoft Store apps. + +
                        Office 365As part of the Intune device configuration, installation of Office 365 ProPlus may be required. For more information, see Office 365 URLs and IP address ranges (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above). +
                        Certificate revocation lists (CRLs)Some of these services will also need to check certificate revocation lists (CRLs) for certificates used in the services.  A full list of these is documented at Office 365 URLs and IP address ranges and Office 365 Certificate Chains. +
                        Hybrid AAD joinThe device can be hybrid AAD joined. The computer should be on corporate network for hybrid AAD join to work. See details at Windows Autopilot user-driven mode +
                        + +## Licensing requirements + +Windows Autopilot depends on specific capabilities available in Windows 10 and Azure Active Directory. It also requires an MDM service such as Microsoft Intune. These capabilities can be obtained through various editions and subscription programs: + +To provide needed Azure Active Directory (automatic MDM enrollment and company branding features) and MDM functionality, one of the following is required: +- [Microsoft 365 Business subscriptions](https://www.microsoft.com/microsoft-365/business) +- [Microsoft 365 F1 subscriptions](https://www.microsoft.com/microsoft-365/enterprise/firstline) +- [Microsoft 365 Academic A1, A3, or A5 subscriptions](https://www.microsoft.com/education/buy-license/microsoft365/default.aspx) +- [Microsoft 365 Enterprise E3 or E5 subscriptions](https://www.microsoft.com/microsoft-365/enterprise), which include all Windows 10, Office 365, and EM+S features (Azure AD and Intune). +- [Enterprise Mobility + Security E3 or E5 subscriptions](https://www.microsoft.com/cloud-platform/enterprise-mobility-security), which include all needed Azure AD and Intune features. +- [Intune for Education subscriptions](https://docs.microsoft.com/intune-education/what-is-intune-for-education), which include all needed Azure AD and Intune features. +- [Azure Active Directory Premium P1 or P2](https://azure.microsoft.com/services/active-directory/) and [Microsoft Intune subscriptions](https://www.microsoft.com/cloud-platform/microsoft-intune) (or an alternative MDM service). + +Additionally, the following are also recommended (but not required): +- [Office 365 ProPlus](https://www.microsoft.com/p/office-365-proplus/CFQ7TTC0K8R0), which can be deployed easily via Intune (or other MDM services). +- [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation), to automatically step up devices from Windows 10 Pro to Windows 10 Enterprise. + +## Configuration requirements + +Before Windows Autopilot can be used, some configuration tasks are required to support the common Autopilot scenarios. + +- Configure Azure Active Directory automatic enrollment. For Microsoft Intune, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment) for details. If using a different MDM service, contact the vendor for the specific URLs or configuration needed for those services. +- Configure Azure Active Directory custom branding. In order to display an organization-specific logon page during the Autopilot process, Azure Active Directory needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details. Note that the "square logo" and "sign-in page text" are the key elements for Autopilot, as well as the Azure Active Directory tenant name (configured separately in the Azure AD tenant properties). +- Enable [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation) if desired, in order to automatically step up from Windows 10 Pro to Windows 10 Enterprise. + +Specific scenarios will then have additional requirements. Generally, there are two specific tasks: + +- Device registration. Devices need to be added to Windows Autopilot to support most Windows Autopilot scenarios. See [Adding devices to Windows Autopilot](add-devices.md) for more details. +- Profile configuration. Once devices have been added to Windows Autopilot, a profile of settings needs to be applied to each device. See [Configure Autopilot profiles](profiles.md) for details. Note that Microsoft Intune can automate this profile assignment; see [Create an AutoPilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an AutoPilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group) for more information. + +See [Windows Autopilot Scenarios](windows-autopilot-scenarios.md) for additional details. + +For a walkthrough for some of these and related steps, see this video: +
                         
                        + + +There are no additional hardware requirements to use Windows 10 Autopilot, beyond the [requirements to run Windows 10](https://www.microsoft.com/windows/windows-10-specifications). + +## Related topics + +[Configure Autopilot deployment](configure-autopilot.md) diff --git a/windows/deployment/windows-deployment-scenarios-and-tools.md b/windows/deployment/windows-deployment-scenarios-and-tools.md index f94b65ffef..742ae20f20 100644 --- a/windows/deployment/windows-deployment-scenarios-and-tools.md +++ b/windows/deployment/windows-deployment-scenarios-and-tools.md @@ -1,350 +1,352 @@ ---- -title: Windows 10 deployment tools (Windows 10) -description: To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. -ms.assetid: 0d6cee1f-14c4-4b69-b29a-43b0b327b877 -ms.reviewer: -manager: laurawi -ms.audience: itpro author: greg-lindsay -keywords: deploy, volume activation, BitLocker, recovery, install, installation, VAMT, MDT, USMT, WDS -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.topic: article ---- - -# Windows 10 deployment scenarios and tools - - -To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. - -Microsoft provides many tools, services, and solutions. These tools include Windows Deployment Services (WDS), the Volume Activation Management Tool (VAMT), the User State Migration Tool (USMT), Windows System Image Manager (Windows SIM), Windows Preinstallation Environment (Windows PE), and Windows Recovery Environment (Windows RE). Keep in mind that these are just tools and not a complete solution on their own. It’s when you combine these tools with solutions like [Microsoft Deployment Toolkit (MDT)](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) or [Microsoft System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) that you get the complete deployment solution. - -In this topic, you also learn about different types of reference images that you can build, and why reference images are beneficial for most organizations - -## Windows Assessment and Deployment Kit - - -Windows ADK contains core assessment and deployment tools and technologies, including Deployment Image Servicing and Management (DISM), Windows Imaging and Configuration Designer (Windows ICD), Windows System Image Manager (Windows SIM), User State Migration Tool (USMT), Volume Activation Management Tool (VAMT), Windows Preinstallation Environment (Windows PE), Windows Assessment Services, Windows Performance Toolkit (WPT), Application Compatibility Toolkit (ACT), and Microsoft SQL Server 2012 Express. For more details, see [Windows ADK for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=526803 ) or [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md). - -![figure 1](images/win-10-adk-select.png) - -Figure 1. The Windows 10 ADK feature selection page. - -### Deployment Image Servicing and Management (DISM) - -DISM is one of the deployment tools included in the Windows ADK and is used for capturing, servicing, and deploying boot images and operating system images. - -DISM services online and offline images. For example, with DISM you can install the Microsoft .NET Framework 3.5.1 in Windows 10 online, which means that you can start the installation in the running operating system, not that you get the software online. The /LimitAccess switch configures DISM to get the files only from a local source: - -``` syntax -Dism.exe /Online /Enable-Feature /FeatureName:NetFX3 /All /Source:D:\Sources\SxS /LimitAccess -``` - -In Windows 10, you can use Windows PowerShell for many of the functions performed by DISM.exe. The equivalent command in Windows 10 using PowerShell is: - -``` syntax -Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All --Source D:\Sources\SxS -LimitAccess -``` - -![figure 2](images/mdt-11-fig05.png) - -Figure 2. Using DISM functions in PowerShell. - -For more information on DISM, see [DISM technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619161). - -### User State Migration Tool (USMT) - -USMT is a backup and restore tool that allows you to migrate user state, data, and settings from one installation to another. Microsoft Deployment Toolkit (MDT) and System Center 2012 R2 Configuration Manager use USMT as part of the operating system deployment process. - -**Note**   -Occasionally, we find that customers are wary of USMT because they believe it requires significant configuration, but, as you will learn below, using USMT is not difficult. If you use MDT and Lite Touch to deploy your machines, the USMT feature is automatically configured and extended so that it is easy to use. With MDT, you do nothing at all and USMT just works. - - - -USMT includes several command-line tools, the most important of which are ScanState and LoadState: - -- **ScanState.exe.** This performs the user-state backup. - -- **LoadState.exe.** This performs the user-state restore. - -- **UsmtUtils.exe.** This supplements the functionality in ScanState.exe and LoadState.exe. - -In addition to these tools, there are also XML templates that manage which data is migrated. You can customize the templates, or create new ones, to manage the backup process at a high level of detail. USMT uses the following terms for its templates: - -- **Migration templates.** The default templates in USMT. - -- **Custom templates.** Custom templates that you create. - -- **Config template.** An optional template, called Config.xml, which you can use to exclude or include components in a migration without modifying the other standard XML templates. - -![figure 3](images/mdt-11-fig06.png) - -Figure 3. A sample USMT migration file that will exclude .MP3 files on all local drives and include the folder C:\\Data and all its files, including its subdirectories and their files. - -USMT supports capturing data and settings from Windows Vista and later, and restoring the data and settings to Windows 7 and later (including Windows 10 in both cases). It also supports migrating from a 32-bit operating system to a 64-bit operating system, but not the other way around. For example, you can use USMT to migrate from Windows 7 x86 to Windows 10 x64. - -By default USMT migrates many settings, most of which are related to the user profile but also to Control Panel configurations, file types, and more. The default templates that are used in Windows 10 deployments are MigUser.xml and MigApp.xml. These two default templates migrate the following data and settings: - -- Folders from each profile, including those from user profiles as well as shared and public profiles. For example, the My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites folders are migrated. - -- Specific file types. USMT templates migrate the following file types: .accdb, .ch3, .csv, .dif, .doc\*, .dot\*, .dqy, .iqy, .mcw, .mdb\*, .mpp, .one\*, .oqy, .or6, .pot\*, .ppa, .pps\*, .ppt\*, .pre, .pst, .pub, .qdf, .qel, .qph, .qsd, .rqy, .rtf, .scd, .sh3, .slk, .txt, .vl\*, .vsd, .wk\*, .wpd, .wps, .wq1, .wri, .xl\*, .xla, .xlb, .xls\*. - - **Note**   - The OpenDocument extensions (\*.odt, \*.odp, \*.ods, etc.) that Microsoft Office applications can use are not migrated by default. - - - -- Operating system component settings - -- Application settings - -These are the settings migrated by the default MigUser.xml and MigApp.xml templates. For more details on what USMT migrates, see [What does USMT migrate?](https://go.microsoft.com/fwlink/p/?LinkId=619227) For more information on the USMT overall, see the [USMT technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619228). - -### Windows Imaging and Configuration Designer - -Windows Imaging and Configuration Designer (Windows ICD) is a tool designed to assist with the creation of provisioning packages that can be used to dynamically configure a Windows device (PCs, tablets, and phones). This is particularly useful for setting up new devices, without the need for re-imaging the device with a custom image. - -![figure 4](images/windows-icd.png) - -Figure 4. Windows Imaging and Configuration Designer. - -For more information, see [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkID=525483). - -### Windows System Image Manager (Windows SIM) - -Windows SIM is an authoring tool for Unattend.xml files. When using MDT and/or Configuration Manager, you don’t need Windows SIM very often because those systems automatically update the Unattend.xml file during the deployment, greatly simplifying the process overall. - -![figure 7](images/mdt-11-fig07.png) - -Figure 5. Windows answer file opened in Windows SIM. - -For more information, see [Windows System Image Manager Technical Reference]( https://go.microsoft.com/fwlink/p/?LinkId=619906). - -### Volume Activation Management Tool (VAMT) - -If you don’t use KMS, you can still manage your MAKs centrally with the Volume Activation Management Tool (VAMT). With this tool, you can install and manage product keys throughout the organization. VAMT also can activate on behalf of clients without Internet access, acting as a MAK proxy. - -![figure 6](images/mdt-11-fig08.png) - -Figure 6. The updated Volume Activation Management Tool. - -VAMT also can be used to create reports, switch from MAK to KMS, manage Active Directory-based activation, and manage Office 2010 and Office 2013 volume activation. VAMT also supports PowerShell (instead of the old command-line tool). For example, if you want to get information from the VAMT database, you can type: - -``` syntax -Get-VamtProduct -``` - -For more information on the VAMT, see [VAMT technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619230). - -### Windows Preinstallation Environment (Windows PE) - -Windows PE is a “Lite” version of Windows 10 and was created to act as a deployment platform. Windows PE replaces the DOS or Linux boot disks that ruled the deployment solutions of the last decade. - -The key thing to know about Windows PE is that, like the operating system, it needs drivers for at least network and storage devices in each PC. Luckily Windows PE includes the same drivers as the full Windows 10 operating system, which means much of your hardware will work out of the box. - -![figure 7](images/mdt-11-fig09.png) - -Figure 7. A machine booted with the Windows ADK default Windows PE boot image. - -For more details on Windows PE, see [Windows PE (WinPE)](https://go.microsoft.com/fwlink/p/?LinkId=619233). - -## Windows Recovery Environment - - -Windows Recovery Environment (Windows RE) is a diagnostics and recovery toolset included in Windows Vista and later operating systems. The latest version of Windows RE is based on Windows PE. You can also extend Windows RE and add your own tools if needed. If a Windows installation fails to start and Windows RE is installed, you will see an automatic failover into Windows RE. - -![figure 8](images/mdt-11-fig10.png) - -Figure 8. A Windows 10 client booted into Windows RE, showing Advanced options. - -For more information on Windows RE, see [Windows Recovery Environment](https://go.microsoft.com/fwlink/p/?LinkId=619236). - -## Windows Deployment Services - - -Windows Deployment Services (WDS) has been updated and improved in several ways starting with Windows 8. Remember that the two main functions you will use are the PXE boot support and multicast. Most of the changes are related to management and increased performance. In Windows Server 2012 R2, WDS also can be used for the Network Unlock feature in BitLocker. - -![figure 9](images/mdt-11-fig11.png) - -Figure 9. Windows Deployment Services using multicast to deploy three machines. - -In Windows Server 2012 R2, [Windows Deployment Services](https://go.microsoft.com/fwlink/p/?LinkId=619245) can be configured for stand-alone mode or for Active Directory integration. In most scenarios, the Active Directory integration mode is the best option. WDS also has the capability to manage drivers; however, driver management through MDT and Configuration Manager is more suitable for deployment due to the flexibility offered by both solutions, so you will use them instead. In WDS, it is possible to pre-stage devices in Active Directory, but here, too, Configuration Manager has that capability built in, and MDT has the ability to use a SQL Server database for pre-staging. In most scenarios, those solutions are better than the built-in pre-staging function as they allow greater control and management. - -### Trivial File Transfer Protocol (TFTP) configuration - -In some cases, you need to modify TFTP Maximum Block Size settings for performance tuning reasons, especially when PXE traffic travels through routers and such. In the previous version of WDS, it was possible to change that, but the method of do so—editing the registry—was not user friendly. In Windows Server 2012, this has become much easier to do as it can be configured as a setting. - -Also, there are a few new features related to TFTP performance: - -- **Scalable buffer management.** Allows buffering an entire file instead of a fixed-size buffer for each client, enabling different sessions to read from the same shared buffer. - -- **Scalable port management.** Provides the capability to service clients with shared UDP port allocation, increasing scalability. - -- **Variable-size transmission window (Variable Windows Extension).** Improves TFTP performance by allowing the client and server to determine the largest workable window size. - -![figure 10](images/mdt-11-fig12.png) - -Figure 10. TFTP changes are now easy to perform. - -## Microsoft Deployment Toolkit - - -MDT is a free deployment solution from Microsoft. It provides end-to-end guidance, best practices, and tools for planning, building, and deploying Windows operating systems. MDT builds on top of the core deployment tools in the Windows ADK by contributing guidance, reducing complexity, and adding critical features for an enterprise-ready deployment solution. - -MDT has two main parts: the first is Lite Touch, which is a stand-alone deployment solution; the second is Zero Touch, which is an extension to System Center 2012 R2 Configuration Manager. - -**Note**   -Lite Touch and Zero Touch are marketing names for the two solutions that MDT supports, and the naming has nothing to do with automation. You can fully automate the stand-alone MDT solution (Lite Touch), and you can configure the solution integration with Configuration Manager to prompt for information. - - - -![figure 11](images/mdt-11-fig13.png) - -Figure 11. The Deployment Workbench in, showing a task sequence. - -For more information on MDT, see the [Microsoft Deployment Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=618117) resource center. - -## Microsoft Security Compliance Manager 2013 - - -[Microsoft SCM](https://go.microsoft.com/fwlink/p/?LinkId=619246) is a free utility used to create baseline security settings for the Windows client and server environment. The baselines can be exported and then deployed via Group Policy, local policies, MDT, or Configuration Manager. The current version of Security Compliance Manager includes baselines for Windows 8.1 and several earlier versions of Windows, Windows Server, and Internet Explorer. - -![figure 12](images/mdt-11-fig14.png) - -Figure 12. The SCM console showing a baseline configuration for a fictional client's computer security compliance. - -## Microsoft Desktop Optimization Pack - - -MDOP is a suite of technologies available to Software Assurance customers through an additional subscription. - -The following components are included in the MDOP suite: - -- **Microsoft Application Virtualization (App-V).** App-V 5.0 provides an integrated platform, more flexible virtualization, and powerful management for virtualized applications. With the release of App-V 5.0 SP3, you have support to run virtual applications on Windows 10. - -- **Microsoft User Experience Virtualization (UE-V).** UE-V monitors the changes that are made by users to application settings and Windows operating system settings. The user settings are captured and centralized to a settings storage location. These settings can then be applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. - -- **Microsoft Advanced Group Policy Management (AGPM).** AGPM enables advanced management of Group Policy objects by providing change control, offline editing, and role-based delegation. - -- **Microsoft Diagnostics and Recovery Toolset (DaRT).** DaRT provides additional tools that extend Windows RE to help you troubleshoot and repair your machines. - -- **Microsoft BitLocker Administration and Monitoring (MBAM).** MBAM is an administrator interface used to manage BitLocker drive encryption. It allows you to configure your enterprise with the correct BitLocker encryption policy options, as well as monitor compliance with these policies. - -For more information on the benefits of an MDOP subscription, see [Microsoft Desktop Optimization Pack](https://go.microsoft.com/fwlink/p/?LinkId=619247). - -## Internet Explorer Administration Kit 11 - - -There has been a version of IEAK for every version of Internet Explorer since 3.0. It gives you the capability to customize Internet Explorer as you would like. The end result of using IEAK is an Internet Explorer package that can be deployed unattended. The wizard creates one .exe file and one .msi file. - -![figure 13](images/mdt-11-fig15.png) - -Figure 13. The User Experience selection screen in IEAK 11. - -To download IEAK 11, see the [Internet Explorer Administration Kit (IEAK) Information and Downloads](https://go.microsoft.com/fwlink/p/?LinkId=619248) page. - -## Windows Server Update Services - - -WSUS is a server role in Windows Server 2012 R2 that enables you to maintain a local repository of Microsoft updates and then distribute them to machines on your network. WSUS offers approval control and reporting of update status in your environment. - -![figure 14](images/mdt-11-fig16.png) - -Figure 14. The Windows Server Update Services console. - -For more information on WSUS, see the [Windows Server Update Services Overview](https://go.microsoft.com/fwlink/p/?LinkId=619249). - -## Unified Extensible Firmware Interface - - -For many years BIOS has been the industry standard for booting a PC. BIOS has served us well, but it is time to replace it with something better. **UEFI** is the replacement for BIOS, so it is important to understand the differences between BIOS and UEFI. In this section, you learn the major differences between the two and how they affect operating system deployment. - -### Introduction to UEFI - -BIOS has been in use for approximately 30 years. Even though it clearly has proven to work, it has some limitations, including: - -- 16-bit code - -- 1 MB address space - -- Poor performance on ROM initialization - -- MBR maximum bootable disk size of 2.2 TB - -As the replacement to BIOS, UEFI has many features that Windows can and will use. - -With UEFI, you can benefit from: - -- **Support for large disks.** UEFI requires a GUID Partition Table (GPT) based disk, which means a limitation of roughly 16.8 million TB in disk size and more than 100 primary disks. - -- **Faster boot time.** UEFI does not use INT 13, and that improves boot time, especially when it comes to resuming from hibernate. - -- **Multicast deployment.** UEFI firmware can use multicast directly when it boots up. In WDS, MDT, and Configuration Manager scenarios, you need to first boot up a normal Windows PE in unicast and then switch into multicast. With UEFI, you can run multicast from the start. - -- **Compatibility with earlier BIOS.** Most of the UEFI implementations include a compatibility support module (CSM) that emulates BIOS. - -- **CPU-independent architecture.** Even if BIOS can run both 32- and 64-bit versions of firmware, all firmware device drivers on BIOS systems must also be 16-bit, and this affects performance. One of the reasons is the limitation in addressable memory, which is only 64 KB with BIOS. - -- **CPU-independent drivers.** On BIOS systems, PCI add-on cards must include a ROM that contains a separate driver for all supported CPU architectures. That is not needed for UEFI because UEFI has the ability to use EFI Byte Code (EBC) images, which allow for a processor-independent device driver environment. - -- **Flexible pre-operating system environment.** UEFI can perform many functions for you. You just need an UEFI application, and you can perform diagnostics and automatic repairs, and call home to report errors. - -- **Secure boot.** Windows 8 and later can use the UEFI firmware validation process, called secure boot, which is defined in UEFI 2.3.1. Using this process, you can ensure that UEFI launches only a verified operating system loader and that malware cannot switch the boot loader. - -### Versions - -UEFI Version 2.3.1B is the version required for Windows 8 and later logo compliance. Later versions have been released to address issues; a small number of machines may need to upgrade their firmware to fully support the UEFI implementation in Windows 8 and later. - -### Hardware support for UEFI - -In regard to UEFI, hardware is divided into four device classes: - -- **Class 0 devices.** This is the UEFI definition for a BIOS, or non-UEFI, device. - -- **Class 1 devices.** These devices behave like a standard BIOS machine, but they run EFI internally. They should be treated as normal BIOS-based machines. Class 1 devices use a CSM to emulate BIOS. These older devices are no longer manufactured. - -- **Class 2 devices.** These devices have the capability to behave as a BIOS- or a UEFI-based machine, and the boot process or the configuration in the firmware/BIOS determines the mode. Class 2 devices use a CSM to emulate BIOS. These are the most common type of devices currently available. - -- **Class 3 devices.** These are UEFI-only devices, which means you must run an operating system that supports only UEFI. Those operating systems include Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2. Windows 7 is not supported on these class 3 devices. Class 3 devices do not have a CSM to emulate BIOS. - -### Windows support for UEFI - -Microsoft started with support for EFI 1.10 on servers and then added support for UEFI on both clients and servers. - -With UEFI 2.3.1, there are both x86 and x64 versions of UEFI. Windows 10 supports both. However, UEFI does not support cross-platform boot. This means that a computer that has UEFI x64 can run only a 64-bit operating system, and a computer that has UEFI x86 can run only a 32-bit operating system. - -### How UEFI is changing operating system deployment - -There are many things that affect operating system deployment as soon as you run on UEFI/EFI-based hardware. Here are considerations to keep in mind when working with UEFI devices: - -- Switching from BIOS to UEFI in the hardware is easy, but you also need to reinstall the operating system because you need to switch from MBR/NTFS to GPT/FAT32 and NTFS. - -- When you deploy to a Class 2 device, make sure the boot option you select matches the setting you want to have. It is common for old machines to have several boot options for BIOS but only a few for UEFI, or vice versa. - -- When deploying from media, remember the media has to be FAT32 for UEFI, and FAT32 has a file-size limitation of 4GB. - -- UEFI does not support cross-platform booting; therefore, you need to have the correct boot media (32- or 64-bit). - -For more information on UEFI, see the [UEFI firmware](https://go.microsoft.com/fwlink/p/?LinkId=619251) overview and related resources. - -## Related topics - - - - -[Deploy Windows To Go](deploy-windows-to-go.md) - -[Sideload apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10) - -[Windows ADK for Windows 10 scenarios for IT pros](windows-adk-scenarios-for-it-pros.md) - - - - - - - - - +--- +title: Windows 10 deployment tools (Windows 10) +description: To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. +ms.assetid: 0d6cee1f-14c4-4b69-b29a-43b0b327b877 +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +keywords: deploy, volume activation, BitLocker, recovery, install, installation, VAMT, MDT, USMT, WDS +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows 10 deployment scenarios and tools + + +To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process. In this topic, you will learn about the most commonly used tools for Windows 10 deployment. + +Microsoft provides many tools, services, and solutions. These tools include Windows Deployment Services (WDS), the Volume Activation Management Tool (VAMT), the User State Migration Tool (USMT), Windows System Image Manager (Windows SIM), Windows Preinstallation Environment (Windows PE), and Windows Recovery Environment (Windows RE). Keep in mind that these are just tools and not a complete solution on their own. It’s when you combine these tools with solutions like [Microsoft Deployment Toolkit (MDT)](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) or [Microsoft System Center 2012 R2 Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md) that you get the complete deployment solution. + +In this topic, you also learn about different types of reference images that you can build, and why reference images are beneficial for most organizations + +## Windows Assessment and Deployment Kit + + +Windows ADK contains core assessment and deployment tools and technologies, including Deployment Image Servicing and Management (DISM), Windows Imaging and Configuration Designer (Windows ICD), Windows System Image Manager (Windows SIM), User State Migration Tool (USMT), Volume Activation Management Tool (VAMT), Windows Preinstallation Environment (Windows PE), Windows Assessment Services, Windows Performance Toolkit (WPT), Application Compatibility Toolkit (ACT), and Microsoft SQL Server 2012 Express. For more details, see [Windows ADK for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=526803 ) or [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md). + +![figure 1](images/win-10-adk-select.png) + +Figure 1. The Windows 10 ADK feature selection page. + +### Deployment Image Servicing and Management (DISM) + +DISM is one of the deployment tools included in the Windows ADK and is used for capturing, servicing, and deploying boot images and operating system images. + +DISM services online and offline images. For example, with DISM you can install the Microsoft .NET Framework 3.5.1 in Windows 10 online, which means that you can start the installation in the running operating system, not that you get the software online. The /LimitAccess switch configures DISM to get the files only from a local source: + +``` syntax +Dism.exe /Online /Enable-Feature /FeatureName:NetFX3 /All /Source:D:\Sources\SxS /LimitAccess +``` + +In Windows 10, you can use Windows PowerShell for many of the functions performed by DISM.exe. The equivalent command in Windows 10 using PowerShell is: + +``` syntax +Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All +-Source D:\Sources\SxS -LimitAccess +``` + +![figure 2](images/mdt-11-fig05.png) + +Figure 2. Using DISM functions in PowerShell. + +For more information on DISM, see [DISM technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619161). + +### User State Migration Tool (USMT) + +USMT is a backup and restore tool that allows you to migrate user state, data, and settings from one installation to another. Microsoft Deployment Toolkit (MDT) and System Center 2012 R2 Configuration Manager use USMT as part of the operating system deployment process. + +**Note**   +Occasionally, we find that customers are wary of USMT because they believe it requires significant configuration, but, as you will learn below, using USMT is not difficult. If you use MDT and Lite Touch to deploy your machines, the USMT feature is automatically configured and extended so that it is easy to use. With MDT, you do nothing at all and USMT just works. + + + +USMT includes several command-line tools, the most important of which are ScanState and LoadState: + +- **ScanState.exe.** This performs the user-state backup. + +- **LoadState.exe.** This performs the user-state restore. + +- **UsmtUtils.exe.** This supplements the functionality in ScanState.exe and LoadState.exe. + +In addition to these tools, there are also XML templates that manage which data is migrated. You can customize the templates, or create new ones, to manage the backup process at a high level of detail. USMT uses the following terms for its templates: + +- **Migration templates.** The default templates in USMT. + +- **Custom templates.** Custom templates that you create. + +- **Config template.** An optional template, called Config.xml, which you can use to exclude or include components in a migration without modifying the other standard XML templates. + +![figure 3](images/mdt-11-fig06.png) + +Figure 3. A sample USMT migration file that will exclude .MP3 files on all local drives and include the folder C:\\Data and all its files, including its subdirectories and their files. + +USMT supports capturing data and settings from Windows Vista and later, and restoring the data and settings to Windows 7 and later (including Windows 10 in both cases). It also supports migrating from a 32-bit operating system to a 64-bit operating system, but not the other way around. For example, you can use USMT to migrate from Windows 7 x86 to Windows 10 x64. + +By default USMT migrates many settings, most of which are related to the user profile but also to Control Panel configurations, file types, and more. The default templates that are used in Windows 10 deployments are MigUser.xml and MigApp.xml. These two default templates migrate the following data and settings: + +- Folders from each profile, including those from user profiles as well as shared and public profiles. For example, the My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites folders are migrated. + +- Specific file types. USMT templates migrate the following file types: .accdb, .ch3, .csv, .dif, .doc\*, .dot\*, .dqy, .iqy, .mcw, .mdb\*, .mpp, .one\*, .oqy, .or6, .pot\*, .ppa, .pps\*, .ppt\*, .pre, .pst, .pub, .qdf, .qel, .qph, .qsd, .rqy, .rtf, .scd, .sh3, .slk, .txt, .vl\*, .vsd, .wk\*, .wpd, .wps, .wq1, .wri, .xl\*, .xla, .xlb, .xls\*. + + **Note**   + The OpenDocument extensions (\*.odt, \*.odp, \*.ods, etc.) that Microsoft Office applications can use are not migrated by default. + + + +- Operating system component settings + +- Application settings + +These are the settings migrated by the default MigUser.xml and MigApp.xml templates. For more details on what USMT migrates, see [What does USMT migrate?](https://go.microsoft.com/fwlink/p/?LinkId=619227) For more information on the USMT overall, see the [USMT technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619228). + +### Windows Imaging and Configuration Designer + +Windows Imaging and Configuration Designer (Windows ICD) is a tool designed to assist with the creation of provisioning packages that can be used to dynamically configure a Windows device (PCs, tablets, and phones). This is particularly useful for setting up new devices, without the need for re-imaging the device with a custom image. + +![figure 4](images/windows-icd.png) + +Figure 4. Windows Imaging and Configuration Designer. + +For more information, see [Windows Imaging and Configuration Designer](https://go.microsoft.com/fwlink/p/?LinkID=525483). + +### Windows System Image Manager (Windows SIM) + +Windows SIM is an authoring tool for Unattend.xml files. When using MDT and/or Configuration Manager, you don’t need Windows SIM very often because those systems automatically update the Unattend.xml file during the deployment, greatly simplifying the process overall. + +![figure 7](images/mdt-11-fig07.png) + +Figure 5. Windows answer file opened in Windows SIM. + +For more information, see [Windows System Image Manager Technical Reference]( https://go.microsoft.com/fwlink/p/?LinkId=619906). + +### Volume Activation Management Tool (VAMT) + +If you don’t use KMS, you can still manage your MAKs centrally with the Volume Activation Management Tool (VAMT). With this tool, you can install and manage product keys throughout the organization. VAMT also can activate on behalf of clients without Internet access, acting as a MAK proxy. + +![figure 6](images/mdt-11-fig08.png) + +Figure 6. The updated Volume Activation Management Tool. + +VAMT also can be used to create reports, switch from MAK to KMS, manage Active Directory-based activation, and manage Office 2010 and Office 2013 volume activation. VAMT also supports PowerShell (instead of the old command-line tool). For example, if you want to get information from the VAMT database, you can type: + +``` syntax +Get-VamtProduct +``` + +For more information on the VAMT, see [VAMT technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619230). + +### Windows Preinstallation Environment (Windows PE) + +Windows PE is a “Lite” version of Windows 10 and was created to act as a deployment platform. Windows PE replaces the DOS or Linux boot disks that ruled the deployment solutions of the last decade. + +The key thing to know about Windows PE is that, like the operating system, it needs drivers for at least network and storage devices in each PC. Luckily Windows PE includes the same drivers as the full Windows 10 operating system, which means much of your hardware will work out of the box. + +![figure 7](images/mdt-11-fig09.png) + +Figure 7. A machine booted with the Windows ADK default Windows PE boot image. + +For more details on Windows PE, see [Windows PE (WinPE)](https://go.microsoft.com/fwlink/p/?LinkId=619233). + +## Windows Recovery Environment + + +Windows Recovery Environment (Windows RE) is a diagnostics and recovery toolset included in Windows Vista and later operating systems. The latest version of Windows RE is based on Windows PE. You can also extend Windows RE and add your own tools if needed. If a Windows installation fails to start and Windows RE is installed, you will see an automatic failover into Windows RE. + +![figure 8](images/mdt-11-fig10.png) + +Figure 8. A Windows 10 client booted into Windows RE, showing Advanced options. + +For more information on Windows RE, see [Windows Recovery Environment](https://go.microsoft.com/fwlink/p/?LinkId=619236). + +## Windows Deployment Services + + +Windows Deployment Services (WDS) has been updated and improved in several ways starting with Windows 8. Remember that the two main functions you will use are the PXE boot support and multicast. Most of the changes are related to management and increased performance. In Windows Server 2012 R2, WDS also can be used for the Network Unlock feature in BitLocker. + +![figure 9](images/mdt-11-fig11.png) + +Figure 9. Windows Deployment Services using multicast to deploy three machines. + +In Windows Server 2012 R2, [Windows Deployment Services](https://go.microsoft.com/fwlink/p/?LinkId=619245) can be configured for stand-alone mode or for Active Directory integration. In most scenarios, the Active Directory integration mode is the best option. WDS also has the capability to manage drivers; however, driver management through MDT and Configuration Manager is more suitable for deployment due to the flexibility offered by both solutions, so you will use them instead. In WDS, it is possible to pre-stage devices in Active Directory, but here, too, Configuration Manager has that capability built in, and MDT has the ability to use a SQL Server database for pre-staging. In most scenarios, those solutions are better than the built-in pre-staging function as they allow greater control and management. + +### Trivial File Transfer Protocol (TFTP) configuration + +In some cases, you need to modify TFTP Maximum Block Size settings for performance tuning reasons, especially when PXE traffic travels through routers and such. In the previous version of WDS, it was possible to change that, but the method of do so—editing the registry—was not user friendly. In Windows Server 2012, this has become much easier to do as it can be configured as a setting. + +Also, there are a few new features related to TFTP performance: + +- **Scalable buffer management.** Allows buffering an entire file instead of a fixed-size buffer for each client, enabling different sessions to read from the same shared buffer. + +- **Scalable port management.** Provides the capability to service clients with shared UDP port allocation, increasing scalability. + +- **Variable-size transmission window (Variable Windows Extension).** Improves TFTP performance by allowing the client and server to determine the largest workable window size. + +![figure 10](images/mdt-11-fig12.png) + +Figure 10. TFTP changes are now easy to perform. + +## Microsoft Deployment Toolkit + + +MDT is a free deployment solution from Microsoft. It provides end-to-end guidance, best practices, and tools for planning, building, and deploying Windows operating systems. MDT builds on top of the core deployment tools in the Windows ADK by contributing guidance, reducing complexity, and adding critical features for an enterprise-ready deployment solution. + +MDT has two main parts: the first is Lite Touch, which is a stand-alone deployment solution; the second is Zero Touch, which is an extension to System Center 2012 R2 Configuration Manager. + +**Note**   +Lite Touch and Zero Touch are marketing names for the two solutions that MDT supports, and the naming has nothing to do with automation. You can fully automate the stand-alone MDT solution (Lite Touch), and you can configure the solution integration with Configuration Manager to prompt for information. + + + +![figure 11](images/mdt-11-fig13.png) + +Figure 11. The Deployment Workbench in, showing a task sequence. + +For more information on MDT, see the [Microsoft Deployment Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=618117) resource center. + +## Microsoft Security Compliance Manager 2013 + + +[Microsoft SCM](https://go.microsoft.com/fwlink/p/?LinkId=619246) is a free utility used to create baseline security settings for the Windows client and server environment. The baselines can be exported and then deployed via Group Policy, local policies, MDT, or Configuration Manager. The current version of Security Compliance Manager includes baselines for Windows 8.1 and several earlier versions of Windows, Windows Server, and Internet Explorer. + +![figure 12](images/mdt-11-fig14.png) + +Figure 12. The SCM console showing a baseline configuration for a fictional client's computer security compliance. + +## Microsoft Desktop Optimization Pack + + +MDOP is a suite of technologies available to Software Assurance customers through an additional subscription. + +The following components are included in the MDOP suite: + +- **Microsoft Application Virtualization (App-V).** App-V 5.0 provides an integrated platform, more flexible virtualization, and powerful management for virtualized applications. With the release of App-V 5.0 SP3, you have support to run virtual applications on Windows 10. + +- **Microsoft User Experience Virtualization (UE-V).** UE-V monitors the changes that are made by users to application settings and Windows operating system settings. The user settings are captured and centralized to a settings storage location. These settings can then be applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. + +- **Microsoft Advanced Group Policy Management (AGPM).** AGPM enables advanced management of Group Policy objects by providing change control, offline editing, and role-based delegation. + +- **Microsoft Diagnostics and Recovery Toolset (DaRT).** DaRT provides additional tools that extend Windows RE to help you troubleshoot and repair your machines. + +- **Microsoft BitLocker Administration and Monitoring (MBAM).** MBAM is an administrator interface used to manage BitLocker drive encryption. It allows you to configure your enterprise with the correct BitLocker encryption policy options, as well as monitor compliance with these policies. + +For more information on the benefits of an MDOP subscription, see [Microsoft Desktop Optimization Pack](https://go.microsoft.com/fwlink/p/?LinkId=619247). + +## Internet Explorer Administration Kit 11 + + +There has been a version of IEAK for every version of Internet Explorer since 3.0. It gives you the capability to customize Internet Explorer as you would like. The end result of using IEAK is an Internet Explorer package that can be deployed unattended. The wizard creates one .exe file and one .msi file. + +![figure 13](images/mdt-11-fig15.png) + +Figure 13. The User Experience selection screen in IEAK 11. + +To download IEAK 11, see the [Internet Explorer Administration Kit (IEAK) Information and Downloads](https://go.microsoft.com/fwlink/p/?LinkId=619248) page. + +## Windows Server Update Services + + +WSUS is a server role in Windows Server 2012 R2 that enables you to maintain a local repository of Microsoft updates and then distribute them to machines on your network. WSUS offers approval control and reporting of update status in your environment. + +![figure 14](images/mdt-11-fig16.png) + +Figure 14. The Windows Server Update Services console. + +For more information on WSUS, see the [Windows Server Update Services Overview](https://go.microsoft.com/fwlink/p/?LinkId=619249). + +## Unified Extensible Firmware Interface + + +For many years BIOS has been the industry standard for booting a PC. BIOS has served us well, but it is time to replace it with something better. **UEFI** is the replacement for BIOS, so it is important to understand the differences between BIOS and UEFI. In this section, you learn the major differences between the two and how they affect operating system deployment. + +### Introduction to UEFI + +BIOS has been in use for approximately 30 years. Even though it clearly has proven to work, it has some limitations, including: + +- 16-bit code + +- 1 MB address space + +- Poor performance on ROM initialization + +- MBR maximum bootable disk size of 2.2 TB + +As the replacement to BIOS, UEFI has many features that Windows can and will use. + +With UEFI, you can benefit from: + +- **Support for large disks.** UEFI requires a GUID Partition Table (GPT) based disk, which means a limitation of roughly 16.8 million TB in disk size and more than 100 primary disks. + +- **Faster boot time.** UEFI does not use INT 13, and that improves boot time, especially when it comes to resuming from hibernate. + +- **Multicast deployment.** UEFI firmware can use multicast directly when it boots up. In WDS, MDT, and Configuration Manager scenarios, you need to first boot up a normal Windows PE in unicast and then switch into multicast. With UEFI, you can run multicast from the start. + +- **Compatibility with earlier BIOS.** Most of the UEFI implementations include a compatibility support module (CSM) that emulates BIOS. + +- **CPU-independent architecture.** Even if BIOS can run both 32- and 64-bit versions of firmware, all firmware device drivers on BIOS systems must also be 16-bit, and this affects performance. One of the reasons is the limitation in addressable memory, which is only 64 KB with BIOS. + +- **CPU-independent drivers.** On BIOS systems, PCI add-on cards must include a ROM that contains a separate driver for all supported CPU architectures. That is not needed for UEFI because UEFI has the ability to use EFI Byte Code (EBC) images, which allow for a processor-independent device driver environment. + +- **Flexible pre-operating system environment.** UEFI can perform many functions for you. You just need an UEFI application, and you can perform diagnostics and automatic repairs, and call home to report errors. + +- **Secure boot.** Windows 8 and later can use the UEFI firmware validation process, called secure boot, which is defined in UEFI 2.3.1. Using this process, you can ensure that UEFI launches only a verified operating system loader and that malware cannot switch the boot loader. + +### Versions + +UEFI Version 2.3.1B is the version required for Windows 8 and later logo compliance. Later versions have been released to address issues; a small number of machines may need to upgrade their firmware to fully support the UEFI implementation in Windows 8 and later. + +### Hardware support for UEFI + +In regard to UEFI, hardware is divided into four device classes: + +- **Class 0 devices.** This is the UEFI definition for a BIOS, or non-UEFI, device. + +- **Class 1 devices.** These devices behave like a standard BIOS machine, but they run EFI internally. They should be treated as normal BIOS-based machines. Class 1 devices use a CSM to emulate BIOS. These older devices are no longer manufactured. + +- **Class 2 devices.** These devices have the capability to behave as a BIOS- or a UEFI-based machine, and the boot process or the configuration in the firmware/BIOS determines the mode. Class 2 devices use a CSM to emulate BIOS. These are the most common type of devices currently available. + +- **Class 3 devices.** These are UEFI-only devices, which means you must run an operating system that supports only UEFI. Those operating systems include Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2. Windows 7 is not supported on these class 3 devices. Class 3 devices do not have a CSM to emulate BIOS. + +### Windows support for UEFI + +Microsoft started with support for EFI 1.10 on servers and then added support for UEFI on both clients and servers. + +With UEFI 2.3.1, there are both x86 and x64 versions of UEFI. Windows 10 supports both. However, UEFI does not support cross-platform boot. This means that a computer that has UEFI x64 can run only a 64-bit operating system, and a computer that has UEFI x86 can run only a 32-bit operating system. + +### How UEFI is changing operating system deployment + +There are many things that affect operating system deployment as soon as you run on UEFI/EFI-based hardware. Here are considerations to keep in mind when working with UEFI devices: + +- Switching from BIOS to UEFI in the hardware is easy, but you also need to reinstall the operating system because you need to switch from MBR/NTFS to GPT/FAT32 and NTFS. + +- When you deploy to a Class 2 device, make sure the boot option you select matches the setting you want to have. It is common for old machines to have several boot options for BIOS but only a few for UEFI, or vice versa. + +- When deploying from media, remember the media has to be FAT32 for UEFI, and FAT32 has a file-size limitation of 4GB. + +- UEFI does not support cross-platform booting; therefore, you need to have the correct boot media (32- or 64-bit). + +For more information on UEFI, see the [UEFI firmware](https://go.microsoft.com/fwlink/p/?LinkId=619251) overview and related resources. + +## Related topics + + + + +[Deploy Windows To Go](deploy-windows-to-go.md) + +[Sideload apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10) + +[Windows ADK for Windows 10 scenarios for IT pros](windows-adk-scenarios-for-it-pros.md) + + + + + + + + + diff --git a/windows/docfx.json b/windows/docfx.json index 0e7c823b17..21cba6820f 100644 --- a/windows/docfx.json +++ b/windows/docfx.json @@ -15,6 +15,7 @@ ], "globalMetadata": { "ROBOTS": "INDEX, FOLLOW", + "audience": "ITPro", "breadcrumb_path": "/itpro/windows/breadcrumb/toc.json", "_op_documentIdPathDepotMapping": { "./": { diff --git a/windows/hub/docfx.json b/windows/hub/docfx.json index 78a9eb10fb..b850fee41f 100644 --- a/windows/hub/docfx.json +++ b/windows/hub/docfx.json @@ -34,6 +34,7 @@ "overwrite": [], "externalReference": [], "globalMetadata": { + "audience": "ITPro", "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", "ms.topic": "article", diff --git a/windows/hub/index.md b/windows/hub/index.md index c9bfdfd89d..d9e3556000 100644 --- a/windows/hub/index.md +++ b/windows/hub/index.md @@ -7,9 +7,8 @@ ms.localizationpriority: high ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.date: 07/16/2019 ms.author: dansimp -ms.date: 09/03/2018 +author: dansimp ms.reviewer: dansimp manager: dansimp --- diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 54f9081648..f7e901603e 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: high author: brianlic-msft -ms.author: brianlic +ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index acef50c475..aed5ac00b0 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -36,12 +36,12 @@ At Microsoft, we use Windows diagnostic data to inform our decisions and focus o To frame a discussion about diagnostic data, it is important to understand Microsoft’s privacy principles. We earn customer trust every day by focusing on six key privacy principles as described at [privacy.microsoft.com](https://privacy.microsoft.com/). These principles guided the implementation of the Windows diagnostic data system in the following ways: -- **Control.** We offer customers control of the diagnostic data they share with us by providing easy-to-use management tools. -- **Transparency.** We provide information about the diagnostic data that Windows and Windows Server collects so our customers can make informed decisions. -- **Security.** We encrypt diagnostic data in transit from your device via TLS 1.2, and additionally use certificate pinning to secure the connection. -- **Strong legal protections.** We respect customers’ local privacy laws and fight for legal protection of their privacy as a fundamental human right. -- **No content-based targeting.** We take steps to avoid and minimize the collection of customer content, such as the content of files, chats, or emails, through the Windows diagnostic data system. Customer content inadvertently collected is kept confidential and not used for user targeting. -- **Benefits to you.** We collect Windows diagnostic data to help provide you with an up-to-date, more secure, reliable and performant product, and to improve Windows for all our customers. +- **Control.** We offer customers control of the diagnostic data they share with us by providing easy-to-use management tools. +- **Transparency.** We provide information about the diagnostic data that Windows and Windows Server collects so our customers can make informed decisions. +- **Security.** We encrypt diagnostic data in transit from your device via TLS 1.2, and additionally use certificate pinning to secure the connection. +- **Strong legal protections.** We respect customers’ local privacy laws and fight for legal protection of their privacy as a fundamental human right. +- **No content-based targeting.** We take steps to avoid and minimize the collection of customer content, such as the content of files, chats, or emails, through the Windows diagnostic data system. Customer content inadvertently collected is kept confidential and not used for user targeting. +- **Benefits to you.** We collect Windows diagnostic data to help provide you with an up-to-date, more secure, reliable and performant product, and to improve Windows for all our customers. In previous versions of Windows and Windows Server, Microsoft used diagnostic data to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC), and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server, you can control diagnostic data streams by using the Privacy option in Settings, Group Policy, or MDM. @@ -56,16 +56,16 @@ The release cadence of Windows may be fast, so feedback is critical to its succe ### What is Windows diagnostic data? Windows diagnostic data is vital technical data from Windows devices about the device and how Windows and related software are performing. It's used in the following ways: -- Keep Windows up to date -- Keep Windows secure, reliable, and performant -- Improve Windows – through the aggregate analysis of the use of Windows -- Personalize Windows engagement surfaces +- Keep Windows up to date +- Keep Windows secure, reliable, and performant +- Improve Windows – through the aggregate analysis of the use of Windows +- Personalize Windows engagement surfaces Here are some specific examples of Windows diagnostic data: -- Type of hardware being used -- Applications installed and usage details -- Reliability information on device drivers +- Type of hardware being used +- Applications installed and usage details +- Reliability information on device drivers ### What is NOT diagnostic data? @@ -96,9 +96,9 @@ There was a version of a video driver that was crashing on some devices running Windows diagnostic data also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. Examples are: -- **Start menu.** How do people change the Start menu layout? Do they pin other apps to it? Are there any apps that they frequently unpin? We use this dataset to adjust the default Start menu layout to better reflect people’s expectations when they turn on their device for the first time. -- **Cortana.** We use diagnostic data to monitor the scalability of our cloud service, improving search performance. -- **Application switching.** Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between applications. After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later diagnostic data showed significantly higher usage of this feature. +- **Start menu.** How do people change the Start menu layout? Do they pin other apps to it? Are there any apps that they frequently unpin? We use this dataset to adjust the default Start menu layout to better reflect people’s expectations when they turn on their device for the first time. +- **Cortana.** We use diagnostic data to monitor the scalability of our cloud service, improving search performance. +- **Application switching.** Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between applications. After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later diagnostic data showed significantly higher usage of this feature. **These examples show how the use of diagnostic data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls.** diff --git a/windows/privacy/diagnostic-data-viewer-overview.md b/windows/privacy/diagnostic-data-viewer-overview.md index 8577fea884..7ebad52ee8 100644 --- a/windows/privacy/diagnostic-data-viewer-overview.md +++ b/windows/privacy/diagnostic-data-viewer-overview.md @@ -42,10 +42,10 @@ Before you can use this tool for viewing Windows diagnostic data, you must turn ![Location to turn on data viewing](images/ddv-data-viewing.png) ### Download the Diagnostic Data Viewer -Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/en-us/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page. +Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page. - >[!Important] - >It's possible that your Windows machine may not have the Microsoft Store available (e.g. Windows Server). If this is the case, please check out [Diagnostic Data Viewer for PowerShell](https://go.microsoft.com/fwlink/?linkid=2094264). + >[!Important] + >It's possible that your Windows device doesn't have the Microsoft Store available (for example, Windows Server). If this is the case, see [Diagnostic Data Viewer for PowerShell](https://go.microsoft.com/fwlink/?linkid=2023830). ### Start the Diagnostic Data Viewer You can start this app from the **Settings** panel. diff --git a/windows/privacy/docfx.json b/windows/privacy/docfx.json index 5a6da07e0b..55e655b1dc 100644 --- a/windows/privacy/docfx.json +++ b/windows/privacy/docfx.json @@ -34,6 +34,7 @@ "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", + "audience": "ITPro", "ms.topic": "article", "feedback_system": "GitHub", "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", diff --git a/windows/privacy/gdpr-it-guidance.md b/windows/privacy/gdpr-it-guidance.md index 088f0adccd..f142ad0677 100644 --- a/windows/privacy/gdpr-it-guidance.md +++ b/windows/privacy/gdpr-it-guidance.md @@ -74,7 +74,7 @@ For example, when an organization is using Microsoft Windows Defender Advanced T #### Processor scenario -In the controller scenario described above, Microsoft is a *processor* because Microsoft provides data processing services to that controller (in the given example, an organization that subscribed to Windows Defender ATP and enabled it for the user’s device). As processor, Microsoft only processes data on behalf of the enterprise customer and does not have the right to process data beyond their instructions as specified in a written contract, such as the [Microsoft Product Terms and the Microsoft Online Services Terms (OST)](https://www.microsoft.com/en-us/licensing/product-licensing/products.aspx). +In the controller scenario described above, Microsoft is a *processor* because Microsoft provides data processing services to that controller (in the given example, an organization that subscribed to Windows Defender ATP and enabled it for the user’s device). As processor, Microsoft only processes data on behalf of the enterprise customer and does not have the right to process data beyond their instructions as specified in a written contract, such as the [Microsoft Product Terms and the Microsoft Online Services Terms (OST)](https://www.microsoft.com/licensing/product-licensing/products.aspx). ## GDPR relationship between a Windows 10 user and Microsoft @@ -120,11 +120,11 @@ Diagnostic data is categorized into the levels "Security", "Basic", "Enhanced", Most Windows 10 services are controller services in terms of the GDPR – for both Windows functional data and Windows diagnostic data. But there are a few Windows services where Microsoft is a processor for functional data under the GDPR, such as [Windows Analytics](https://www.microsoft.com/windowsforbusiness/windows-analytics) and [Windows Defender Advanced Threat Protection (ATP)](https://www.microsoft.com/windowsforbusiness/windows-atp). >[!NOTE] ->Both Windows Analytics and Windows Defender ATP are subscription services for organizations. Some functionality requires a certain license (please see [Compare Windows 10 editions](https://www.microsoft.com/en-us/windowsforbusiness/compare)). +>Both Windows Analytics and Windows Defender ATP are subscription services for organizations. Some functionality requires a certain license (please see [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare)). #### Windows Analytics -[Windows Analytics](https://www.microsoft.com/en-us/windowsforbusiness/windows-analytics) is a service that provides rich, actionable information for helping organizations to gain deep insights into the operational efficiency and health of the Windows devices in their environment. It uses Windows diagnostic data from devices enrolled by the IT organization of an enterprise into the Windows Analytics service. +[Windows Analytics](https://www.microsoft.com/windowsforbusiness/windows-analytics) is a service that provides rich, actionable information for helping organizations to gain deep insights into the operational efficiency and health of the Windows devices in their environment. It uses Windows diagnostic data from devices enrolled by the IT organization of an enterprise into the Windows Analytics service. Windows [transmits Windows diagnostic data](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) to Microsoft datacenters, where that data is analyzed and stored. With Windows Analytics, the IT organization can then view the analyzed data to detect and fix issues or to improve their processes for upgrading to Windows 10. @@ -137,7 +137,7 @@ As a result, in terms of the GDPR, the organization that has subscribed to Windo #### Windows Defender ATP -[Windows Defender ATP](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp) is cloud-based service that collects and analyzes usage data from an organization’s devices to detect security threats. Some of the data can contain personal data as defined by the GDPR. Enrolled devices transmit usage data to Microsoft datacenters, where that data is analyzed, processed, and stored. The security operations center (SOC) of the organization can view the analyzed data using the [Windows Defender ATP portal](https://securitycenter.windows.com/). +[Windows Defender ATP](https://www.microsoft.com/WindowsForBusiness/windows-atp) is cloud-based service that collects and analyzes usage data from an organization’s devices to detect security threats. Some of the data can contain personal data as defined by the GDPR. Enrolled devices transmit usage data to Microsoft datacenters, where that data is analyzed, processed, and stored. The security operations center (SOC) of the organization can view the analyzed data using the [Windows Defender ATP portal](https://securitycenter.windows.com/). As a result, in terms of the GDPR, the organization that has subscribed to Windows Defender ATP is acting as the controller, while Microsoft is the processor for Windows Defender ATP. @@ -159,7 +159,7 @@ The following table lists in what GDPR mode – controller or processor – Wind */*Depending on which application/feature this is referring to.* -## Windows diagnostic data and Windows 10 +## Windows diagnostic data and Windows 10 ### Recommended Windows 10 settings @@ -285,7 +285,7 @@ To make it easier to deploy settings that restrict connections from Windows 10 a ### Microsoft Trust Center and Service Trust Portal -Please visit our [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/en-us/trustcenter/privacy/gdpr) to obtain additional resources and to learn more about how Microsoft can help you fulfill specific GDPR requirements. There you can find lots of useful information about the GDPR, including how Microsoft is helping customers to successfully master the GDPR, a FAQ list, and a list of [resources for GDPR compliance](https://www.microsoft.com/en-us/TrustCenter/Privacy/gdpr/resources). Also, please check out the [Compliance Manager](https://aka.ms/compliancemanager) of the Microsoft [Service Trust Portal (STP)](https://aka.ms/stp) and [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted). +Please visit our [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/trustcenter/privacy/gdpr) to obtain additional resources and to learn more about how Microsoft can help you fulfill specific GDPR requirements. There you can find lots of useful information about the GDPR, including how Microsoft is helping customers to successfully master the GDPR, a FAQ list, and a list of [resources for GDPR compliance](https://www.microsoft.com/TrustCenter/Privacy/gdpr/resources). Also, please check out the [Compliance Manager](https://aka.ms/compliancemanager) of the Microsoft [Service Trust Portal (STP)](https://aka.ms/stp) and [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted). ### Additional resources diff --git a/windows/privacy/gdpr-win10-whitepaper.md b/windows/privacy/gdpr-win10-whitepaper.md index 4797029729..259561932e 100644 --- a/windows/privacy/gdpr-win10-whitepaper.md +++ b/windows/privacy/gdpr-win10-whitepaper.md @@ -30,7 +30,7 @@ Microsoft and our customers are now on a journey to achieve the privacy goals of We have outlined our commitment to the GDPR and how we are supporting our customers within the [Get GDPR compliant with the Microsoft Cloud](https://blogs.microsoft.com/on-the-issues/2017/02/15/get-gdpr-compliant-with-the-microsoft-cloud/#hv52B68OZTwhUj2c.99) blog post by our Chief Privacy Officer [Brendon Lynch](https://blogs.microsoft.com/on-the-issues/author/brendonlynch/) and the [Earning your trust with contractual commitments to the General Data Protection Regulation](https://blogs.microsoft.com/on-the-issues/2017/04/17/earning-trust-contractual-commitments-general-data-protection-regulation/#6QbqoGWXCLavGM63.99)” blog post by [Rich Sauer](https://blogs.microsoft.com/on-the-issues/author/rsauer/) - Microsoft Corporate Vice President & Deputy General Counsel. -Although your journey to GDPR-compliance may seem challenging, we're here to help you. For specific information about the GDPR, our commitments and how to begin your journey, please visit the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/en-us/trustcenter/privacy/gdpr). +Although your journey to GDPR-compliance may seem challenging, we're here to help you. For specific information about the GDPR, our commitments and how to begin your journey, please visit the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/trustcenter/privacy/gdpr). ## GDPR and its implications The GDPR is a complex regulation that may require significant changes in how you gather, use and manage personal data. Microsoft has a long history of helping our customers comply with complex regulations, and when it comes to preparing for the GDPR, we are your partner on this journey. @@ -82,7 +82,7 @@ Given how much is involved to become GDPR-compliant, we strongly recommend that ![Diagram about how the 4 key GDPR steps work together](images/gdpr-steps-diagram.png) -For each of the steps, we've outlined example tools, resources, and features in various Microsoft solutions, which can be used to help you address the requirements of that step. While this article isn't a comprehensive “how to,” we've included links for you to find out more details, and more information is available in the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/en-us/trustcenter/privacy/gdpr). +For each of the steps, we've outlined example tools, resources, and features in various Microsoft solutions, which can be used to help you address the requirements of that step. While this article isn't a comprehensive “how to,” we've included links for you to find out more details, and more information is available in the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/trustcenter/privacy/gdpr). ## Windows 10 security and privacy As you work to comply with the GDPR, understanding the role of your desktop and laptop client machines in creating, accessing, processing, storing and managing data that may qualify as personal and potentially sensitive data under the GDPR is important. Windows 10 provides capabilities that will help you comply with the GDPR requirements to implement appropriate technical and organizational security measures to protect personal data. @@ -105,11 +105,11 @@ A key provision within the GDPR is data protection by design and by default, and The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can: -- Generate, store, and limit the use of cryptographic keys. +- Generate, store, and limit the use of cryptographic keys. -- Use TPM technology for platform device authentication by using the TPM’s unique RSA key, which is burned into itself. +- Use TPM technology for platform device authentication by using the TPM’s unique RSA key, which is burned into itself. -- Help to ensure platform integrity by taking and storing security measurements. +- Help to ensure platform integrity by taking and storing security measurements. Additional advanced device protection relevant to your operating without data breaches include Windows Trusted Boot to help maintain the integrity of the system by ensuring malware is unable to start before system defenses. @@ -252,7 +252,7 @@ There are numerous ways one can use the Windows Hello Companion Device Framework - Wear a fitness band that has already authenticated the wearer. Upon approaching PC, and by performing a special gesture (like clapping), the PC unlocks. #### Protection against attacks by isolating user credentials -As noted in the [Windows 10 Credential Theft Mitigation Guide](https://www.microsoft.com/en-us/download/confirmation.aspx?id=54095), “_the tools and techniques criminals use to carry out credential theft and reuse attacks improve, malicious attackers are finding it easier to achieve their goals. Credential theft often relies on operational practices or user credential exposure, so effective mitigations require a holistic approach that addresses people, processes, and technology. In addition, these attacks rely on the attacker stealing credentials after compromising a system to expand or persist access, so organizations must contain breaches rapidly by implementing strategies that prevent attackers from moving freely and undetected in a compromised network._” +As noted in the [Windows 10 Credential Theft Mitigation Guide](https://www.microsoft.com/download/confirmation.aspx?id=54095), “_the tools and techniques criminals use to carry out credential theft and reuse attacks improve, malicious attackers are finding it easier to achieve their goals. Credential theft often relies on operational practices or user credential exposure, so effective mitigations require a holistic approach that addresses people, processes, and technology. In addition, these attacks rely on the attacker stealing credentials after compromising a system to expand or persist access, so organizations must contain breaches rapidly by implementing strategies that prevent attackers from moving freely and undetected in a compromised network._” An important design consideration for Windows 10 was mitigating credential theft — in particular, derived credentials. Windows Defender Credential Guard provides significantly improved security against derived credential theft and reuse by implementing a significant architectural change in Windows designed to help eliminate hardware-based isolation attacks rather than simply trying to defend against them. diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md index f5a74dfff8..8211fc3089 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md @@ -6,35 +6,39 @@ keywords: privacy, manage connections to Microsoft, Windows 10 ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -ms.localizationpriority: medium +ms.localizationpriority: high +audience: ITPro author: medgarmedgar ms.author: v-medgar -ms.date: 7/9/2019 +manager: sanashar +ms.date: 9/10/2019 --- -# Manage connections from Windows operating system components to Microsoft services using Microsoft Intune MDM Server +# Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server **Applies to** - Windows 10 Enterprise 1903 version and newer -You can use Microsoft InTune with MDM CSPs and custom [OMA URIs](https://docs.microsoft.com/intune/custom-settings-windows-10) to minimize connections from Windows to Microsoft services, or to configure particular privacy settings. You can configure diagnostic data at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article. -To ensure CSPs take priority over Group Policies in case of conflicts, use the [ControlPolicyConflict](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-controlpolicyconflict) policy. +This article describes the network connections that Windows 10 components make to Microsoft and the Mobile Device Management/Configuration Service Provider (MDM/CSP) and custom Open Mobile Alliance Uniform Resource Identifier ([OMA URI](https://docs.microsoft.com/intune/custom-settings-windows-10)) policies available to IT Professionals using Microsoft Intune to help manage the data shared with Microsoft. If you want to minimize connections from Windows to Microsoft services, or configure privacy settings, there are a number of settings for consideration. For example, you can configure diagnostic data to the lowest level for your edition of Windows and evaluate other connections Windows makes to Microsoft services you want to turn off using the instructions in this article. While it is possible to minimize network connections to Microsoft, there are many reasons why these communications are enabled by default, such as updating malware definitions and maintaining current certificate revocation lists. This data helps us deliver a secure, reliable, and up-to-date experience. -You can configure diagnostic data at the Security/Basic level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all other connections to Microsoft network endpoints as described in this article to help prevent Windows from sending any data to Microsoft. There are many reasons why these communications are enabled by default, such as updating malware definitions and maintain current certificate revocation lists, which is why we strongly recommend against this. This data helps us deliver a secure, reliable, and more delightful personalized experience. +>[!IMPORTANT] +>- The Allowed Traffic endpoints for an MDM configuration are here: [Allowed Traffic](#bkmk-mdm-allowedtraffic) +> - CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) network traffic cannot be disabled and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of these authorities. There are many others such as DigiCert, Thawte, Google, Symantec, and VeriSign. +> - There is some traffic which is specifically required for the Microsoft Intune based management of Windows 10 devices. This traffic includes Windows Notifications Service (WNS), Automatic Root Certificates Update (ARCU), and some Windows Update related traffic. The aforementioned traffic comprises the Allowed Traffic for Microsoft Intune MDM Server to manage Windows 10 devices. +>- For security reasons, it is important to take care in deciding which settings to configure as some of them may result in a less secure device. Examples of settings that can lead to a less secure device configuration include: disabling Windows Update, disabling Automatic Root Certificates Update, and disabling Windows Defender. Accordingly, we do not recommend disabling any of these features. +>- To ensure CSPs take priority over Group Policies in case of conflicts, use the [ControlPolicyConflict](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-controlpolicyconflict) policy. +>- The **Get Help** and **Give us Feedback** links in Windows may no longer work after applying some or all of the MDM/CSP settings. -Note, there is some traffic which is required (i.e. "whitelisted") for the operation of Windows and the Microsoft InTune based management. This traffic includes CRL and OCSP network traffic which will show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of them, but there are many others, such as DigiCert, Thawte, Google, Symantec, and VeriSign. Additional whitelisted traffic specifically for MDM managed devices includes Windows Notification Service related traffic as well as some specific Microsoft InTune and Windows Update related traffic. +For more information on Microsoft Intune please see [Transform IT service delivery for your modern workplace](https://www.microsoft.com/en-us/enterprise-mobility-security/microsoft-intune?rtc=1) and [Microsoft Intune documentation](https://docs.microsoft.com/intune/). -For more information on Microsoft InTune please see [Transform IT service delivery for your modern workplace](https://www.microsoft.com/en-us/enterprise-mobility-security/microsoft-intune?rtc=1) and [Microsoft Intune documentation](https://docs.microsoft.com/intune/). +For detailed information about managing network connections to Microsoft services using Windows Settings, Group Policies and Registry settings see [Manage connections from Windows 10 operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). -For detailed information about managing network connections to Microsoft services using Registries, Group Policies, or UI see [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). +We are always striving to improve our documentation and welcome your feedback. You can provide feedback by sending email to **telmhelp**@**microsoft.com**. -The endpoints for the MDM “whitelisted” traffic are in the [Whitelisted Traffic](#bkmk-mdm-whitelist). - - -### Settings for Windows 10 Enterprise edition 1903 and newer +## Settings for Windows 10 Enterprise edition 1903 and newer The following table lists management options for each setting. @@ -98,7 +102,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. **OneDrive** 1. MDM Policy: [DisableOneDriveFileSync](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-disableonedrivefilesync). Allows IT Admins to prevent apps and features from working with files on OneDrive. **Set to 1 (one)** 1. Ingest the ADMX - To get the latest OneDrive ADMX file you need an up-to-date Windows 10 client. The ADMX files are located under the following path: %LocalAppData%\Microsoft\OneDrive\ there's a folder with the current OneDrive build (e.g. "18.162.0812.0001"). There is a folder named "adm" which contains the admx and adml policy definition files. - 1. MDM Policy: Prevent Network Traffic before User SignIn. **PreventNetworkTrafficPreUserSignIn**. The OMA-URI value is: ./Device/Vendor/MSFT/Policy/Config/OneDriveNGSC\~Policy\~OneDriveNGSC/PreventNetworkTrafficPreUserSignIn, **String, \** + 1. MDM Policy: Prevent Network Traffic before User SignIn. **PreventNetworkTrafficPreUserSignIn**. The OMA-URI value is: **./Device/Vendor/MSFT/Policy/Config/OneDriveNGSC\~Policy\~OneDriveNGSC/PreventNetworkTrafficPreUserSignIn**, Data type: **String**, Value: **\** 1. **Privacy settings** Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC. @@ -137,6 +141,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. Windows Defender Smartscreen - [Browser/AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen). Disable Windows Defender Smartscreen. **Set to 0 (zero)** 1. Windows Defender Smartscreen EnableAppInstallControl - [SmartScreen/EnableAppInstallControl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-smartscreen#smartscreen-enableappinstallcontrol). Controls whether users are allowed to install apps from places other than the Microsoft Store. **Set to 0 (zero)** 1. Windows Defender Potentially Unwanted Applications(PUA) Protection - [Defender/PUAProtection](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-puaprotection). Specifies the level of detection for potentially unwanted applications (PUAs). **Set to 1 (one)** + 1. [Defender/SignatureUpdateFallbackOrder](https://docs.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm). Allows you to define the order in which different definition update sources should be contacted. The OMA-URI for this is: **./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFallbackOrder**, Data type: **String**, Value: **FileShares** 1. **Windows Spotlight** - [Experience/AllowWindowsSpotlight](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsspotlight). Disable Windows Spotlight. **Set to 0 (zero)** 1. **Microsoft Store** 1. [ApplicationManagement/DisableStoreOriginatedApps](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-disablestoreoriginatedapps). Boolean value that disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded. **Set to 1 (one)** @@ -150,18 +155,18 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. Windows Update Service URL - [Update/UpdateServiceUrl](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-update#update-updateserviceurl). Allows the device to check for updates from a WSUS server instead of Microsoft Update. **Set to String** with the Value: 1. **\\$CmdID$\\\chr\text/plain\\ \./Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl\\http://abcd-srv:8530\\** -### Allowed traffic ("Whitelisted traffic") for Microsoft InTune / MDM configurations +### Allowed traffic for Microsoft Intune / MDM configurations |**Allowed traffic endpoints** | | --- | -|ctldl.windowsupdate.com| +|activation-v2.sls.microsoft.com/*| |cdn.onenote.net| +|client.wns.windows.com| +|crl.microsoft.com/pki/crl/*| +|ctldl.windowsupdate.com| +|dm3p.wns.windows.com| +|\*microsoft.com/pkiops/\*| +|ocsp.digicert.com/*| |r.manage.microsoft.com| |tile-service.weather.microsoft.com| |settings-win.data.microsoft.com| -|client.wns.windows.com| -|dm3p.wns.windows.com| -|crl.microsoft.com/pki/crl/*| -|*microsoft.com/pkiops/**| -|activation-v2.sls.microsoft.com/*| -|ocsp.digicert.com/*| diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index a7aec9de77..71b2aa6e37 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -1,5 +1,5 @@ --- -title: Manage connections from Windows operating system components to Microsoft services (Windows 10) +title: Manage connections from Windows 10 operating system components to Microsoft services description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 ms.reviewer: @@ -7,17 +7,17 @@ keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2 ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -ms.localizationpriority: medium +ms.localizationpriority: high audience: ITPro -author: dansimp -ms.author: dansimp -manager: dansimp +author: medgarmedgar +ms.author: v-medgar +manager: sanashar ms.collection: M365-security-compliance ms.topic: article -ms.date: 05/16/2019 +ms.date: 9/17/2019 --- -# Manage connections from Windows operating system components to Microsoft services +# Manage connections from Windows 10 operating system components to Microsoft services **Applies to** @@ -25,29 +25,24 @@ ms.date: 05/16/2019 - Windows Server 2016 - Windows Server 2019 -If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). +This article describes the network connections that Windows 10 components make to Microsoft and the Windows Settings, Group Policies and registry settings available to IT Professionals to help manage the data shared with Microsoft. If you want to minimize connections from Windows to Microsoft services, or configure privacy settings, there are a number of settings for consideration. For example, you can configure diagnostic data to the lowest level for your edition of Windows and evaluate other connections Windows makes to Microsoft services you want to turn off using the instructions in this article. While it is possible to minimize network connections to Microsoft, there are many reasons why these communications are enabled by default, such as updating malware definitions and maintaining current certificate revocation lists. This data helps us deliver a secure, reliable, and up-to-date experience. -Learn about the network connections that Windows components make to Microsoft in addition to the privacy settings that affect the data which is shared with either Microsoft or apps and how they can be managed by an IT Pro. +Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887) package that will allow your organization to quickly configure the settings covered in this document to restrict connections from Windows 10 to Microsoft. The Windows Restricted Traffic Limited Baseline is based on [Group Policy Administrative Template](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) functionality and the package you download contains further instructions on how to deploy to devices in your organization. Since some of the settings can reduce the functionality and security configuration of your device, **before deploying Windows Restricted Traffic Limited Functionality Baseline** make sure you **choose the right settings configuration for your environment** and **ensure that Windows and Windows Defender are fully up to date**. Failure to do so may result in errors or unexpected behavior. You should not extract this package to the windows\system32 folder because it will not apply correctly. -If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure diagnostic data at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article. +>[!IMPORTANT] +> - The Allowed Traffic endpoints are listed here: [Allowed Traffic](#bkmk-allowedtraffic) +> - CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) network traffic cannot be disabled and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of these authorities. There are many others such as DigiCert, Thawte, Google, Symantec, and VeriSign. +> - For security reasons, it is important to take care in deciding which settings to configure as some of them may result in a less secure device. Examples of settings that can lead to a less secure device configuration include: Windows Update, Automatic Root Certificates Update, and Windows Defender. Accordingly, we do not recommend disabling any of these features. +> - It is recommended that you restart a device after making configuration changes to it. +> - The **Get Help** and **Give us Feedback** links no longer work after the Windows Restricted Traffic Limited Functionality Baseline is applied. -You can configure diagnostic data at the Security/Basic level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all other connections to Microsoft network endpoints as described in this article to help prevent Windows from sending any data to Microsoft. There are many reasons why these communications are enabled by default, such as updating malware definitions and maintain current certificate revocation lists, which is why we strongly recommend against this. This data helps us deliver a secure, reliable, and more delightful personalized experience. +To use Microsoft Intune cloud based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm) -To help make it easier to deploy settings to restrict connections from Windows 10 to Microsoft, you can apply the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887), but **before application please ensure that Windows and Windows Defender are fully up to date**. Failure to do so may result in errors. This baseline was created in the same way as the [Windows security baselines](/windows/device-security/windows-security-baselines) that are often used to efficiently configure Windows to a known secure state. -Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document. However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended. Make sure you've chosen the right settings configuration for your environment before applying. -You should not extract this package to the windows\\system32 folder because it will not apply correctly. +We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting **telmhelp**@**microsoft.com**. -Applying the Windows Restricted Traffic Limited Functionality Baseline is the same as applying each setting covered in this article. -It is recommended that you restart a device after making configuration changes to it. -Note that **Get Help** and **Give us Feedback** links no longer work after the Windows Restricted Traffic Limited Functionality Baseline is applied. +## Management options for each setting -To use Microsoft InTune cloud based device management for restricting traffic please refer to the [Manage connections from Windows operating system components to Microsoft services using MDM](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm). - -We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. - -## Management options for each setting - -The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure diagnostic data at the Security level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all of these connections. +The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure diagnostic data at the Security level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all of these connections ### Settings for Windows 10 Enterprise edition @@ -230,7 +225,7 @@ For more information, see [Automatic Root Certificates Update Configuration](htt Although not recommended, you can turn off Automatic Root Certificates Update, which also prevents updates to the disallowed certificate list and the pin rules list. > [!CAUTION] -> By not automatically downloading the root certificates, the device might have not been able to connect to some websites. +> By not automatically downloading the root certificates the device may not be able to connect to some websites. For Windows 10, Windows Server 2016 with Desktop Experience, and Windows Server 2016 Server Core: @@ -260,7 +255,7 @@ On Windows Server 2016 Nano Server: - Create the registry path **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\AuthRoot** and then add a REG_DWORD registry setting, named **DisableRootAutoUpdate**, with a value of 1. >[!NOTE] ->CRL and OCSP network traffic is currently whitelisted and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of them, but there are many others, such as DigiCert, Thawte, Google, Symantec, and VeriSign. +>CRL and OCSP network traffic is currently Allowed Traffic and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of them, but there are many others, such as DigiCert, Thawte, Google, Symantec, and VeriSign. ### 2. Cortana and Search @@ -276,7 +271,6 @@ Find the Cortana Group Policy objects under **Computer Configuration** > **Ad | Allow search and Cortana to use location | Choose whether Cortana and Search can provide location-aware search results.

                        **Disable** this policy to block access to location information for Cortana. | | Do not allow web search | Choose whether to search the web from Windows Desktop Search.

                        **Enable** this policy to remove the option to search the Internet from Cortana. | | Don't search the web or display web results in Search| Choose whether to search the web from Cortana.

                        **Enable** this policy to stop web queries and results from showing in Search. | -| Set what information is shared in Search | Control what information is shared with Bing in Search.

                        If you **enable** this policy and set it to **Anonymous info**, usage information will be shared but not search history, Microsoft Account information, or specific location. | You can also apply the Group Policies using the following registry keys: @@ -286,7 +280,7 @@ You can also apply the Group Policies using the following registry keys: | Allow search and Cortana to use location | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
                        REG_DWORD: AllowSearchToUseLocation
                        Value: 0 | | Do not allow web search | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
                        REG_DWORD: DisableWebSearch
                        Value: 1 | | Don't search the web or display web results in Search| HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
                        REG_DWORD: ConnectedSearchUseWeb
                        Value: 0 | -| Set what information is shared in Search | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
                        REG_DWORD: ConnectedSearchPrivacy
                        Value: 3 | + >[!IMPORTANT] > Using the Group Policy editor these steps are required for all supported versions of Windows 10, however they are not required for devices running Windows 10, version 1607 or Windows Server 2016. @@ -390,7 +384,7 @@ Windows Insider Preview builds only apply to Windows 10 and are not available fo > [!NOTE] -> If you upgrade a device that is configured to minimize connections from Windows to Microsoft services (that is, a device configured for zero exhaust) to a Windows Insider Preview build, the Feedback & Diagnostic setting will automatically be set to **Full**. Although the diagnostic data level may initially appear as **Basic**, a few hours after the UI is refreshed or the machine is rebooted, the setting will become **Full**. +> If you upgrade a device that is configured to minimize connections from Windows to Microsoft services (that is, a device configured for Restricted Traffic) to a Windows Insider Preview build, the Feedback & Diagnostic setting will automatically be set to **Full**. Although the diagnostic data level may initially appear as **Basic**, a few hours after the UI is refreshed or the machine is rebooted, the setting will become **Full**. To turn off Insider Preview builds for a released version of Windows 10: @@ -1049,11 +1043,11 @@ To turn off dictation of your voice, speaking to Cortana and other apps, and to If you're running at Windows 10, version 1703 up to and including Windows 10, version 1803, you can turn off updates to the speech recognition and speech synthesis models: - - **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Speech** > **Allow automatic update of Speech Data** +- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Speech** > **Allow automatic update of Speech Data** -or- - - Create a REG_DWORD registry setting named **AllowSpeechModelUpdate** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Speech** with a **value of 0 (zero)** +- Create a REG_DWORD registry setting named **AllowSpeechModelUpdate** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Speech** with a **value of 0 (zero)** @@ -1260,7 +1254,7 @@ To turn off **Let your apps use your trusted devices (hardware you've already co ### 18.16 Feedback & diagnostics -In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. +In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft. If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). To change how frequently **Windows should ask for my feedback**: @@ -1415,11 +1409,11 @@ In the **Inking & Typing** area you can configure the functionality as such: To turn off Inking & Typing data collection (note: there is no Group Policy for this setting): - - In the UI go to **Settings -> Privacy -> Diagnostics & Feedback -> Inking and typing** and turn **Improve inking & typing** to **Off** +- In the UI go to **Settings -> Privacy -> Diagnostics & Feedback -> Inking and typing** and turn **Improve inking & typing** to **Off** -or- - - Set **RestrictImplicitTextCollection** registry REG_DWORD setting in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\InputPersonalization** to a **value of 1 (one)** +- Set **RestrictImplicitTextCollection** registry REG_DWORD setting in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\InputPersonalization** to a **value of 1 (one)** ### 18.22 Activity History @@ -1484,29 +1478,29 @@ To turn this Off in the UI: Enterprise customers can manage their Windows activation status with volume licensing using an on-premises Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by doing one of the following: - **For Windows 10:** +**For Windows 10:** - - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation** -or- - - Create a REG_DWORD registry setting named **NoGenTicket** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a **value of 1 (one)**. +- Create a REG_DWORD registry setting named **NoGenTicket** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a **value of 1 (one)**. **For Windows Server 2019 or later:** - - **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation** +- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation** -or- - - Create a REG_DWORD registry setting named **NoGenTicket** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one). +- Create a REG_DWORD registry setting named **NoGenTicket** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one). **For Windows Server 2016:** - - Create a REG_DWORD registry setting named **NoAcquireGT** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one). +- Create a REG_DWORD registry setting named **NoAcquireGT** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one). - >[!NOTE] - >Due to a known issue the **Turn off KMS Client Online AVS Validation** group policy does not work as intended on Windows Server 2016, the **NoAcquireGT** value needs to be set instead. - >The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. +>[!NOTE] +>Due to a known issue the **Turn off KMS Client Online AVS Validation** group policy does not work as intended on Windows Server 2016, the **NoAcquireGT** value needs to be set instead. +>The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS. ### 20. Storage health @@ -1584,7 +1578,7 @@ You can disconnect from the Microsoft Antimalware Protection Service. >[!IMPORTANT] >**Required Steps BEFORE setting the Windows Defender Group Policy or RegKey on Windows 10 version 1903** >1. Ensure Windows and Windows Defender are fully up to date. ->2. Search the Start menu for "Tamper Protection" by clicking on the search icon next to the Windows Start button. Then scroll down to >the Tamper Protection toggle and turn it **Off**. This will allow you to modify the Registry key and allow the Group Policy to make >the setting. Alternatively, you can go to **Windows Security Settings -> Virus & threat protection, click on Manage Settings** link >and then scroll down to the Tamper Protection toggle to set it to **Off**. +>2. Search the Start menu for "Tamper Protection" by clicking on the search icon next to the Windows Start button. Then scroll down to the Tamper Protection toggle and turn it **Off**. This will allow you to modify the Registry key and allow the Group Policy to make the setting. Alternatively, you can go to **Windows Security Settings -> Virus & threat protection, click on Manage Settings** link and then scroll down to the Tamper Protection toggle to set it to **Off**. - **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Join Microsoft MAPS** and then select **Disabled** from the drop-down box named **Join Microsoft MAPS** @@ -1623,7 +1617,7 @@ You can stop downloading **Definition Updates**: - **Remove** the **DefinitionUpdateFileSharesSources** reg value if it exists under **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Signature Updates** -You can turn off **Malicious Software Reporting Tool diagnostic data**: +You can turn off **Malicious Software Reporting Tool (MSRT) diagnostic data**: - Set the REG_DWORD value **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to **1**. @@ -1730,7 +1724,7 @@ If you're running Windows 10, version 1607 or later, you need to: > The Group Policy for the **LockScreenOverlaysDisabled** regkey is **Force a specific default lock screen and logon image** that is under **Control Panel** **Personalization**. --AND- + \-AND- - Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips** to **Enabled** @@ -1740,7 +1734,7 @@ If you're running Windows 10, version 1607 or later, you need to: - Create a new REG_DWORD registry setting named **DisableSoftLanding** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)** --AND- + \-AND- - Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences** to **Enabled** @@ -1881,7 +1875,16 @@ For China releases of Windows 10 there is one additional Regkey to be set to pre - Add a REG_DWORD value named **HapDownloadEnabled** to **HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LexiconUpdate\\loc_0804** and set the value to 0. + +### Allowed traffic list for Windows Restricted Traffic Limited Functionality Baseline + +|**Allowed traffic endpoints** | +| --- | +|activation-v2.sls.microsoft.com/*| +|crl.microsoft.com/pki/crl/*| +|ocsp.digicert.com/*| +|www.microsoft.com/pkiops/*| To learn more, see [Device update management](https://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](https://technet.microsoft.com/library/cc720539.aspx). diff --git a/windows/privacy/manage-windows-1709-endpoints.md b/windows/privacy/manage-windows-1709-endpoints.md index 4f007d6da6..ae5da4bba4 100644 --- a/windows/privacy/manage-windows-1709-endpoints.md +++ b/windows/privacy/manage-windows-1709-endpoints.md @@ -23,11 +23,11 @@ ms.reviewer: Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: -- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. -- Connecting to email servers to send and receive email. -- Connecting to the web for every day web browsing. -- Connecting to the cloud to store and access backups. -- Using your location to show a weather forecast. +- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. +- Connecting to email servers to send and receive email. +- Connecting to the web for every day web browsing. +- Connecting to the cloud to store and access backups. +- Using your location to show a weather forecast. This article lists different endpoints that are available on a clean installation of Windows 10, version 1709 and later. Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). diff --git a/windows/privacy/manage-windows-1803-endpoints.md b/windows/privacy/manage-windows-1803-endpoints.md index c8c4bffe0c..2ad044d990 100644 --- a/windows/privacy/manage-windows-1803-endpoints.md +++ b/windows/privacy/manage-windows-1803-endpoints.md @@ -23,11 +23,11 @@ ms.reviewer: Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: -- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. -- Connecting to email servers to send and receive email. -- Connecting to the web for every day web browsing. -- Connecting to the cloud to store and access backups. -- Using your location to show a weather forecast. +- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. +- Connecting to email servers to send and receive email. +- Connecting to the web for every day web browsing. +- Connecting to the cloud to store and access backups. +- Using your location to show a weather forecast. This article lists different endpoints that are available on a clean installation of Windows 10, version 1709 and later. Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md index 2f2f90b82d..f574f6409d 100644 --- a/windows/privacy/manage-windows-1809-endpoints.md +++ b/windows/privacy/manage-windows-1809-endpoints.md @@ -23,11 +23,11 @@ ms.reviewer: Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: -- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. -- Connecting to email servers to send and receive email. -- Connecting to the web for every day web browsing. -- Connecting to the cloud to store and access backups. -- Using your location to show a weather forecast. +- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. +- Connecting to email servers to send and receive email. +- Connecting to the web for every day web browsing. +- Connecting to the cloud to store and access backups. +- Using your location to show a weather forecast. This article lists different endpoints that are available on a clean installation of Windows 10, version 1709 and later. Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). diff --git a/windows/privacy/manage-windows-1903-endpoints.md b/windows/privacy/manage-windows-1903-endpoints.md index 5400e152f2..01c084966d 100644 --- a/windows/privacy/manage-windows-1903-endpoints.md +++ b/windows/privacy/manage-windows-1903-endpoints.md @@ -22,11 +22,11 @@ ms.date: 5/3/2019 Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: -- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. -- Connecting to email servers to send and receive email. -- Connecting to the web for every day web browsing. -- Connecting to the cloud to store and access backups. -- Using your location to show a weather forecast. +- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. +- Connecting to email servers to send and receive email. +- Connecting to the web for every day web browsing. +- Connecting to the cloud to store and access backups. +- Using your location to show a weather forecast. This article lists different endpoints that are available on a clean installation of Windows 10, version 1709 and later. Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). diff --git a/windows/release-information/TOC.md b/windows/release-information/TOC.md index c905dea447..41ca5d90c0 100644 --- a/windows/release-information/TOC.md +++ b/windows/release-information/TOC.md @@ -24,7 +24,7 @@ # Previous versions ## Windows 8.1 and Windows Server 2012 R2 ### [Known issues and notifications](status-windows-8.1-and-windows-server-2012-r2.yml) -###[Resolved issues](resolved-issues-windows-8.1-and-windows-server-2012-r2.yml) +### [Resolved issues](resolved-issues-windows-8.1-and-windows-server-2012-r2.yml) ## Windows Server 2012 ### [Known issues and notifications](status-windows-server-2012.yml) ### [Resolved issues](resolved-issues-windows-server-2012.yml) @@ -33,4 +33,4 @@ ### [Resolved issues](resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml) ## Windows Server 2008 SP2 ### [Known issues and notifications](status-windows-server-2008-sp2.yml) -### [Resolved issues](resolved-issues-windows-server-2008-sp2.yml) \ No newline at end of file +### [Resolved issues](resolved-issues-windows-server-2008-sp2.yml) diff --git a/windows/release-information/docfx.json b/windows/release-information/docfx.json index 5bab1ca43c..4dcacaf204 100644 --- a/windows/release-information/docfx.json +++ b/windows/release-information/docfx.json @@ -38,6 +38,7 @@ "breadcrumb_path": "/windows/release-information/breadcrumb/toc.json", "ms.prod": "w10", "ms.date": "4/30/2019", + "audience": "ITPro", "titleSuffix": "Windows Release Information", "extendBreadcrumb": true, "feedback_system": "None" diff --git a/windows/release-information/resolved-issues-windows-10-1507.yml b/windows/release-information/resolved-issues-windows-10-1507.yml index 048946f759..b4f166be36 100644 --- a/windows/release-information/resolved-issues-windows-10-1507.yml +++ b/windows/release-information/resolved-issues-windows-10-1507.yml @@ -32,17 +32,13 @@ sections: - type: markdown text: " + + - - - - - -
                        SummaryOriginating updateStatusDate resolved
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

                        See details >                        		OS Build 10240.18305

                        August 13, 2019
                        KB4512497                        		Resolved
                        KB4517276                        		August 17, 2019
                        02:00 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                        See details >                        		OS Build 10240.18244

                        June 11, 2019
                        KB4503291                        		Resolved External
                        		August 09, 2019
                        07:03 PM PT
                        Event Viewer may close or you may receive an error when using Custom Views
                        When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                        See details >                        		OS Build 10240.18244

                        June 11, 2019
                        KB4503291                        		Resolved
                        KB4507458                        		July 09, 2019
                        10:00 AM PT
                        Unable to access some gov.uk websites
                        gov.uk websites that don’t support “HSTS” may not be accessible

                        See details >                        		OS Build 10240.18215

                        May 14, 2019
                        KB4499154                        		Resolved
                        KB4505051                        		May 19, 2019
                        02:00 PM PT
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                        See details >                        		OS Build 10240.18132

                        February 12, 2019
                        KB4487018                        		Resolved
                        KB4493475                        		April 09, 2019
                        10:00 AM PT
                        Unable to access hotspots with third-party applications
                        Third-party applications may have difficulty authenticating hotspots.

                        See details >                        		OS Build 10240.18094

                        January 08, 2019
                        KB4480962                        		Resolved
                        KB4487018                        		February 12, 2019
                        10:00 AM PT
                        MSXML6 may cause applications to stop responding
                        MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        See details >                        		OS Build 10240.18094

                        January 08, 2019
                        KB4480962                        		Resolved
                        KB4493475                        		April 09, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        Users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files.

                        See details >                        		OS Build 10240.18132

                        February 12, 2019
                        KB4487018                        		Resolved
                        KB4489872                        		March 12, 2019
                        10:00 AM PT
                        Internet Explorer may fail to load images
                        Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        See details >                        		OS Build 10240.18132

                        February 12, 2019
                        KB4487018                        		Resolved
                        KB4491101                        		February 21, 2019
                        02:00 PM PT
                        First character of Japanese era name not recognized
                        The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        See details >                        		OS Build 10240.18132

                        February 12, 2019
                        KB4487018                        		Resolved
                        KB4489872                        		March 12, 2019
                        10:00 AM PT
                        Custom URI schemes may not start corresponding application
                        Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                        See details >                        		OS Build 10240.18158

                        March 12, 2019
                        KB4489872                        		Resolved
                        KB4493475                        		April 09, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                        See details >                        		OS Build 10240.18094

                        January 08, 2019
                        KB4480962                        		Resolved
                        KB4487018                        		February 12, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        See details >                        		OS Build 10240.18132

                        February 12, 2019
                        KB4487018                        		Resolved
                        KB4489872                        		March 12, 2019
                        10:00 AM PT
                        " @@ -53,6 +49,16 @@ sections:
                        " +- title: August 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        After installing KB4512497, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4517276. This ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4517276 and install. For instructions, see Update Windows 10.

                        Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                        Back to top                        		OS Build 10240.18305

                        August 13, 2019
                        KB4512497                        		Resolved
                        KB4517276                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        August 14, 2019
                        03:34 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503291) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                        Back to top                        		OS Build 10240.18244

                        June 11, 2019
                        KB4503291                        		Resolved External
                        		Last updated:
                        August 09, 2019
                        07:03 PM PT

                        Opened:
                        August 09, 2019
                        04:25 PM PT
                        + " + - title: June 2019 - items: - type: markdown @@ -86,10 +92,6 @@ sections: text: " - - - -
                        DetailsOriginating updateStatusHistory
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                         
                        For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                         
                        Affected platforms:  
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4493475. 

                        Back to top                        		OS Build 10240.18132

                        February 12, 2019
                        KB4487018                        		Resolved
                        KB4493475                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        After installing KB4487018, users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue is resolved in KB4489872.

                        Back to top                        		OS Build 10240.18132

                        February 12, 2019
                        KB4487018                        		Resolved
                        KB4489872                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Internet Explorer may fail to load images
                        After installing KB4487018, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                        Resolution: This issue is resolved in KB4491101.

                        Back to top                        		OS Build 10240.18132

                        February 12, 2019
                        KB4487018                        		Resolved
                        KB4491101                        		Resolved:
                        February 21, 2019
                        02:00 PM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        First character of Japanese era name not recognized
                        After installing KB4487018, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4489872.

                        Back to top                        		OS Build 10240.18132

                        February 12, 2019
                        KB4487018                        		Resolved
                        KB4489872                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4489872.

                        Back to top                        		OS Build 10240.18132

                        February 12, 2019
                        KB4487018                        		Resolved
                        KB4489872                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        " @@ -98,8 +100,6 @@ sections: - type: markdown text: " - -
                        DetailsOriginating updateStatusHistory
                        Unable to access hotspots with third-party applications
                        After installing KB4480962, third-party applications may have difficulty authenticating hotspots.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue is resolved in KB4487018.

                        Back to top                        		OS Build 10240.18094

                        January 08, 2019
                        KB4480962                        		Resolved
                        KB4487018                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        MSXML6 may cause applications to stop responding
                        After installing KB4480962, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue was resolved in KB4493475.

                        Back to top                        		OS Build 10240.18094

                        January 08, 2019
                        KB4480962                        		Resolved
                        KB4493475                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, \"Unrecognized Database Format\".

                        Affected platforms:
                        • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487018.

                        Back to top                        		OS Build 10240.18094

                        January 08, 2019
                        KB4480962                        		Resolved
                        KB4487018                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        " diff --git a/windows/release-information/resolved-issues-windows-10-1607.yml b/windows/release-information/resolved-issues-windows-10-1607.yml index c20d9b33f0..f2e5cd3bcb 100644 --- a/windows/release-information/resolved-issues-windows-10-1607.yml +++ b/windows/release-information/resolved-issues-windows-10-1607.yml @@ -32,6 +32,13 @@ sections: - type: markdown text: " + + + + + + + @@ -47,14 +54,7 @@ sections: - - - - - - -
                        SummaryOriginating updateStatusDate resolved
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

                        See details >                        		OS Build 14393.3204

                        September 10, 2019
                        KB4516044                        		Resolved
                        		September 17, 2019
                        04:47 PM PT
                        Apps and scripts using the NetQueryDisplayInformation API may fail with error
                        Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

                        See details >                        		OS Build 14393.3053

                        June 18, 2019
                        KB4503294                        		Resolved
                        KB4516044                        		September 10, 2019
                        10:00 AM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 14393.3115

                        July 16, 2019
                        KB4507459                        		Resolved
                        KB4512517                        		August 13, 2019
                        10:00 AM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 14393.3025

                        June 11, 2019
                        KB4503267                        		Resolved
                        KB4512495                        		August 17, 2019
                        02:00 PM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

                        See details >                        		OS Build 14393.3144

                        August 13, 2019
                        KB4512517                        		Resolved
                        KB4512495                        		August 17, 2019
                        02:00 PM PT
                        Internet Explorer 11 and apps using the WebBrowser control may fail to render
                        JavaScript may fail to render as expected in Internet Explorer 11 and in apps using JavaScript or the WebBrowser control.

                        See details >                        		OS Build 14393.3085

                        July 09, 2019
                        KB4507460                        		Resolved
                        KB4512517                        		August 13, 2019
                        10:00 AM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                        See details >                        		OS Build 14393.3025

                        June 11, 2019
                        KB4503267                        		Resolved External
                        		August 09, 2019
                        07:03 PM PT
                        SCVMM cannot enumerate and manage logical switches deployed on the host
                        For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host.

                        See details >                        		OS Build 14393.2639

                        November 27, 2018
                        KB4467684                        		Resolved
                        KB4507459                        		July 16, 2019
                        10:00 AM PT
                        Some applications may fail to run as expected on clients of AD FS 2016
                        Some applications may fail to run as expected on clients of Active Directory Federation Services 2016 (AD FS 2016)

                        See details >                        		OS Build 14393.2941

                        April 25, 2019
                        KB4493473                        		Resolved
                        KB4507459                        		July 16, 2019
                        10:00 AM PT
                        Devices with Hyper-V enabled may receive BitLocker error 0xC0210000
                        Some devices with Hyper-V enabled may start into BitLocker recovery with error 0xC0210000.

                        See details >                        		OS Build 14393.2969

                        May 14, 2019
                        KB4494440                        		Resolved
                        KB4507460                        		July 09, 2019
                        10:00 AM PT
                        Internet Explorer 11 authentication issue with multiple concurrent logons
                        Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.

                        See details >                        		OS Build 14393.2724

                        January 08, 2019
                        KB4480961                        		Resolved
                        KB4493470                        		April 09, 2019
                        10:00 AM PT
                        End-user-defined characters (EUDC) may cause blue screen at startup
                        If you enable per font end-user-defined characters (EUDC), the system will stop working and a blue screen may appear at startup.

                        See details >                        		OS Build 14393.2879

                        March 19, 2019
                        KB4489889                        		Resolved
                        KB4493470                        		April 09, 2019
                        10:00 AM PT
                        MSXML6 may cause applications to stop responding
                        MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        See details >                        		OS Build 14393.2724

                        January 08, 2019
                        KB4480961                        		Resolved
                        KB4493470                        		April 09, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                        See details >                        		OS Build 14393.2791

                        February 12, 2019
                        KB4487026                        		Resolved
                        KB4489882                        		March 12, 2019
                        10:00 AM PT
                        Internet Explorer may fail to load images
                        Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        See details >                        		OS Build 14393.2791

                        February 12, 2019
                        KB4487026                        		Resolved
                        KB4487006                        		February 19, 2019
                        02:00 PM PT
                        First character of the Japanese era name not recognized as an abbreviation
                        The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        See details >                        		OS Build 14393.2759

                        January 17, 2019
                        KB4480977                        		Resolved
                        KB4487006                        		February 19, 2019
                        02:00 PM PT
                        Custom URI schemes may not start corresponding application
                        Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                        See details >                        		OS Build 14393.2848

                        March 12, 2019
                        KB4489882                        		Resolved
                        KB4493473                        		April 25, 2019
                        02:00 PM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                        See details >                        		OS Build 14393.2724

                        January 08, 2019
                        KB4480961                        		Resolved
                        KB4487026                        		February 12, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        See details >                        		OS Build 14393.2791

                        February 12, 2019
                        KB4487026                        		Resolved
                        KB4487006                        		February 19, 2019
                        02:00 PM PT
                        Issue hosting multiple terminal server sessions and a user logs off on Windows Server
                        In some cases, Windows Server will stop working and restart when hosting multiple terminal server sessions and a user logs off.

                        See details >                        		OS Build 14393.2828

                        February 19, 2019
                        KB4487006                        		Resolved
                        KB4489882                        		March 12, 2019
                        10:00 AM PT
                        Instant search in Microsoft Outlook fails on Windows Server 2016
                        Instant search in Microsoft Outlook clients fail with the error, \"Outlook cannot perform the search\" on Windows Server 2016.

                        See details >                        		OS Build 14393.2639

                        November 27, 2018
                        KB4467684                        		Resolved
                        KB4487026                        		February 12, 2019
                        10:00 AM PT
                        " @@ -65,6 +65,38 @@ sections:
                        " +- title: September 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: After investigation, we have found that this issue does not affect this version of Windows.

                        Back to top                        		OS Build 14393.3204

                        September 10, 2019
                        KB4516044                        		Resolved
                        		Resolved:
                        September 17, 2019
                        04:47 PM PT

                        Opened:
                        September 13, 2019
                        05:25 PM PT
                        + " + +- title: August 2019 +- items: + - type: markdown + text: " + + + + +
                        DetailsOriginating updateStatusHistory
                        Apps and scripts using the NetQueryDisplayInformation API may fail with error
                         Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

                        Affected platforms:
                        • Server: Windows Server 2019; Windows Server 2016
                        Resolution: This issue was resolved in KB4516044.

                        Back to top                        		OS Build 14393.3053

                        June 18, 2019
                        KB4503294                        		Resolved
                        KB4516044                        		Resolved:
                        September 10, 2019
                        10:00 AM PT

                        Opened:
                        August 01, 2019
                        05:00 PM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        After installing KB4512517, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4512495. This ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512495 and install. For instructions, see Update Windows 10.

                        Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                        Back to top                        		OS Build 14393.3144

                        August 13, 2019
                        KB4512517                        		Resolved
                        KB4512495                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        August 14, 2019
                        03:34 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503267) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                        Back to top                        		OS Build 14393.3025

                        June 11, 2019
                        KB4503267                        		Resolved External
                        		Last updated:
                        August 09, 2019
                        07:03 PM PT

                        Opened:
                        August 09, 2019
                        04:25 PM PT
                        + " + +- title: July 2019 +- items: + - type: markdown + text: " + + + + +
                        DetailsOriginating updateStatusHistory
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507459. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                        HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: This issue was resolved in KB4512517 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                        Back to top                        		OS Build 14393.3115

                        July 16, 2019
                        KB4507459                        		Resolved
                        KB4512517                        		Resolved:
                        August 13, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503267 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512495.

                        Back to top                        		OS Build 14393.3025

                        June 11, 2019
                        KB4503267                        		Resolved
                        KB4512495                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        Internet Explorer 11 and apps using the WebBrowser control may fail to render
                        Internet Explorer 11 may fail to render some JavaScript after installing KB4507460. You may also have issues with apps using JavaScript or the WebBrowser control, such as the present PowerPoint feature of Skype Meeting Broadcast.

                        Affected platforms:
                        • Client: Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server 2016
                        Resolution: This issue was resolved in KB4512517.

                        Back to top                        		OS Build 14393.3085

                        July 09, 2019
                        KB4507460                        		Resolved
                        KB4512517                        		Resolved:
                        August 13, 2019
                        10:00 AM PT

                        Opened:
                        July 26, 2019
                        04:58 PM PT
                        + " + - title: June 2019 - items: - type: markdown @@ -115,10 +147,6 @@ sections: text: " - - - -
                        DetailsOriginating updateStatusHistory
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                         
                        For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                         
                        Affected platforms:  
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4493470. 

                        Back to top                        		OS Build 14393.2791

                        February 12, 2019
                        KB4487026                        		Resolved
                        KB4493470                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        After installing KB4487026, users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue is resolved in KB4489882.

                        Back to top                        		OS Build 14393.2791

                        February 12, 2019
                        KB4487026                        		Resolved
                        KB4489882                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Internet Explorer may fail to load images
                        After installing KB4487026, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                        Resolution: This issue is resolved in KB4487006.

                        Back to top                        		OS Build 14393.2791

                        February 12, 2019
                        KB4487026                        		Resolved
                        KB4487006                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487006.

                        Back to top                        		OS Build 14393.2791

                        February 12, 2019
                        KB4487026                        		Resolved
                        KB4487006                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Issue hosting multiple terminal server sessions and a user logs off on Windows Server
                        In some cases, Windows Server will stop working and restart when hosting multiple terminal server sessions and a user logs off. The faulting driver is win32kbase.sys.

                        Affected platforms:
                        • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                        • Server: Windows Server 2016
                        Resolution: This issue is resolved in KB4489882.

                        Back to top                        		OS Build 14393.2828

                        February 19, 2019
                        KB4487006                        		Resolved
                        KB4489882                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        February 19, 2019
                        02:00 PM PT
                        " @@ -129,8 +157,6 @@ sections: - -
                        DetailsOriginating updateStatusHistory
                        Internet Explorer 11 authentication issue with multiple concurrent logons
                        After installing KB4480961, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
                        • Cache size and location show zero or empty.
                        • Keyboard shortcuts may not work properly.
                        • Webpages may intermittently fail to load or render correctly.
                        • Issues with credential prompts.
                        • Issues when downloading files.
                        Affected platforms: 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                        Resolution: This issue was resolved in KB4493470.

                        Back to top                        		OS Build 14393.2724

                        January 08, 2019
                        KB4480961                        		Resolved
                        KB4493470                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        MSXML6 may cause applications to stop responding
                        After installing KB4480961, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue was resolved in KB4493470.

                        Back to top                        		OS Build 14393.2724

                        January 08, 2019
                        KB4480961                        		Resolved
                        KB4493470                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        First character of the Japanese era name not recognized as an abbreviation
                        After installing KB4480977, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487006.

                        Back to top                        		OS Build 14393.2759

                        January 17, 2019
                        KB4480977                        		Resolved
                        KB4487006                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        January 17, 2019
                        02:00 PM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, “Unrecognized Database Format”.

                        Affected platforms:
                        • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4487026.

                        Back to top                        		OS Build 14393.2724

                        January 08, 2019
                        KB4480961                        		Resolved
                        KB4487026                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        " @@ -140,6 +166,5 @@ sections: text: " -
                        DetailsOriginating updateStatusHistory
                        SCVMM cannot enumerate and manage logical switches deployed on the host
                        For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host after installing KB4467684.

                        Additionally, if you do not follow the best practices, a stop error may occur in vfpext.sys on the hosts.

                        Affected platforms:
                        • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                        • Server: Windows Server 2016
                        Resolution: This issue was resolved in KB4507459.

                        Back to top                        		OS Build 14393.2639

                        November 27, 2018
                        KB4467684                        		Resolved
                        KB4507459                        		Resolved:
                        July 16, 2019
                        10:00 AM PT

                        Opened:
                        November 27, 2018
                        10:00 AM PT
                        Instant search in Microsoft Outlook fails on Windows Server 2016
                        After installing KB4467684 on Windows Server 2016, instant search in Microsoft Outlook clients fail with the error, \"Outlook cannot perform the search\".

                        Affected platforms:
                        • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                        • Server: Windows Server 2016
                        Resolution: This issue is resolved in KB4487026.

                        Back to top                        		OS Build 14393.2639

                        November 27, 2018
                        KB4467684                        		Resolved
                        KB4487026                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        November 27, 2018
                        10:00 AM PT
                        " diff --git a/windows/release-information/resolved-issues-windows-10-1703.yml b/windows/release-information/resolved-issues-windows-10-1703.yml index b87928c05d..a15dc08538 100644 --- a/windows/release-information/resolved-issues-windows-10-1703.yml +++ b/windows/release-information/resolved-issues-windows-10-1703.yml @@ -32,6 +32,10 @@ sections: - type: markdown text: " + + + + @@ -41,13 +45,7 @@ sections: - - - - - -
                        SummaryOriginating updateStatusDate resolved
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

                        See details >                        		OS Build 15063.2045

                        September 10, 2019
                        KB4516068                        		Resolved
                        		September 17, 2019
                        04:47 PM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 15063.1955

                        July 16, 2019
                        KB4507467                        		Resolved
                        KB4512507                        		August 13, 2019
                        10:00 AM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

                        See details >                        		OS Build 15063.1988

                        August 13, 2019
                        KB4512507                        		Resolved
                        KB4512474                        		August 17, 2019
                        02:00 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                        See details >                        		OS Build 15063.1868

                        June 11, 2019
                        KB4503279                        		Resolved External
                        		August 09, 2019
                        07:03 PM PT
                        Devices with Hyper-V enabled may receive BitLocker error 0xC0210000
                        Some devices with Hyper-V enabled may start into BitLocker recovery with error 0xC0210000.

                        See details >                        		OS Build 15063.1805

                        May 14, 2019
                        KB4499181                        		Resolved
                        KB4507450                        		July 09, 2019
                        10:00 AM PT
                        Difficulty connecting to some iSCSI-based SANs
                        Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

                        See details >                        		OS Build 15063.1839

                        May 28, 2019
                        KB4499162                        		Resolved
                        KB4509476                        		June 26, 2019
                        04:00 PM PT
                        Event Viewer may close or you may receive an error when using Custom Views
                        When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                        See details >                        		OS Build 15063.1868

                        June 11, 2019
                        KB4503279                        		Resolved
                        KB4503289                        		June 18, 2019
                        02:00 PM PT
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                        See details >                        		OS Build 15063.1631

                        February 12, 2019
                        KB4487020                        		Resolved
                        KB4493474                        		April 09, 2019
                        10:00 AM PT
                        End-user-defined characters (EUDC) may cause blue screen at startup
                        If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.

                        See details >                        		OS Build 15063.1716

                        March 19, 2019
                        KB4489888                        		Resolved
                        KB4493474                        		April 09, 2019
                        10:00 AM PT
                        MSXML6 may cause applications to stop responding
                        MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        See details >                        		OS Build 15063.1563

                        January 08, 2019
                        KB4480973                        		Resolved
                        KB4493474                        		April 09, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                        See details >                        		OS Build 15063.1659

                        February 19, 2019
                        KB4487011                        		Resolved
                        KB4489871                        		March 12, 2019
                        10:00 AM PT
                        Internet Explorer may fail to load images
                        Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        See details >                        		OS Build 15063.1631

                        February 12, 2019
                        KB4487020                        		Resolved
                        KB4487011                        		February 19, 2019
                        02:00 PM PT
                        First character of the Japanese era name not recognized as an abbreviation
                        The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        See details >                        		OS Build 15063.1596

                        January 15, 2019
                        KB4480959                        		Resolved
                        KB4487011                        		February 19, 2019
                        02:00 PM PT
                        Custom URI schemes may not start corresponding application
                        Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                        See details >                        		OS Build 15063.1689

                        March 12, 2019
                        KB4489871                        		Resolved
                        KB4493436                        		April 25, 2019
                        02:00 PM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                        See details >                        		OS Build 15063.1563

                        January 08, 2019
                        KB4480973                        		Resolved
                        KB4487020                        		February 12, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        See details >                        		OS Build 15063.1631

                        February 12, 2019
                        KB4487020                        		Resolved
                        KB4487011                        		February 19, 2019
                        02:00 PM PT
                        Webpages become unresponsive in Microsoft Edge
                        Microsoft Edge users report difficulty browsing and loading webpages.

                        See details >                        		OS Build 15063.1563

                        January 08, 2019
                        KB4480973                        		Resolved
                        KB4487020                        		February 12, 2019
                        10:00 AM PT
                        " @@ -58,6 +56,35 @@ sections:
                        " +- title: September 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: After investigation, we have found that this issue does not affect this version of Windows.

                        Back to top                        		OS Build 15063.2045

                        September 10, 2019
                        KB4516068                        		Resolved
                        		Resolved:
                        September 17, 2019
                        04:47 PM PT

                        Opened:
                        September 13, 2019
                        05:25 PM PT
                        + " + +- title: August 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        After installing KB4512507, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4512474. This ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512474 and install. For instructions, see Update Windows 10.

                        Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                        Back to top                        		OS Build 15063.1988

                        August 13, 2019
                        KB4512507                        		Resolved
                        KB4512474                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        August 14, 2019
                        03:34 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503279) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                        Back to top                        		OS Build 15063.1868

                        June 11, 2019
                        KB4503279                        		Resolved External
                        		Last updated:
                        August 09, 2019
                        07:03 PM PT

                        Opened:
                        August 09, 2019
                        04:25 PM PT
                        + " + +- title: July 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507467. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                        HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: This issue was resolved in KB4512507 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                        Back to top                        		OS Build 15063.1955

                        July 16, 2019
                        KB4507467                        		Resolved
                        KB4512507                        		Resolved:
                        August 13, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        + " + - title: June 2019 - items: - type: markdown @@ -96,9 +123,6 @@ sections: text: " - - -
                        DetailsOriginating updateStatusHistory
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                         
                        For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                         
                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4493474. 

                        Back to top                        		OS Build 15063.1631

                        February 12, 2019
                        KB4487020                        		Resolved
                        KB4493474                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        After installing KB4487011, users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue is resolved in KB4489871.

                        Back to top                        		OS Build 15063.1659

                        February 19, 2019
                        KB4487011                        		Resolved
                        KB4489871                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        February 19, 2019
                        02:00 PM PT
                        Internet Explorer may fail to load images
                        After installing KB4487020, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                        Resolution: This issue is resolved in KB4487011.

                        Back to top                        		OS Build 15063.1631

                        February 12, 2019
                        KB4487020                        		Resolved
                        KB4487011                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487011.

                        Back to top                        		OS Build 15063.1631

                        February 12, 2019
                        KB4487020                        		Resolved
                        KB4487011                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        " @@ -108,8 +132,5 @@ sections: text: " - - -
                        DetailsOriginating updateStatusHistory
                        MSXML6 may cause applications to stop responding
                        After installing KB4480973, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue was resolved in KB4493474.

                        Back to top                        		OS Build 15063.1563

                        January 08, 2019
                        KB4480973                        		Resolved
                        KB4493474                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        First character of the Japanese era name not recognized as an abbreviation
                        After installing KB4480959, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487011.

                        Back to top                        		OS Build 15063.1596

                        January 15, 2019
                        KB4480959                        		Resolved
                        KB4487011                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        January 15, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, “Unrecognized Database Format”.

                        Affected platforms:
                        • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487020.

                        Back to top                        		OS Build 15063.1563

                        January 08, 2019
                        KB4480973                        		Resolved
                        KB4487020                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Webpages become unresponsive in Microsoft Edge
                        After installing KB4480973, some Microsoft Edge users report that they:
                        • Cannot load web pages using a local IP address.
                        • Cannot load web pages on the Internet using a VPN connection.
                        Browsing fails or the web page may become unresponsive.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                        Resolution: This issue is resolved in KB4486996. 

                        Back to top                        		OS Build 15063.1563

                        January 08, 2019
                        KB4480973                        		Resolved
                        KB4487020                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        " diff --git a/windows/release-information/resolved-issues-windows-10-1709.yml b/windows/release-information/resolved-issues-windows-10-1709.yml index cd92b2d492..b9fb594146 100644 --- a/windows/release-information/resolved-issues-windows-10-1709.yml +++ b/windows/release-information/resolved-issues-windows-10-1709.yml @@ -32,6 +32,10 @@ sections: - type: markdown text: " + + + + @@ -42,12 +46,6 @@ sections: - - - - - -
                        SummaryOriginating updateStatusDate resolved
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 16299.1296

                        July 16, 2019
                        KB4507465                        		Resolved
                        KB4512516                        		August 13, 2019
                        10:00 AM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 16299.1217

                        June 11, 2019
                        KB4503284                        		Resolved
                        KB4512494                        		August 16, 2019
                        02:00 PM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

                        See details >                        		OS Build 16299.1331

                        August 13, 2019
                        KB4512516                        		Resolved
                        KB4512494                        		August 16, 2019
                        02:00 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                        See details >                        		OS Build 16299.1217

                        June 11, 2019
                        KB4503284                        		Resolved External
                        		August 09, 2019
                        07:03 PM PT
                        Difficulty connecting to some iSCSI-based SANs
                        Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

                        See details >                        		OS Build 16299.1182

                        May 28, 2019
                        KB4499147                        		Resolved
                        KB4509477                        		June 26, 2019
                        04:00 PM PT
                        Event Viewer may close or you may receive an error when using Custom Views
                        When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                        See details >                        		OS Build 16299.1217

                        June 11, 2019
                        KB4503284                        		Resolved
                        KB4503281                        		June 18, 2019
                        02:00 PM PT
                        Opening Internet Explorer 11 may fail
                        Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.

                        See details >                        		OS Build 16299.1182

                        May 28, 2019
                        KB4499147                        		Resolved
                        KB4503284                        		June 11, 2019
                        10:00 AM PT
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                        See details >                        		OS Build 16299.967

                        February 12, 2019
                        KB4486996                        		Resolved
                        KB4493441                        		April 09, 2019
                        10:00 AM PT
                        End-user-defined characters (EUDC) may cause blue screen at startup
                        If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.

                        See details >                        		OS Build 16299.1059

                        March 19, 2019
                        KB4489890                        		Resolved
                        KB4493441                        		April 09, 2019
                        10:00 AM PT
                        MSXML6 causes applications to stop responding if an exception was thrown
                        MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        See details >                        		OS Build 16299.904

                        January 08, 2019
                        KB4480978                        		Resolved
                        KB4493441                        		April 09, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                        See details >                        		OS Build 16299.967

                        February 12, 2019
                        KB4486996                        		Resolved
                        KB4489886                        		March 12, 2019
                        10:00 AM PT
                        Internet Explorer may fail to load images
                        Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        See details >                        		OS Build 16299.967

                        February 12, 2019
                        KB4486996                        		Resolved
                        KB4487021                        		February 19, 2019
                        02:00 PM PT
                        First character of the Japanese era name not recognized as an abbreviation
                        The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        See details >                        		OS Build 16299.936

                        January 15, 2019
                        KB4480967                        		Resolved
                        KB4487021                        		February 19, 2019
                        02:00 PM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                        See details >                        		OS Build 16299.904

                        January 08, 2019
                        KB4480978                        		Resolved
                        KB4486996                        		February 12, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        See details >                        		OS Build 16299.967

                        February 12, 2019
                        KB4486996                        		Resolved
                        KB4487021                        		February 19, 2019
                        02:00 PM PT
                        Webpages become unresponsive in Microsoft Edge
                        Microsoft Edge users report difficulty browsing and loading webpages.

                        See details >                        		OS Build 16299.904

                        January 08, 2019
                        KB4480978                        		Resolved
                        KB4486996                        		February 12, 2019
                        10:00 AM PT
                        Stop error when attempting to start SSH from WSL
                        A stop error occurs when attempting to start Secure Shell from Windows Subsystem for Linux with agent forwarding using a command line switch (ssh –A) or a configuration setting.

                        See details >                        		OS Build 16299.1029

                        March 12, 2019
                        KB4489886                        		Resolved
                        KB4493441                        		April 09, 2019
                        10:00 AM PT
                        " @@ -59,6 +57,27 @@ sections:
                        " +- title: August 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        After installing KB4512516, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4512494. The ‘optional’ update will be available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512494 and install. For instructions, see Update Windows 10.

                        Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                        Back to top                        		OS Build 16299.1331

                        August 13, 2019
                        KB4512516                        		Resolved
                        KB4512494                        		Resolved:
                        August 16, 2019
                        02:00 PM PT

                        Opened:
                        August 14, 2019
                        03:34 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503284) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                        Back to top                        		OS Build 16299.1217

                        June 11, 2019
                        KB4503284                        		Resolved External
                        		Last updated:
                        August 09, 2019
                        07:03 PM PT

                        Opened:
                        August 09, 2019
                        04:25 PM PT
                        + " + +- title: July 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507465. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                        HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: This issue was resolved in KB4512516 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                        Back to top                        		OS Build 16299.1296

                        July 16, 2019
                        KB4507465                        		Resolved
                        KB4512516                        		Resolved:
                        August 13, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503284 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512494.

                        Back to top                        		OS Build 16299.1217

                        June 11, 2019
                        KB4503284                        		Resolved
                        KB4512494                        		Resolved:
                        August 16, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        + " + - title: June 2019 - items: - type: markdown @@ -106,9 +125,6 @@ sections: text: " - - -
                        DetailsOriginating updateStatusHistory
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                         
                        For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                         
                        Affected platforms:  
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4493441. 

                        Back to top                        		OS Build 16299.967

                        February 12, 2019
                        KB4486996                        		Resolved
                        KB4493441                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        After installing KB4486996, users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue is resolved in KB4489886.

                        Back to top                        		OS Build 16299.967

                        February 12, 2019
                        KB4486996                        		Resolved
                        KB4489886                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Internet Explorer may fail to load images
                        After installing KB4486996, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                        Resolution: This issue is resolved in KB4487021.

                        Back to top                        		OS Build 16299.967

                        February 12, 2019
                        KB4486996                        		Resolved
                        KB4487021                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487021.

                        Back to top                        		OS Build 16299.967

                        February 12, 2019
                        KB4486996                        		Resolved
                        KB4487021                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        " @@ -118,8 +134,5 @@ sections: text: " - - -
                        DetailsOriginating updateStatusHistory
                        MSXML6 causes applications to stop responding if an exception was thrown
                        After installing KB4480978, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue is resolved in KB4493441.

                        Back to top                        		OS Build 16299.904

                        January 08, 2019
                        KB4480978                        		Resolved
                        KB4493441                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        First character of the Japanese era name not recognized as an abbreviation
                        After installing KB4480967, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487021.

                        Back to top                        		OS Build 16299.936

                        January 15, 2019
                        KB4480967                        		Resolved
                        KB4487021                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        January 15, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, “Unrecognized Database Format.”

                        Affected platforms:
                        • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4486996.

                        Back to top                        		OS Build 16299.904

                        January 08, 2019
                        KB4480978                        		Resolved
                        KB4486996                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Webpages become unresponsive in Microsoft Edge
                        After installing KB4480978, some Microsoft Edge users report that they:
                        • Cannot load web pages using a local IP address. 
                        • Cannot load web pages on the Internet using a VPN connection.  
                        Browsing fails or the web page may become unresponsive. 

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                        Resolution: This issue is resolved in KB4486996.

                        Back to top                        		OS Build 16299.904

                        January 08, 2019
                        KB4480978                        		Resolved
                        KB4486996                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        " diff --git a/windows/release-information/resolved-issues-windows-10-1803.yml b/windows/release-information/resolved-issues-windows-10-1803.yml index 7174542746..a65cc10df5 100644 --- a/windows/release-information/resolved-issues-windows-10-1803.yml +++ b/windows/release-information/resolved-issues-windows-10-1803.yml @@ -32,6 +32,11 @@ sections: - type: markdown text: " + + + + + @@ -41,13 +46,7 @@ sections: - - - - - -
                        SummaryOriginating updateStatusDate resolved
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 17134.915

                        July 16, 2019
                        KB4507466                        		Resolved
                        KB4512501                        		August 13, 2019
                        10:00 AM PT
                        Notification issue: \"Your device is missing important security and quality fixes.\"
                        Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"

                        See details >                        		N/A

                        		Resolved
                        		September 03, 2019
                        12:32 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 17134.829

                        June 11, 2019
                        KB4503286                        		Resolved
                        KB4512509                        		August 19, 2019
                        02:00 PM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

                        See details >                        		OS Build 17134.950

                        August 13, 2019
                        KB4512501                        		Resolved
                        KB4512509                        		August 19, 2019
                        02:00 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                        See details >                        		OS Build 17134.829

                        June 11, 2019
                        KB4503286                        		Resolved External
                        		August 09, 2019
                        07:03 PM PT
                        Difficulty connecting to some iSCSI-based SANs
                        Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

                        See details >                        		OS Build 17134.799

                        May 21, 2019
                        KB4499183                        		Resolved
                        KB4509478                        		June 26, 2019
                        04:00 PM PT
                        Event Viewer may close or you may receive an error when using Custom Views
                        When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                        See details >                        		OS Build 17134.829

                        June 11, 2019
                        KB4503286                        		Resolved
                        KB4503288                        		June 18, 2019
                        02:00 PM PT
                        Opening Internet Explorer 11 may fail
                        Internet Explorer 11 may fail to open if Default Search Provider is not set or is malformed.

                        See details >                        		OS Build 17134.799

                        May 21, 2019
                        KB4499183                        		Resolved
                        KB4503286                        		June 11, 2019
                        10:00 AM PT
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                        See details >                        		OS Build 17134.590

                        February 12, 2019
                        KB4487017                        		Resolved
                        KB4493464                        		April 09, 2019
                        10:00 AM PT
                        End-user-defined characters (EUDC) may cause blue screen at startup
                        If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.

                        See details >                        		OS Build 17134.677

                        March 19, 2019
                        KB4489894                        		Resolved
                        KB4493464                        		April 09, 2019
                        10:00 AM PT
                        MSXML6 may cause applications to stop responding
                        MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        See details >                        		OS Build 17134.523

                        January 08, 2019
                        KB4480966                        		Resolved
                        KB4493464                        		April 09, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        Users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files.

                        See details >                        		OS Build 17134.590

                        February 12, 2019
                        KB4487017                        		Resolved
                        KB4489868                        		March 12, 2019
                        10:00 AM PT
                        Internet Explorer may fail to load images
                        Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        See details >                        		OS Build 17134.590

                        February 12, 2019
                        KB4487017                        		Resolved
                        KB4487029                        		February 19, 2019
                        02:00 PM PT
                        First character of the Japanese era name not recognized
                        The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        See details >                        		OS Build 17134.556

                        January 15, 2019
                        KB4480976                        		Resolved
                        KB4487029                        		February 19, 2019
                        02:00 PM PT
                        Custom URI schemes may not start corresponding application
                        Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                        See details >                        		OS Build 17134.648

                        March 12, 2019
                        KB4489868                        		Resolved
                        KB4493437                        		April 25, 2019
                        02:00 PM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        See details >                        		OS Build 17134.523

                        January 08, 2019
                        KB4480966                        		Resolved
                        KB4487017                        		February 12, 2019
                        10:00 AM PT
                        Cannot pin a web link on the Start menu or the taskbar
                        Some users cannot pin a web link on the Start menu or the taskbar.

                        See details >                        		OS Build 17134.471

                        December 11, 2018
                        KB4471324                        		Resolved
                        KB4487029                        		February 19, 2019
                        02:00 PM PT
                        Webpages become unresponsive in Microsoft Edge
                        Microsoft Edge users report difficulty browsing and loading webpages.

                        See details >                        		OS Build 17134.523

                        January 08, 2019
                        KB4480966                        		Resolved
                        KB4487017                        		February 12, 2019
                        10:00 AM PT
                        Stop error when attempting to start SSH from WSL
                        A stop error occurs when attempting to start Secure Shell from Windows Subsystem for Linux with agent forwarding using a command line switch (ssh –A) or a configuration setting.

                        See details >                        		OS Build 17134.648

                        March 12, 2019
                        KB4489868                        		Resolved
                        KB4493464                        		April 09, 2019
                        10:00 AM PT
                        " @@ -59,6 +58,36 @@ sections:
                        " +- title: September 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        Notification issue: \"Your device is missing important security and quality fixes.\"
                        Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes\" in the Windows Update dialog and a red \"!\" in the task tray on the Windows Update tray icon. This notification is intended for devices that are 90 days or more out of date, but some users with installed updates released in June or July also saw this notification.

                        Affected platforms:
                        • Client: Windows 10, version 1803
                        • Server: Windows Server, version 1803
                        Resolution: This issue was resolved on the server side on August 30, 2019. Only devices that are out of date by 90 days or more should now see the notification. No action is required by the user to resolve this issue. If you are still seeing the \"Your device is missing important security and quality fixes\" notification, we recommend selecting Check for Updates in the Windows Update dialog. For instructions, see Update Windows 10. Microsoft always recommends trying to keep your devices up to date, as the monthly updates contain important security fixes. 

                        Back to top                        		N/A

                        		Resolved
                        		Resolved:
                        September 03, 2019
                        12:32 PM PT

                        Opened:
                        September 03, 2019
                        12:32 PM PT
                        + " + +- title: August 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        After installing KB4512501, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4512509. The ‘optional’ update will be available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512509 and install. For instructions, see Update Windows 10.

                        Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                        Back to top                        		OS Build 17134.950

                        August 13, 2019
                        KB4512501                        		Resolved
                        KB4512509                        		Resolved:
                        August 19, 2019
                        02:00 PM PT

                        Opened:
                        August 14, 2019
                        03:34 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503286) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                        Back to top                        		OS Build 17134.829

                        June 11, 2019
                        KB4503286                        		Resolved External
                        		Last updated:
                        August 09, 2019
                        07:03 PM PT

                        Opened:
                        August 09, 2019
                        04:25 PM PT
                        + " + +- title: July 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507466. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                        HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: This issue was resolved in KB4512501 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                        Back to top                        		OS Build 17134.915

                        July 16, 2019
                        KB4507466                        		Resolved
                        KB4512501                        		Resolved:
                        August 13, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503286 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512509.

                        Back to top                        		OS Build 17134.829

                        June 11, 2019
                        KB4503286                        		Resolved
                        KB4512509                        		Resolved:
                        August 19, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        + " + - title: June 2019 - items: - type: markdown @@ -106,8 +135,6 @@ sections: text: " - -
                        DetailsOriginating updateStatusHistory
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                         
                        For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                         
                        Affected platforms:  
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4493464. 

                        Back to top                        		OS Build 17134.590

                        February 12, 2019
                        KB4487017                        		Resolved
                        KB4493464                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        After installing KB4487017, users may received \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files. 

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue is resolved in KB4489868.

                        Back to top                        		OS Build 17134.590

                        February 12, 2019
                        KB4487017                        		Resolved
                        KB4489868                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Internet Explorer may fail to load images
                        After installing KB4487017, Internet Explorer may fail to load images with a backslash (\\) in their relative source path. 

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                        Resolution: This issue is resolved in KB4487029. 

                        Back to top                        		OS Build 17134.590

                        February 12, 2019
                        KB4487017                        		Resolved
                        KB4487029                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        " @@ -117,17 +144,5 @@ sections: text: " - - - -
                        DetailsOriginating updateStatusHistory
                        MSXML6 may cause applications to stop responding
                        After installing KB4480966, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue was resolved in KB4493464. 

                        Back to top                        		OS Build 17134.523

                        January 08, 2019
                        KB4480966                        		Resolved
                        KB4493464                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        First character of the Japanese era name not recognized
                        After installing KB4480976, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487029. 

                        Back to top                        		OS Build 17134.556

                        January 15, 2019
                        KB4480976                        		Resolved
                        KB4487029                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working. 

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487017.

                        Back to top                        		OS Build 17134.523

                        January 08, 2019
                        KB4480966                        		Resolved
                        KB4487017                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Webpages become unresponsive in Microsoft Edge
                        After installing KB4480966, some Microsoft Edge users report that they: 
                        • Cannot load web pages using a local IP address. 
                        • Cannot load web pages on the Internet using a VPN connection.  
                        Browsing fails or the web page may become unresponsive. 

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                        Resolution: This issue is resolved in KB4487017. 

                        Back to top                        		OS Build 17134.523

                        January 08, 2019
                        KB4480966                        		Resolved
                        KB4487017                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        - " - -- title: December 2018 -- items: - - type: markdown - text: " - -
                        DetailsOriginating updateStatusHistory
                        Cannot pin a web link on the Start menu or the taskbar
                        After installing KB4471324, some users cannot pin a web link on the Start menu or the taskbar. 

                        Affected platforms:
                        • Client: Windows 10, version 1803
                        • Server: Windows Server, version 1803
                        Resolution: This issue is resolved in KB4487029. 

                        Back to top                        		OS Build 17134.471

                        December 11, 2018
                        KB4471324                        		Resolved
                        KB4487029                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        December 11, 2018
                        10:00 AM PT
                        " diff --git a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml index 0d43d708e8..829b497041 100644 --- a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml @@ -32,6 +32,10 @@ sections: - type: markdown text: " + + + + @@ -50,17 +54,7 @@ sections: - - - - - - - - - -
                        SummaryOriginating updateStatusDate resolved
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 17763.652

                        July 22, 2019
                        KB4505658                        		Resolved
                        KB4511553                        		August 13, 2019
                        10:00 AM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 17763.557

                        June 11, 2019
                        KB4503327                        		Resolved
                        KB4512534                        		August 17, 2019
                        02:00 PM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

                        See details >                        		OS Build 17763.678

                        August 13, 2019
                        KB4511553                        		Resolved
                        KB4512534                        		August 17, 2019
                        02:00 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                        See details >                        		OS Build 17763.557

                        June 11, 2019
                        KB4503327                        		Resolved External
                        		August 09, 2019
                        07:03 PM PT
                        Difficulty connecting to some iSCSI-based SANs
                        Devices may have difficulty connecting to some Storage Area Network (SAN) devices that leverage iSCSI.

                        See details >                        		OS Build 17763.529

                        May 21, 2019
                        KB4497934                        		Resolved
                        KB4509479                        		June 26, 2019
                        04:00 PM PT
                        Devices with Realtek Bluetooth radios drivers may not pair or connect as expected
                        Devices with some Realtek Bluetooth radios drivers, in some circumstances, may have issues pairing or connecting to devices.

                        See details >                        		OS Build 17763.503

                        May 14, 2019
                        KB4494441                        		Resolved
                        KB4501371                        		June 18, 2019
                        02:00 PM PT
                        Event Viewer may close or you may receive an error when using Custom Views
                        When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                        See details >                        		OS Build 17763.557

                        June 11, 2019
                        KB4503327                        		Resolved
                        KB4501371                        		June 18, 2019
                        02:00 PM PT
                        Internet Explorer 11 authentication issue with multiple concurrent logons
                        Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.

                        See details >                        		OS Build 17763.253

                        January 08, 2019
                        KB4480116                        		Resolved
                        KB4493509                        		April 09, 2019
                        10:00 AM PT
                        End-user-defined characters (EUDC) may cause blue screen at startup
                        If you enable per font end-user-defined characters (EUDC), the system may stop working and a blue screen may appear at startup.

                        See details >                        		OS Build 17763.404

                        April 02, 2019
                        KB4490481                        		Resolved
                        KB4493509                        		April 09, 2019
                        10:00 AM PT
                        MSXML6 may cause applications to stop responding
                        MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        See details >                        		OS Build 17763.253

                        January 08, 2019
                        KB4480116                        		Resolved
                        KB4493509                        		April 09, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        Users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files.

                        See details >                        		OS Build 17763.316

                        February 12, 2019
                        KB4487044                        		Resolved
                        KB4489899                        		March 12, 2019
                        10:00 AM PT
                        Internet Explorer may fail to load images
                        Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        See details >                        		OS Build 17763.316

                        February 12, 2019
                        KB4487044                        		Resolved
                        KB4482887                        		March 01, 2019
                        10:00 AM PT
                        First character of the Japanese era name not recognized
                        The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        See details >                        		OS Build 17763.316

                        February 12, 2019
                        KB4487044                        		Resolved
                        KB4482887                        		March 01, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 9 file format may randomly stop working.

                        See details >                        		OS Build 17763.316

                        February 12, 2019
                        KB4487044                        		Resolved
                        KB4482887                        		March 01, 2019
                        10:00 AM PT
                        Issues with lock screen and Microsoft Edge tabs for certain AMD Radeon video cards
                        Upgrade block: Devices utilizing AMD Radeon HD2000 or HD4000 series video cards may experience issues with the lock screen and Microsoft Edge tabs.

                        See details >                        		OS Build 17763.134

                        November 13, 2018
                        KB4467708                        		Resolved
                        KB4487044                        		February 12, 2019
                        10:00 AM PT
                        Shared albums may not sync with iCloud for Windows
                        Upgrade block: Apple has identified an incompatibility with iCloud for Windows (version 7.7.0.27) where users may experience issues updating or synching Shared Albums.

                        See details >                        		OS Build 17763.134

                        November 13, 2018
                        KB4467708                        		Resolved
                        KB4482887                        		March 01, 2019
                        10:00 AM PT
                        Intel Audio Display (intcdaud.sys) notification during Windows 10 Setup
                        Upgrade block: Users may see an Intel Audio Display (intcdaud.sys) notification during setup for devices with certain Intel Display Audio Drivers.

                        See details >                        		OS Build 17763.134

                        November 13, 2018
                        KB4467708                        		Resolved
                        KB4482887                        		March 01, 2019
                        10:00 AM PT
                        F5 VPN clients losing network connectivity
                        Upgrade block: After updating to Windows 10, version 1809, F5 VPN clients may lose network connectivity when the VPN service is in a split tunnel configuration.

                        See details >                        		OS Build 17763.134

                        November 13, 2018
                        KB4467708                        		Resolved
                        KB4482887                        		March 01, 2019
                        10:00 AM PT
                        Global DNS outage affects Windows Update customers
                        Windows Update customers were recently affected by a network infrastructure event caused by an external DNS service provider's global outage.

                        See details >                        		N/A

                        		Resolved
                        		March 08, 2019
                        11:15 AM PT
                        Apps may stop working after selecting an audio output device other than the default
                        Users with multiple audio devices that select an audio output device different from the \"Default Audio Device\" may find certain applications stop working unexpectedly.

                        See details >                        		OS Build 17763.348

                        March 01, 2019
                        KB4482887                        		Resolved
                        KB4490481                        		April 02, 2019
                        10:00 AM PT
                        Webpages become unresponsive in Microsoft Edge
                        Microsoft Edge users report difficulty browsing and loading webpages.

                        See details >                        		OS Build 17763.253

                        January 08, 2019
                        KB4480116                        		Resolved
                        KB4487044                        		February 12, 2019
                        10:00 AM PT
                        " @@ -71,6 +65,27 @@ sections:
                        " +- title: August 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        After installing KB4511553, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4512534. This ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512534 and install. For instructions, see Update Windows 10.

                        Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                        Back to top                        		OS Build 17763.678

                        August 13, 2019
                        KB4511553                        		Resolved
                        KB4512534                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        August 14, 2019
                        03:34 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503327) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                        Back to top                        		OS Build 17763.557

                        June 11, 2019
                        KB4503327                        		Resolved External
                        		Last updated:
                        August 09, 2019
                        07:03 PM PT

                        Opened:
                        August 09, 2019
                        04:25 PM PT
                        + " + +- title: July 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4505658. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                        HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: This issue was resolved in KB4511553 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                        Back to top                        		OS Build 17763.652

                        July 22, 2019
                        KB4505658                        		Resolved
                        KB4511553                        		Resolved:
                        August 13, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503327 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512534.

                        Back to top                        		OS Build 17763.557

                        June 11, 2019
                        KB4503327                        		Resolved
                        KB4512534                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        + " + - title: June 2019 - items: - type: markdown @@ -124,10 +139,6 @@ sections: text: " - - - -
                        DetailsOriginating updateStatusHistory
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                         
                        For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                         
                        Affected platforms:  
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1  
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2  
                        Resolution: This issue is resolved in KB4493509.  

                        Back to top                        		OS Build 17763.316

                        February 12, 2019
                        KB4487044                        		Resolved
                        KB4493509                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        After installing KB4487044, users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files. 

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue is resolved in KB4489899. 

                        Back to top                        		OS Build 17763.316

                        February 12, 2019
                        KB4487044                        		Resolved
                        KB4489899                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Internet Explorer may fail to load images
                        After installing KB4487044, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1
                        Resolution: This issue is resolved in KB4482887.

                        Back to top                        		OS Build 17763.316

                        February 12, 2019
                        KB4487044                        		Resolved
                        KB4482887                        		Resolved:
                        March 01, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        First character of the Japanese era name not recognized
                        After installing KB4487044, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues. 

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4482887. 

                        Back to top                        		OS Build 17763.316

                        February 12, 2019
                        KB4487044                        		Resolved
                        KB4482887                        		Resolved:
                        March 01, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4482887.

                        Back to top                        		OS Build 17763.316

                        February 12, 2019
                        KB4487044                        		Resolved
                        KB4482887                        		Resolved:
                        March 01, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        " @@ -138,8 +149,6 @@ sections: - -
                        DetailsOriginating updateStatusHistory
                        Internet Explorer 11 authentication issue with multiple concurrent logons
                        After installing KB4480116, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to: 
                        • Cache size and location show zero or empty. 
                        • Keyboard shortcuts may not work properly. 
                        • Webpages may intermittently fail to load or render correctly. 
                        • Issues with credential prompts. 
                        • Issues when downloading files. 
                        Affected platforms: 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                        Resolution: This issue was resolved in KB4493509. 

                        Back to top                        		OS Build 17763.253

                        January 08, 2019
                        KB4480116                        		Resolved
                        KB4493509                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        MSXML6 may cause applications to stop responding
                        After installing KB4480116, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().
                         
                        The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings. 

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue was resolved in KB4493509. 

                        Back to top                        		OS Build 17763.253

                        January 08, 2019
                        KB4480116                        		Resolved
                        KB4493509                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Global DNS outage affects Windows Update customers
                        Windows Update customers were affected by a network infrastructure event on January 29, 2019 (21:00 UTC), caused by an external DNS service provider's global outage. A software update to the external provider's DNS servers resulted in the distribution of corrupted DNS records that affected connectivity to the Windows Update service. The DNS records were restored by January 30, 2019 (00:10 UTC), and the majority of local Internet Service Providers (ISP) have refreshed their DNS servers and customer services have been restored. 
                         
                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                        • Server: Windows Server, version 1809; Windows Server 2019
                        While this was not an issue with Microsoft's services, we take any service disruption for our customers seriously. We will work with partners to better understand this so we can provide higher quality service in the future even across diverse global network providers. 
                         
                        If you are still unable to connect to Windows Update services due to this problem, please contact your local ISP or network administrator. You can also refer to our new KB4493784 for more information to determine if your network is affected, and to provide your local ISP or network administrator with additional information to assist you. 

                        Back to top                        		N/A

                        		Resolved
                        		Resolved:
                        March 08, 2019
                        11:15 AM PT

                        Opened:
                        January 29, 2019
                        02:00 PM PT
                        Webpages become unresponsive in Microsoft Edge
                        After installing KB4480116, some Microsoft Edge users report that they:
                        • Cannot load web pages using a local IP address. 
                        • Cannot load web pages on the Internet using a VPN connection.
                        Browsing fails or the web page may become unresponsive.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                        Resolution: This issue is resolved in KB4487020. 

                        Back to top                        		OS Build 17763.253

                        January 08, 2019
                        KB4480116                        		Resolved
                        KB4487044                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        " @@ -149,9 +158,5 @@ sections: text: " - - - -
                        DetailsOriginating updateStatusHistory
                        Audio not working on monitors or TV connected to a PC via HDMI, USB, or DisplayPort
                        Upgrade block: Microsoft has identified issues with certain new Intel display drivers. Intel inadvertently released versions of its display driver (versions 24.20.100.6344, 24.20.100.6345) to OEMs that accidentally turned on unsupported features in Windows. 
                         
                        As a result, after updating to Windows 10, version 1809, audio playback from a monitor or television connected to a PC via HDMI, USB-C, or a DisplayPort may not function correctly on devices with these drivers.
                        Note: This Intel display driver issue is different from the Intel Smart Sound Technology driver (version 09.21.00.3755) audio issue previously documented.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                        • Server: Windows Server, version 1809; Windows Server 2019 
                        Next steps: Intel has released updated drivers to OEM device manufacturers. OEMs need to make the updated driver available via Windows Update. For more information, see the Intel Customer Support article.

                        Resolution: Microsoft has removed the safeguard hold.



                        Back to top                        		OS Build 17763.134

                        November 13, 2018
                        KB4467708                        		Resolved
                        		Resolved:
                        May 21, 2019
                        07:42 AM PT

                        Opened:
                        November 13, 2018
                        10:00 AM PT
                        Issues with lock screen and Microsoft Edge tabs for certain AMD Radeon video cards
                        Note: AMD no longer supports Radeon HD2000 and HD4000 series graphic processor units (GPUs).
                         
                        Upgrade block: After updating to Windows 10, version 1809, Microsoft Edge tabs may stop working when a device is configured with AMD Radeon HD2000 or HD4000 series video cards. Customers may get the following error code: \"INVALID_POINTER_READ_c0000005_atidxx64.dll\". 
                         
                        Some users may also experience performance issues with the lock screen or the ShellExperienceHost. (The lock screen hosts widgets, and the ShellExperienceHost is responsible for assorted shell functionality.) 

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                        • Server: Windows Server, version 1809; Windows Server 2019
                        Resolution: This issue was resolved in KB4487044, and the block was removed.

                        Back to top                        		OS Build 17763.134

                        November 13, 2018
                        KB4467708                        		Resolved
                        KB4487044                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        November 13, 2018
                        10:00 AM PT
                        Shared albums may not sync with iCloud for Windows
                        Upgrade block: Users who attempt to install iCloud for Windows (version 7.7.0.27) will see a message displayed that this version iCloud for Windows isn't supported and the install will fail.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                        • Server: Windows Server, version 1809; Windows Server 2019
                        To ensure a seamless experience, Microsoft is blocking devices with iCloud for Windows (version 7.7.0.27) software installed from being offered Windows 10, version 1809 until this issue has been resolved. 

                        We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool from the Microsoft software download website until this issue is resolved. 
                         
                        Resolution: Apple has released an updated version of iCloud for Windows (version 7.8.1) that resolves compatibility issues encountered when updating or synching Shared Albums after updating to Windows 10, version 1809. We recommend that you update your iCloud for Windows to version 7.8.1 when prompted before attempting to upgrade to Windows 10, version 1809. You can also manually download the latest version of iCloud for Windows by visiting https://support.apple.com/HT204283.

                        Back to top                        		OS Build 17763.134

                        November 13, 2018
                        KB4467708                        		Resolved
                        KB4482887                        		Resolved:
                        March 01, 2019
                        10:00 AM PT

                        Opened:
                        November 13, 2018
                        10:00 AM PT
                        Intel Audio Display (intcdaud.sys) notification during Windows 10 Setup
                        Upgrade block: Microsoft and Intel have identified a compatibility issue with a range of Intel Display Audio device drivers (intcdaud.sys, versions 10.25.0.3 - 10.25.0.8) that may result in excessive processor demand and reduced battery life. As a result, the update process to the Windows 10 October 2018 Update (Windows 10, version 1809) will fail and affected devices will automatically revert to the previous working configuration. 

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                        • Server: Windows Server, version 1809; Windows Server 2019
                        If you see a \"What needs your attention\" notification during installation of the October 2018 Update, you have one of these affected drivers on your system. On the notification, click Back to remain on your current version of Windows 10. 
                         
                        To ensure a seamless experience, we are blocking devices from being offered the October 2018 Update until updated Intel device drivers are installed on your current operating system. We recommend that you do not attempt to manually update to Windows 10, version 1809, using the Update Now button or the Media Creation Tool from the Microsoft Software Download Center until newer Intel device drivers are available with the update. You can either wait for newer drivers to be installed automatically through Windows Update or check with your computer manufacturer for the latest device driver software availability and installation procedures. For more information about this issue, see Intel's customer support guidance.
                         
                        Resolution: This issue was resolved in KB4482887 and the upgrade block removed. 

                        Back to top                        		OS Build 17763.134

                        November 13, 2018
                        KB4467708                        		Resolved
                        KB4482887                        		Resolved:
                        March 01, 2019
                        10:00 AM PT

                        Opened:
                        November 13, 2018
                        10:00 AM PT
                        F5 VPN clients losing network connectivity
                        Upgrade block: After updating to Windows 10, version 1809, F5 VPN clients may lose network connectivity when the VPN service is in a split tunnel configuration.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                        • Server: Windows Server, version 1809; Windows Server 2019
                        Resolution: This issue was resolved in KB4482887 and the upgrade block removed. 

                        Back to top                        		OS Build 17763.134

                        November 13, 2018
                        KB4467708                        		Resolved
                        KB4482887                        		Resolved:
                        March 01, 2019
                        10:00 AM PT

                        Opened:
                        November 13, 2018
                        10:00 AM PT
                        " diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml index 4e7aae8a05..c2c7870398 100644 --- a/windows/release-information/resolved-issues-windows-10-1903.yml +++ b/windows/release-information/resolved-issues-windows-10-1903.yml @@ -32,6 +32,15 @@ sections: - type: markdown text: " + + + + + + + + + @@ -52,6 +61,39 @@ sections:
                        " +- title: September 2019 +- items: + - type: markdown + text: " +
                        SummaryOriginating updateStatusDate resolved
                        Screenshots and Snips have an unnatural orange tint
                        Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

                        See details >                        		OS Build 18362.356

                        September 10, 2019
                        KB4516115                        		Resolved External
                        		September 11, 2019
                        08:54 PM PT
                        Windows Desktop Search may not return any results and may have high CPU usage
                        Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.

                        See details >                        		OS Build 18362.329

                        August 30, 2019
                        KB4512941                        		Resolved
                        KB4515384                        		September 10, 2019
                        10:00 AM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4512941                        		August 30, 2019
                        10:00 AM PT
                        Issues updating when certain versions of Intel storage drivers are installed
                        Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

                        See details >                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4512941                        		August 30, 2019
                        10:00 AM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

                        See details >                        		OS Build 18362.295

                        August 13, 2019
                        KB4512508                        		Resolved
                        KB4512941                        		August 30, 2019
                        10:00 AM PT
                        Initiating a Remote Desktop connection may result in black screen
                        When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.

                        See details >                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4512941                        		August 30, 2019
                        10:00 AM PT
                        Windows Sandbox may fail to start with error code “0x80070002”
                        Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updates

                        See details >                        		OS Build 18362.116

                        May 20, 2019
                        KB4505057                        		Resolved
                        KB4512941                        		August 30, 2019
                        10:00 AM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 18362.175

                        June 11, 2019
                        KB4503293                        		Resolved
                        KB4512941                        		August 30, 2019
                        10:00 AM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                        See details >                        		OS Build 18362.175

                        June 11, 2019
                        KB4503293                        		Resolved External
                        		August 09, 2019
                        07:03 PM PT
                        Display brightness may not respond to adjustments
                        Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers.

                        See details >                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Resolved
                        KB4505903                        		July 26, 2019
                        02:00 PM PT
                        RASMAN service may stop working and result in the error “0xc0000005”
                        The Remote Access Connection Manager (RASMAN) service may stop working and result in the error “0xc0000005” with VPN profiles configured as an Always On VPN connection.

                        See details >                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4505903                        		July 26, 2019
                        02:00 PM PT
                        Loss of functionality in Dynabook Smartphone Link app
                        After updating to Windows 10, version 1903, you may experience a loss of functionality when using the Dynabook Smartphone Link application.

                        See details >                        		OS Build 18362.116

                        May 20, 2019
                        KB4505057                        		Resolved
                        		July 11, 2019
                        01:54 PM PT
                        + + +
                        DetailsOriginating updateStatusHistory
                        Screenshots and Snips have an unnatural orange tint
                        When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        • Server: None
                        Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

                        Back to top                        		OS Build 18362.356

                        September 10, 2019
                        KB4516115                        		Resolved External
                        		Last updated:
                        September 11, 2019
                        08:54 PM PT

                        Opened:
                        September 11, 2019
                        08:54 PM PT
                        Windows Desktop Search may not return any results and may have high CPU usage
                        Microsoft is getting reports that a small number of users may not receive results when using Windows Desktop Search and may see high CPU usage from SearchUI.exe when searching after installing KB4512941. This issue is only encountered on devices in which searching the web from Windows Desktop Search has been disabled.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Resolution: This issue was resolved in KB4515384.

                        Back to top                        		OS Build 18362.329

                        August 30, 2019
                        KB4512941                        		Resolved
                        KB4515384                        		Resolved:
                        September 10, 2019
                        10:00 AM PT

                        Opened:
                        September 04, 2019
                        02:25 PM PT
                        + " + +- title: August 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        After installing KB4512508, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4512941. The ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512941 and install. For instructions, see Update Windows 10.

                        Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                        Back to top                        		OS Build 18362.295

                        August 13, 2019
                        KB4512508                        		Resolved
                        KB4512941                        		Resolved:
                        August 30, 2019
                        10:00 AM PT

                        Opened:
                        August 14, 2019
                        03:34 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503293) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                        Back to top                        		OS Build 18362.175

                        June 11, 2019
                        KB4503293                        		Resolved External
                        		Last updated:
                        August 09, 2019
                        07:03 PM PT

                        Opened:
                        August 09, 2019
                        04:25 PM PT
                        + " + +- title: July 2019 +- items: + - type: markdown + text: " + + + + + +
                        DetailsOriginating updateStatusHistory
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                        HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                        Back to top                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4512941                        		Resolved:
                        August 30, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Issues updating when certain versions of Intel storage drivers are installed
                        Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

                        To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

                        Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        • Server: Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                        Back to top                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4512941                        		Resolved:
                        August 30, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Initiating a Remote Desktop connection may result in black screen
                        When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        • Server: Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512941.

                        Back to top                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4512941                        		Resolved:
                        August 30, 2019
                        10:00 AM PT

                        Opened:
                        July 12, 2019
                        04:42 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503293 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512941.

                        Back to top                        		OS Build 18362.175

                        June 11, 2019
                        KB4503293                        		Resolved
                        KB4512941                        		Resolved:
                        August 30, 2019
                        10:00 AM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        + " + - title: June 2019 - items: - type: markdown @@ -67,6 +109,7 @@ sections: - type: markdown text: " + diff --git a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml index 8d0678c091..aa64a5bbb2 100644 --- a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml +++ b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml @@ -32,6 +32,11 @@ sections: - type: markdown text: "
                        DetailsOriginating updateStatusHistory
                        Windows Sandbox may fail to start with error code “0x80070002”
                        Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language is changed during the update process when installing Windows 10, version 1903.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Resolution: This issue was resolved in KB4512941.

                        Back to top                        		OS Build 18362.116

                        May 20, 2019
                        KB4505057                        		Resolved
                        KB4512941                        		Resolved:
                        August 30, 2019
                        10:00 AM PT

                        Opened:
                        May 24, 2019
                        04:20 PM PT
                        Display brightness may not respond to adjustments
                        Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers. After updating to Windows 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change.

                        To safeguard your update experience, we have applied a compatibility hold on devices with certain Intel drivers from being offered Windows 10, version 1903, until this issue is resolved.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Resolution: This issue was resolved in KB4505903 and the safeguard hold has been removed. Please ensure you have applied the resolving update before attempting to update to the Windows 10 May 2019 Update (version 1903). Please note, it can take up to 48 hours for the safeguard to be removed.

                        Back to top                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Resolved
                        KB4505903                        		Resolved:
                        July 26, 2019
                        02:00 PM PT

                        Opened:
                        May 21, 2019
                        07:56 AM PT
                        Loss of functionality in Dynabook Smartphone Link app
                        Some users may experience a loss of functionality after updating to Windows 10, version 1903 when using the Dynabook Smartphone Link application on Windows devices. Loss of functionality may affect the display of phone numbers in the Call menu and the ability to answer phone calls on the Windows PC.

                        To safeguard your update experience, we have applied a compatibility hold on devices with Dynabook Smartphone Link from being offered Windows 10, version 1903, until this issue is resolved.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                        Back to top                        		OS Build 18362.116

                        May 20, 2019
                        KB4505057                        		Resolved
                        		Resolved:
                        July 11, 2019
                        01:54 PM PT

                        Opened:
                        May 24, 2019
                        03:10 PM PT
                        Error attempting to update with external USB device or memory card attached
                        If you have an external USB device or SD memory card attached when installing Windows 10, version 1903, you may get an error message stating \"This PC can't be upgraded to Windows 10.\" This is caused by inappropriate drive reassignment during installation.

                        Sample scenario: An update to Windows 10, version 1903 is attempted on a computer that has a thumb drive inserted into its USB port. Before the update, the thumb drive is mounted in the system as drive G based on the existing drive configuration. After the feature update is installed; however, the device is reassigned a different drive letter (e.g., drive H).

                        Note The drive reassignment is not limited to removable drives. Internal hard drives may also be affected.

                        To safeguard your update experience, we have applied a hold on devices with an external USB device or SD memory card attached from being offered Windows 10, version 1903 until this issue is resolved.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                        Back to top                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Resolved
                        		Resolved:
                        July 11, 2019
                        01:53 PM PT

                        Opened:
                        May 21, 2019
                        07:38 AM PT
                        + + + + + @@ -43,13 +48,7 @@ sections: - - - - - -
                        SummaryOriginating updateStatusDate resolved
                        Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
                        Windows updates that are SHA-2 signed are not available with Symantec or Norton antivirus program installed

                        See details >                        		August 13, 2019
                        KB4512506                        		Resolved External
                        		August 27, 2019
                        02:29 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		June 11, 2019
                        KB4503292                        		Resolved
                        KB4512514                        		August 17, 2019
                        02:00 PM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

                        See details >                        		August 13, 2019
                        KB4512506                        		Resolved
                        KB4517297                        		August 16, 2019
                        02:00 PM PT
                        System may be unresponsive after restart with certain McAfee antivirus products
                        Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup.

                        See details >                        		April 09, 2019
                        KB4493472                        		Resolved External
                        		August 13, 2019
                        06:59 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                        See details >                        		June 11, 2019
                        KB4503292                        		Resolved External
                        		August 09, 2019
                        07:03 PM PT
                        IE11 may stop working when loading or interacting with Power BI reports
                        Power BI reports that contain line charts with markers may cause Internet Explorer 11 to stop working.

                        See details >                        		May 14, 2019
                        KB4499164                        		Resolved
                        KB4503277                        		June 20, 2019
                        02:00 PM PT
                        Event Viewer may close or you may receive an error when using Custom Views
                        When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                        See details >                        		June 11, 2019
                        KB4503292                        		Resolved
                        KB4503277                        		June 20, 2019
                        02:00 PM PT
                        Unable to access some gov.uk websites
                        gov.uk websites that don’t support “HSTS” may not be accessible

                        See details >                        		May 14, 2019
                        KB4499164                        		Resolved
                        KB4505050                        		May 18, 2019
                        02:00 PM PT
                        Devices may not respond at login or Welcome screen if running certain Avast software
                        Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.

                        See details >                        		April 09, 2019
                        KB4493472                        		Resolved
                        		April 25, 2019
                        02:00 PM PT
                        NETDOM.EXE fails to run
                        NETDOM.EXE fails to run and the error, “The command failed to complete successfully.” appears on screen.

                        See details >                        		March 12, 2019
                        KB4489878                        		Resolved
                        KB4493472                        		April 09, 2019
                        10:00 AM PT
                        Custom URI schemes may not start corresponding application
                        Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                        See details >                        		March 12, 2019
                        KB4489878                        		Resolved
                        KB4493472                        		April 09, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        See details >                        		February 12, 2019
                        KB4486563                        		Resolved
                        KB4486565                        		February 19, 2019
                        02:00 PM PT
                        Internet Explorer may fail to load images
                        Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        See details >                        		February 12, 2019
                        KB4486563                        		Resolved
                        KB4486565                        		February 19, 2019
                        02:00 PM PT
                        First character of the Japanese era name not recognized as an abbreviation
                        The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        See details >                        		January 17, 2019
                        KB4480955                        		Resolved
                        KB4486565                        		February 19, 2019
                        02:00 PM PT
                        Internet Explorer 11 authentication issue with multiple concurrent logons
                        Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.

                        See details >                        		January 08, 2019
                        KB4480970                        		Resolved
                        KB4493472                        		April 09, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                        See details >                        		January 08, 2019
                        KB4480970                        		Resolved
                        KB4486563                        		February 12, 2019
                        10:00 AM PT
                        Event Viewer may not show some event descriptions for network interface cards
                        The Event Viewer may not show some event descriptions for network interface cards (NIC).

                        See details >                        		October 18, 2018
                        KB4462927                        		Resolved
                        KB4489878                        		March 12, 2019
                        10:00 AM PT
                        Virtual machines fail to restore
                        Virtual machines (VMs) may fail to restore successfully if the VM has been saved and restored once before.

                        See details >                        		January 08, 2019
                        KB4480970                        		Resolved
                        KB4490511                        		February 19, 2019
                        02:00 PM PT
                        " @@ -60,6 +59,26 @@ sections:
                        " +- title: August 2019 +- items: + - type: markdown + text: " + + + + +
                        DetailsOriginating updateStatusHistory
                        Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
                        Symantec identified the potential for a negative interaction that may occur after Windows Updates code signed with SHA-2 only certificates are installed on devices with Symantec or Norton antivirus programs installed. The software may not correctly identify files included in the update as code signed by Microsoft, putting the device at risk for a delayed or incomplete update.

                        Affected platforms:
                        • Client: Windows 7 SP1
                        • Server: Windows Server 2008 R2 SP1
                        Resolution: The safeguard hold has been removed. Symantec has completed its evaluation of the impact of this update and future updates to Windows 7/Windows 2008 R2 and has determined that there is no increased risk of a false positive detection for all in-field versions of Symantec Endpoint Protection and Norton antivirus programs. See the Symantec support article for additional detail and please reach out to Symantec or Norton support if you encounter any issues.

                        Back to top                        		August 13, 2019
                        KB4512506                        		Resolved External
                        		Last updated:
                        August 27, 2019
                        02:29 PM PT

                        Opened:
                        August 13, 2019
                        10:05 AM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        After installing KB4512506, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4517297. The ‘optional’ update is now available on Microsoft Update Catalog and Windows Server Update Services (WSUS).

                        Back to top                        		August 13, 2019
                        KB4512506                        		Resolved
                        KB4517297                        		Resolved:
                        August 16, 2019
                        02:00 PM PT

                        Opened:
                        August 14, 2019
                        03:34 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503292) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                        Back to top                        		June 11, 2019
                        KB4503292                        		Resolved External
                        		Last updated:
                        August 09, 2019
                        07:03 PM PT

                        Opened:
                        August 09, 2019
                        04:25 PM PT
                        + " + +- title: July 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503292 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512514.

                        Back to top                        		June 11, 2019
                        KB4503292                        		Resolved
                        KB4512514                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        + " + - title: June 2019 - items: - type: markdown @@ -84,6 +103,7 @@ sections: - type: markdown text: " + @@ -108,8 +128,6 @@ sections: text: "
                        DetailsOriginating updateStatusHistory
                        System may be unresponsive after restart with certain McAfee antivirus products
                        Microsoft and McAfee have identified an issue on devices with McAfee Endpoint Security (ENS) Threat Prevention 10.x or McAfee Host Intrusion Prevention (Host IPS) 8.0 or McAfee VirusScan Enterprise (VSE) 8.8 installed. It may cause the system to have slow startup or become unresponsive at restart after installing this update. 

                        Affected platforms:
                        • Client: Windows 8.1; Windows 7 SP1
                        • Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1
                        Resolution: This issue has been resolved. McAfee has released an automatic update to address this issue. Guidance for McAfee customers can be found in the following McAfee support articles: 

                        Back to top                        		April 09, 2019
                        KB4493472                        		Resolved External
                        		Last updated:
                        August 13, 2019
                        06:59 PM PT

                        Opened:
                        April 09, 2019
                        10:00 AM PT
                        System may be unresponsive after restart if ArcaBit antivirus software installed
                        Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493472.

                        Affected platforms:
                        • Client: Windows 8.1; Windows 7 SP1
                        • Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1
                        Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. ArcaBit has released an update to address this issue. For more information, see the Arcabit support article.

                        Back to top                        		April 09, 2019
                        KB4493472                        		Resolved
                        		Resolved:
                        May 14, 2019
                        01:23 PM PT

                        Opened:
                        April 09, 2019
                        10:00 AM PT
                        System unresponsive after restart if Sophos Endpoint Protection installed
                        Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493472.

                        Affected platforms: 
                        • Client: Windows 8.1; Windows 7 SP1
                        • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article.

                        Back to top                        		April 09, 2019
                        KB4493472                        		Resolved
                        		Resolved:
                        May 14, 2019
                        01:22 PM PT

                        Opened:
                        April 09, 2019
                        10:00 AM PT
                        System may be unresponsive after restart if Avira antivirus software installed
                        Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493472.

                        Affected platforms: 
                        • Client: Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article.

                        Back to top                        		April 09, 2019
                        KB4493472                        		Resolved
                        		Resolved:
                        May 14, 2019
                        01:21 PM PT

                        Opened:
                        April 09, 2019
                        10:00 AM PT
                        - -
                        DetailsOriginating updateStatusHistory
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly. 
                         
                        For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color. 
                         
                        Affected platforms:  
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4493472. 

                        Back to top                        		February 12, 2019
                        KB4486563                        		Resolved
                        KB4493472                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        Affected platforms: 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4486565.

                        Back to top                        		February 12, 2019
                        KB4486563                        		Resolved
                        KB4486565                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Internet Explorer may fail to load images
                        After installing KB4486563, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        Affected platforms: 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1 
                        Resolution: This issue is resolved in KB4486565.

                        Back to top                        		February 12, 2019
                        KB4486563                        		Resolved
                        KB4486565                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        " @@ -118,18 +136,6 @@ sections: - type: markdown text: " - - - -
                        DetailsOriginating updateStatusHistory
                        First character of the Japanese era name not recognized as an abbreviation
                        After installing KB4480955, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        Affected platforms: 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4486565.

                        Back to top                        		January 17, 2019
                        KB4480955                        		Resolved
                        KB4486565                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        January 17, 2019
                        10:00 AM PT
                        Internet Explorer 11 authentication issue with multiple concurrent logons
                        After installing KB4480970, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
                        • Cache size and location show zero or empty.
                        • Keyboard shortcuts may not work properly.
                        • Webpages may intermittently fail to load or render correctly.
                        • Issues with credential prompts.
                        • Issues when downloading files.
                        Affected platforms: 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                        Resolution: This issue is resolved in KB4493472.

                        Back to top                        		January 08, 2019
                        KB4480970                        		Resolved
                        KB4493472                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, “Unrecognized Database Format”.

                        Affected Platforms:
                        • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 

                        Resolution: This issue is resolved in KB4486563.

                        Back to top                        		January 08, 2019
                        KB4480970                        		Resolved
                        KB4486563                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Virtual machines fail to restore
                        After installing KB4480970, virtual machines (VM) may fail to restore successfully if the VM has been saved and restored once before. The error message is, “Failed to restore the virtual machine state: Cannot restore this virtual machine because the saved state data cannot be read. Delete the saved state data and then try to start the virtual machine. (0xC0370027).”

                        This affects AMD Bulldozer Family 15h, AMD Jaguar Family 16h, and AMD Puma Family 16h (second generation) microarchitectures.

                        Affected platforms: 
                        • Client: Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4490511.

                        Back to top                        		January 08, 2019
                        KB4480970                        		Resolved
                        KB4490511                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        - " - -- title: October 2018 -- items: - - type: markdown - text: " - -
                        DetailsOriginating updateStatusHistory
                        Event Viewer may not show some event descriptions for network interface cards
                        After installing KB4462927, the Event Viewer may not show some event descriptions for network interface cards (NICs).

                        Affected Platforms:
                        • Client: Windows 7 SP1 
                        • Server: Windows Server 2012; Windows Server 2008 R2 SP1
                        Resolution: This issue is resolved in KB4489878.

                        Back to top                        		October 18, 2018
                        KB4462927                        		Resolved
                        KB4489878                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        October 18, 2018
                        10:00 AM PT
                        " diff --git a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml index dc386260cc..6255d324e1 100644 --- a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml +++ b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml @@ -32,6 +32,10 @@ sections: - type: markdown text: " + + + + @@ -40,17 +44,12 @@ sections: - - - - -
                        SummaryOriginating updateStatusDate resolved
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		June 11, 2019
                        KB4503276                        		Resolved
                        KB4512478                        		August 17, 2019
                        02:00 PM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

                        See details >                        		August 13, 2019
                        KB4512488                        		Resolved
                        KB4517298                        		August 16, 2019
                        02:00 PM PT
                        System may be unresponsive after restart with certain McAfee antivirus products
                        Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup.

                        See details >                        		April 09, 2019
                        KB4493446                        		Resolved External
                        		August 13, 2019
                        06:59 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                        See details >                        		June 11, 2019
                        KB4503276                        		Resolved External
                        		August 09, 2019
                        07:03 PM PT
                        IE11 may stop working when loading or interacting with Power BI reports
                        Power BI reports that contain line charts with markers may cause Internet Explorer 11 to stop working.

                        See details >                        		May 14, 2019
                        KB4499151                        		Resolved
                        KB4503283                        		June 20, 2019
                        02:00 PM PT
                        Event Viewer may close or you may receive an error when using Custom Views
                        When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                        See details >                        		June 11, 2019
                        KB4503276                        		Resolved
                        KB4503283                        		June 20, 2019
                        02:00 PM PT
                        Issue using PXE to start a device from WDS
                        There may be issues using the Preboot Execution Environment (PXE) to start a device from a Windows Deployment Services (WDS) server configured to use Variable Window Extension.

                        See details >                        		March 12, 2019
                        KB4489881                        		Resolved
                        KB4503276                        		June 11, 2019
                        10:00 AM PT
                        System may be unresponsive after restart if ArcaBit antivirus software installed
                        Devices with ArcaBit antivirus software installed may become unresponsive upon restart.

                        See details >                        		April 09, 2019
                        KB4493446                        		Resolved
                        		May 14, 2019
                        01:22 PM PT
                        System unresponsive after restart if Sophos Endpoint Protection installed
                        Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.

                        See details >                        		April 09, 2019
                        KB4493446                        		Resolved
                        		May 14, 2019
                        01:22 PM PT
                        System may be unresponsive after restart if Avira antivirus software installed
                        Devices with Avira antivirus software installed may become unresponsive upon restart.

                        See details >                        		April 09, 2019
                        KB4493446                        		Resolved
                        		May 14, 2019
                        01:21 PM PT
                        Internet Explorer may fail to load images
                        Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        See details >                        		February 12, 2019
                        KB4487000                        		Resolved
                        KB4487016                        		February 19, 2019
                        02:00 PM PT
                        First character of the Japanese era name not recognized as an abbreviation
                        The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        See details >                        		January 15, 2019
                        KB4480969                        		Resolved
                        KB4487016                        		February 19, 2019
                        02:00 PM PT
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                        See details >                        		February 12, 2019
                        KB4487000                        		Resolved
                        KB4493446                        		April 09, 2019
                        10:00 AM PT
                        Devices may not respond at login or Welcome screen if running certain Avast software
                        Devices running Avast for Business, Avast CloudCare, and AVG Business Edition antivirus software may become unresponsive after restart.

                        See details >                        		April 09, 2019
                        KB4493446                        		Resolved
                        		April 25, 2019
                        02:00 PM PT
                        Devices with winsock kernel client may receive error
                        Devices with a winsock kernel client may receive D1, FC, and other errors.

                        See details >                        		March 12, 2019
                        KB4489881                        		Resolved
                        KB4489893                        		March 19, 2019
                        10:00 AM PT
                        Custom URI schemes may not start corresponding application
                        Custom URI schemes for application protocol handlers may not start the corresponding application for local intranet and trusted sites in Internet Explorer.

                        See details >                        		March 12, 2019
                        KB4489881                        		Resolved
                        KB4493446                        		April 09, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                        See details >                        		February 19, 2019
                        KB4487016                        		Resolved
                        KB4489881                        		March 12, 2019
                        10:00 AM PT
                        MSXML6 may cause applications to stop responding.
                        MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        See details >                        		January 08, 2019
                        KB4480963                        		Resolved
                        KB4493446                        		April 09, 2019
                        10:00 AM PT
                        Internet Explorer 11 authentication issue with multiple concurrent logons
                        Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.

                        See details >                        		January 08, 2019
                        KB4480963                        		Resolved
                        KB4493446                        		April 09, 2019
                        10:00 AM PT
                        Virtual machines fail to restore
                        Virtual machines (VMs) may fail to restore successfully if the VM has been saved and restored once before.

                        See details >                        		January 08, 2019
                        KB4480963                        		Resolved
                        KB4490512                        		February 19, 2019
                        02:00 PM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                        See details >                        		January 08, 2019
                        KB4480963                        		Resolved
                        KB4487000                        		February 12, 2019
                        10:00 AM PT
                        " @@ -61,6 +60,25 @@ sections:
                        " +- title: August 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        After installing KB4512488, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4517298. The ‘optional’ update is now available on Microsoft Update Catalog and Windows Server Update Services (WSUS).

                        Back to top                        		August 13, 2019
                        KB4512488                        		Resolved
                        KB4517298                        		Resolved:
                        August 16, 2019
                        02:00 PM PT

                        Opened:
                        August 14, 2019
                        03:34 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503276) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                        Back to top                        		June 11, 2019
                        KB4503276                        		Resolved External
                        		Last updated:
                        August 09, 2019
                        07:03 PM PT

                        Opened:
                        August 09, 2019
                        04:25 PM PT
                        + " + +- title: July 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503276 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512478.

                        Back to top                        		June 11, 2019
                        KB4503276                        		Resolved
                        KB4512478                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        + " + - title: June 2019 - items: - type: markdown @@ -86,6 +104,7 @@ sections: - type: markdown text: " + @@ -109,9 +128,7 @@ sections: - type: markdown text: "
                        DetailsOriginating updateStatusHistory
                        System may be unresponsive after restart with certain McAfee antivirus products
                        Microsoft and McAfee have identified an issue on devices with McAfee Endpoint Security (ENS) Threat Prevention 10.x or McAfee Host Intrusion Prevention (Host IPS) 8.0 or McAfee VirusScan Enterprise (VSE) 8.8 installed. It may cause the system to have slow startup or become unresponsive at restart after installing this update. 

                        Affected platforms:
                        • Client: Windows 8.1; Windows 7 SP1
                        • Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1
                        Resolution: This issue has been resolved. McAfee has released an automatic update to address this issue. Guidance for McAfee customers can be found in the following McAfee support articles:  

                        Back to top                        		April 09, 2019
                        KB4493446                        		Resolved External
                        		Last updated:
                        August 13, 2019
                        06:59 PM PT

                        Opened:
                        April 09, 2019
                        10:00 AM PT
                        System may be unresponsive after restart if ArcaBit antivirus software installed
                        Microsoft and ArcaBit have identified an issue on devices with ArcaBit antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493446.

                        Affected platforms:
                        • Client: Windows 8.1; Windows 7 SP1
                        • Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1
                        Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. ArcaBit has released an update to address this issue. For more information, see the Arcabit support article.

                        Back to top                        		April 09, 2019
                        KB4493446                        		Resolved
                        		Resolved:
                        May 14, 2019
                        01:22 PM PT

                        Opened:
                        April 09, 2019
                        10:00 AM PT
                        System unresponsive after restart if Sophos Endpoint Protection installed
                        Microsoft and Sophos have identified an issue on devices with Sophos Endpoint Protection installed and managed by either Sophos Central or Sophos Enterprise Console (SEC) that may cause the system to become unresponsive upon restart after installing KB4493446.

                        Affected platforms: 
                        • Client: Windows 8.1; Windows 7 SP1
                        • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Sophos has released an update to address this issue. Guidance for Sophos Endpoint and Sophos Enterprise Console customers can be found in the Sophos support article.

                        Back to top                        		April 09, 2019
                        KB4493446                        		Resolved
                        		Resolved:
                        May 14, 2019
                        01:22 PM PT

                        Opened:
                        April 09, 2019
                        10:00 AM PT
                        System may be unresponsive after restart if Avira antivirus software installed
                        Microsoft and Avira have identified an issue on devices with Avira antivirus software installed that may cause the system to become unresponsive upon restart after installing KB4493446.

                        Affected platforms: 
                        • Client: Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue has been resolved. Microsoft has removed the temporary block for all affected Windows updates. Avira has released an automatic update to address this issue. Guidance for Avira customers can be found in the Avira support article.

                        Back to top                        		April 09, 2019
                        KB4493446                        		Resolved
                        		Resolved:
                        May 14, 2019
                        01:21 PM PT

                        Opened:
                        April 09, 2019
                        10:00 AM PT
                        - -
                        DetailsOriginating updateStatusHistory
                        Internet Explorer may fail to load images
                        After installing KB4487000, Internet Explorer may fail to load images with a backslash (\\) in their relative source path.

                        Affected platforms: 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2008 R2 SP1 
                        Resolution: This issue is resolved in KB4487016.

                        Back to top                        		February 12, 2019
                        KB4487000                        		Resolved
                        KB4487016                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                        For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color.

                        Affected platforms 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4493446.

                        Back to top                        		February 12, 2019
                        KB4487000                        		Resolved
                        KB4493446                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        After installing KB4487016, users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                        Affected platforms: 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012 
                        Resolution: This issue is resolved in KB4489881.

                        Back to top                        		February 19, 2019
                        KB4487016                        		Resolved
                        KB4489881                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        February 19, 2019
                        02:00 PM PT
                        " @@ -120,10 +137,7 @@ sections: - type: markdown text: " - - -
                        DetailsOriginating updateStatusHistory
                        First character of the Japanese era name not recognized as an abbreviation
                        After installing KB4480969, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        Affected platforms: 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4487016.

                        Back to top                        		January 15, 2019
                        KB4480969                        		Resolved
                        KB4487016                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        January 15, 2019
                        10:00 AM PT
                        MSXML6 may cause applications to stop responding.
                        After installing KB4480963, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue is resolved in KB4493446.

                        Back to top                        		January 08, 2019
                        KB4480963                        		Resolved
                        KB4493446                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Internet Explorer 11 authentication issue with multiple concurrent logons
                        After installing KB4480963, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
                        • Cache size and location show zero or empty.
                        • Keyboard shortcuts may not work properly.
                        • Webpages may intermittently fail to load or render correctly.
                        • Issues with credential prompts.
                        • Issues when downloading files.
                        Affected platforms: 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                        Resolution: This issue is resolved in KB4493446.

                        Back to top                        		January 08, 2019
                        KB4480963                        		Resolved
                        KB4493446                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Virtual machines fail to restore
                        After installing KB4480963, virtual machines (VM) may fail to restore successfully if the VM has been saved and restored once before. The error message is, “Failed to restore the virtual machine state: Cannot restore this virtual machine because the saved state data cannot be read. Delete the saved state data and then try to start the virtual machine. (0xC0370027).”

                        This affects AMD Bulldozer Family 15h, AMD Jaguar Family 16h, and AMD Puma Family 16h (second generation) microarchitectures.

                        Affected platforms: 
                        • Client: Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4490512.

                        Back to top                        		January 08, 2019
                        KB4480963                        		Resolved
                        KB4490512                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, “Unrecognized Database Format”.

                        Affected platforms: 
                        • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4487000.

                        Back to top                        		January 08, 2019
                        KB4480963                        		Resolved
                        KB4487000                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        " diff --git a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml index 1a7ffb0d7a..f81be52e89 100644 --- a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml +++ b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml @@ -32,16 +32,15 @@ sections: - type: markdown text: " + + + - - - -
                        SummaryOriginating updateStatusDate resolved
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		June 11, 2019
                        KB4503273                        		Resolved
                        KB4512499                        		August 17, 2019
                        02:00 PM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

                        See details >                        		August 13, 2019
                        KB4512476                        		Resolved
                        KB4517301                        		August 16, 2019
                        02:00 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                        See details >                        		June 11, 2019
                        KB4503273                        		Resolved External
                        		August 09, 2019
                        07:03 PM PT
                        Event Viewer may close or you may receive an error when using Custom Views
                        When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                        See details >                        		June 11, 2019
                        KB4503273                        		Resolved
                        KB4503271                        		June 20, 2019
                        02:00 PM PT
                        System unresponsive after restart if Sophos Endpoint Protection installed
                        Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.

                        See details >                        		April 09, 2019
                        KB4493471                        		Resolved
                        		May 14, 2019
                        01:21 PM PT
                        System may be unresponsive after restart if Avira antivirus software installed
                        Devices with Avira antivirus software installed may become unresponsive upon restart.

                        See details >                        		April 09, 2019
                        KB4493471                        		Resolved
                        		May 14, 2019
                        01:19 PM PT
                        Authentication may fail for services after the Kerberos ticket expires
                        Authentication may fail for services that require unconstrained delegation after the Kerberos ticket expires.

                        See details >                        		March 12, 2019
                        KB4489880                        		Resolved
                        KB4499149                        		May 14, 2019
                        10:00 AM PT
                        NETDOM.EXE fails to run
                        NETDOM.EXE fails to run and the error, “The command failed to complete successfully.” appears on screen.

                        See details >                        		March 12, 2019
                        KB4489880                        		Resolved
                        KB4493471                        		April 09, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        See details >                        		February 12, 2019
                        KB4487023                        		Resolved
                        KB4487022                        		February 19, 2019
                        02:00 PM PT
                        First character of the Japanese era name not recognized as an abbreviation
                        The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        See details >                        		January 17, 2019
                        KB4480974                        		Resolved
                        KB4489880                        		March 12, 2019
                        10:00 AM PT
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                        See details >                        		February 12, 2019
                        KB4487023                        		Resolved
                        KB4493471                        		April 09, 2019
                        10:00 AM PT
                        Virtual machines fail to restore
                        Virtual machines (VMs) may fail to restore successfully if the VM has been saved and restored once before.

                        See details >                        		January 08, 2019
                        KB4480968                        		Resolved
                        KB4490514                        		February 19, 2019
                        02:00 PM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                        See details >                        		January 08, 2019
                        KB4480968                        		Resolved
                        KB4487023                        		February 12, 2019
                        10:00 AM PT
                        " @@ -52,6 +51,25 @@ sections:
                        " +- title: August 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        After installing KB4512476, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4517301. The ‘optional’ update is now available on Microsoft Update Catalog and Windows Server Update Services (WSUS).

                        Back to top                        		August 13, 2019
                        KB4512476                        		Resolved
                        KB4517301                        		Resolved:
                        August 16, 2019
                        02:00 PM PT

                        Opened:
                        August 14, 2019
                        03:34 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503273) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                        Back to top                        		June 11, 2019
                        KB4503273                        		Resolved External
                        		Last updated:
                        August 09, 2019
                        07:03 PM PT

                        Opened:
                        August 09, 2019
                        04:25 PM PT
                        + " + +- title: July 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503273 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512499.

                        Back to top                        		June 11, 2019
                        KB4503273                        		Resolved
                        KB4512499                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        + " + - title: June 2019 - items: - type: markdown @@ -86,18 +104,6 @@ sections: - type: markdown text: " -
                        DetailsOriginating updateStatusHistory
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487022.

                        Back to top                        		February 12, 2019
                        KB4487023                        		Resolved
                        KB4487022                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                        For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color.

                        Affected platforms 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4493471.

                        Back to top                        		February 12, 2019
                        KB4487023                        		Resolved
                        KB4493471                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        " - -- title: January 2019 -- items: - - type: markdown - text: " - - - - -
                        DetailsOriginating updateStatusHistory
                        First character of the Japanese era name not recognized as an abbreviation
                        After installing KB4480974, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4489880.

                        Back to top                        		January 17, 2019
                        KB4480974                        		Resolved
                        KB4489880                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        January 17, 2019
                        10:00 AM PT
                        Virtual machines fail to restore
                        After installing KB4480968, virtual machines (VM) may fail to restore successfully if the VM has been saved and restored once before. The error message is, “Failed to restore the virtual machine state: Cannot restore this virtual machine because the saved state data cannot be read. Delete the saved state data and then try to start the virtual machine. (0xC0370027).”

                        This affects AMD Bulldozer Family 15h, AMD Jaguar Family 16h, and AMD Puma Family 16h (second generation) microarchitectures.

                        Affected platforms: 
                        • Client: Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4490514.

                        Back to top                        		January 08, 2019
                        KB4480968                        		Resolved
                        KB4490514                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, “Unrecognized Database Format”.

                        Affected platforms: 
                        • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487023.

                        Back to top                        		January 08, 2019
                        KB4480968                        		Resolved
                        KB4487023                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        - " diff --git a/windows/release-information/resolved-issues-windows-server-2012.yml b/windows/release-information/resolved-issues-windows-server-2012.yml index b46a4674bf..bb1c5a4635 100644 --- a/windows/release-information/resolved-issues-windows-server-2012.yml +++ b/windows/release-information/resolved-issues-windows-server-2012.yml @@ -32,6 +32,9 @@ sections: - type: markdown text: " + + + @@ -40,15 +43,9 @@ sections: - - - - - -
                        SummaryOriginating updateStatusDate resolved
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		June 11, 2019
                        KB4503285                        		Resolved
                        KB4512512                        		August 17, 2019
                        02:00 PM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

                        See details >                        		August 13, 2019
                        KB4512518                        		Resolved
                        KB4517302                        		August 16, 2019
                        02:00 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on Windows devices that installed updates on June 11, 2019 or later.

                        See details >                        		June 11, 2019
                        KB4503285                        		Resolved External
                        		August 09, 2019
                        07:03 PM PT
                        Some devices and generation 2 Hyper-V VMs may have issues installing updates
                        Some devices and generation 2 Hyper-V virtual machines (VMs) may have issues installing some updates when Secure Boot is enabled.

                        See details >                        		June 11, 2019
                        KB4503285                        		Resolved
                        KB4503295                        		June 21, 2019
                        02:00 PM PT
                        IE11 may stop working when loading or interacting with Power BI reports
                        Power BI reports that contain line charts with markers may cause Internet Explorer 11 to stop working.

                        See details >                        		May 14, 2019
                        KB4499171                        		Resolved
                        KB4503295                        		June 21, 2019
                        02:00 PM PT
                        Event Viewer may close or you may receive an error when using Custom Views
                        When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                        See details >                        		June 11, 2019
                        KB4503285                        		Resolved
                        KB4503295                        		June 20, 2019
                        02:00 PM PT
                        Layout and cell size of Excel sheets may change when using MS UI Gothic
                        When using the MS UI Gothic or MS PGothic fonts, the text, layout, or cell size may become narrower or wider than expected in Microsoft Excel.

                        See details >                        		April 25, 2019
                        KB4493462                        		Resolved
                        KB4499171                        		May 14, 2019
                        10:00 AM PT
                        System unresponsive after restart if Sophos Endpoint Protection installed
                        Devices with Sophos Endpoint Protection installed and managed by Sophos Central or Sophos Enterprise Console (SEC) may become unresponsive upon restart.

                        See details >                        		April 09, 2019
                        KB4493451                        		Resolved
                        		May 14, 2019
                        01:21 PM PT
                        System may be unresponsive after restart if Avira antivirus software installed
                        Devices with Avira antivirus software installed may become unresponsive upon restart.

                        See details >                        		April 09, 2019
                        KB4493451                        		Resolved
                        		May 14, 2019
                        01:19 PM PT
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        See details >                        		February 12, 2019
                        KB4487025                        		Resolved
                        KB4487024                        		February 19, 2019
                        02:00 PM PT
                        First character of the Japanese era name not recognized as an abbreviation
                        The first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        See details >                        		January 15, 2019
                        KB4480971                        		Resolved
                        KB4487024                        		February 19, 2019
                        02:00 PM PT
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                        See details >                        		February 12, 2019
                        KB4487025                        		Resolved
                        KB4493451                        		April 09, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        Users may receive “Error 1309” while installing or uninstalling certain types of MSI and MSP files.

                        See details >                        		February 12, 2019
                        KB4487025                        		Resolved
                        KB4489891                        		March 12, 2019
                        10:00 AM PT
                        Internet Explorer 11 authentication issue with multiple concurrent logons
                        Internet Explorer 11 users may encounter issues if two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine.

                        See details >                        		January 08, 2019
                        KB4480975                        		Resolved
                        KB4493451                        		April 09, 2019
                        10:00 AM PT
                        MSXML6 may cause applications to stop responding
                        MSXML6 may cause applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        See details >                        		January 08, 2019
                        KB4480975                        		Resolved
                        KB4493451                        		April 09, 2019
                        10:00 AM PT
                        Virtual machines fail to restore
                        Virtual machines (VMs) may fail to restore successfully if the VM has been saved and restored once before.

                        See details >                        		January 08, 2019
                        KB4480975                        		Resolved
                        KB4490516                        		February 19, 2019
                        02:00 PM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if column names are greater than 32 characters.

                        See details >                        		January 08, 2019
                        KB4480975                        		Resolved
                        KB4487025                        		February 12, 2019
                        10:00 AM PT
                        Event Viewer may not show some event descriptions for network interface cards
                        The Event Viewer may not show some event descriptions for network interface cards (NIC).

                        See details >                        		September 11, 2018
                        KB4457135                        		Resolved
                        KB4489891                        		March 12, 2019
                        10:00 AM PT
                        " @@ -59,6 +56,25 @@ sections:
                        " +- title: August 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        After installing KB4512518, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4517302. The ‘optional’ update is now available on Microsoft Update Catalog and Windows Server Update Services (WSUS).

                        Back to top                        		August 13, 2019
                        KB4512518                        		Resolved
                        KB4517302                        		Resolved:
                        August 16, 2019
                        02:00 PM PT

                        Opened:
                        August 14, 2019
                        03:34 PM PT
                        MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                        You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503285) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                        Back to top                        		June 11, 2019
                        KB4503285                        		Resolved External
                        		Last updated:
                        August 09, 2019
                        07:03 PM PT

                        Opened:
                        August 09, 2019
                        04:25 PM PT
                        + " + +- title: July 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503285 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512512.

                        Back to top                        		June 11, 2019
                        KB4503285                        		Resolved
                        KB4512512                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        + " + - title: June 2019 - items: - type: markdown @@ -104,9 +120,7 @@ sections: - type: markdown text: " - -
                        DetailsOriginating updateStatusHistory
                        Applications using Microsoft Jet database and Access 95 file format stop working
                        Applications that use a Microsoft Jet database with the Microsoft Access 95 file format may randomly stop working.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487024.

                        Back to top                        		February 12, 2019
                        KB4487025                        		Resolved
                        KB4487024                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Embedded objects may display incorrectly
                        Any compound document (OLE) server application that places embedded objects into the Windows Metafile (WMF) using the PatBlt API may display embedded objects incorrectly.

                        For example, if you paste a Microsoft Excel worksheet object into a Microsoft Word document, the cells may render with a different background color.

                        Affected platforms 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2 
                        Resolution: This issue is resolved in KB4493451.

                        Back to top                        		February 12, 2019
                        KB4487025                        		Resolved
                        KB4493451                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        Error 1309 when installing/uninstalling MSI or MSP files
                        After installing KB4487025, users may receive \"Error 1309\" while installing or uninstalling certain types of MSI and MSP files.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue is resolved in KB4489891.

                        Back to top                        		February 12, 2019
                        KB4487025                        		Resolved
                        KB4489891                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        February 12, 2019
                        10:00 AM PT
                        " @@ -115,19 +129,7 @@ sections: - type: markdown text: " - - - -
                        DetailsOriginating updateStatusHistory
                        First character of the Japanese era name not recognized as an abbreviation
                        After installing KB4480971, the first character of the Japanese era name is not recognized as an abbreviation and may cause date parsing issues.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487024.

                        Back to top                        		January 15, 2019
                        KB4480971                        		Resolved
                        KB4487024                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        January 15, 2019
                        10:00 AM PT
                        Internet Explorer 11 authentication issue with multiple concurrent logons
                        After installing KB4480975, Internet Explorer 11 and other applications that use WININET.DLL may have authentication issues. This occurs when two or more people use the same user account for multiple, concurrent login sessions on the same Windows Server machine, including Remote Desktop Protocol (RDP) and Terminal Server logons. Symptoms reported by customers include, but may not be limited to:
                        • Cache size and location show zero or empty.
                        • Keyboard shortcuts may not work properly.
                        • Webpages may intermittently fail to load or render correctly.
                        • Issues with credential prompts.
                        • Issues when downloading files.
                        Affected platforms: 
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
                        Resolution: This issue is resolved in KB4493451.

                        Back to top                        		January 08, 2019
                        KB4480975                        		Resolved
                        KB4493451                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        MSXML6 may cause applications to stop responding
                        After installing KB4480975, MSXML6 causes applications to stop responding if an exception was thrown during node operations, such as appendChild(), insertBefore(), and moveNode().

                        The Group Policy editor may stop responding when editing a Group Policy Object (GPO) that contains Group Policy Preferences (GPP) for Internet Explorer 10 settings.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                        • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                        Resolution: This issue is resolved in KB4493451.

                        Back to top                        		January 08, 2019
                        KB4480975                        		Resolved
                        KB4493451                        		Resolved:
                        April 09, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Virtual machines fail to restore
                        After installing KB4480975, virtual machines (VM) may fail to restore successfully if the VM has been saved and restored once before. The error message is, \"Failed to restore the virtual machine state: Cannot restore this virtual machine because the saved state data cannot be read. Delete the saved state data and then try to start the virtual machine. (0xC0370027).\"

                        This affects AMD Bulldozer Family 15h, AMD Jaguar Family 16h, and AMD Puma Family 16h (second generation) microarchitectures.

                        Affected platforms: 
                        • Client: Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4490516.

                        Back to top                        		January 08, 2019
                        KB4480975                        		Resolved
                        KB4490516                        		Resolved:
                        February 19, 2019
                        02:00 PM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        Applications using Microsoft Jet database fail to open
                        Applications that use a Microsoft Jet database with the Microsoft Access 97 file format may fail to open if the database has column names greater than 32 characters. The database will fail to open with the error, \"Unrecognized Database Format\".

                        Affected platforms: 
                        • Client: Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1; Windows 7 SP1 
                        • Server: Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue is resolved in KB4487025.

                        Back to top                        		January 08, 2019
                        KB4480975                        		Resolved
                        KB4487025                        		Resolved:
                        February 12, 2019
                        10:00 AM PT

                        Opened:
                        January 08, 2019
                        10:00 AM PT
                        - " - -- title: September 2018 -- items: - - type: markdown - text: " - -
                        DetailsOriginating updateStatusHistory
                        Event Viewer may not show some event descriptions for network interface cards
                        After installing KB4457135, the Event Viewer may not show some event descriptions for network interface cards (NICs).

                        Affected Platforms:
                        • Client: Windows 7 SP1 
                        • Server: Windows Server 2012; Windows Server 2008 R2 SP1
                        Resolution: This issue is resolved in KB4489891.

                        Back to top                        		September 11, 2018
                        KB4457135                        		Resolved
                        KB4489891                        		Resolved:
                        March 12, 2019
                        10:00 AM PT

                        Opened:
                        September 11, 2018
                        10:00 AM PT
                        " diff --git a/windows/release-information/status-windows-10-1507.yml b/windows/release-information/status-windows-10-1507.yml index 9f116c65f8..88f03f07b7 100644 --- a/windows/release-information/status-windows-10-1507.yml +++ b/windows/release-information/status-windows-10-1507.yml @@ -60,7 +60,6 @@ sections: - type: markdown text: "
                        This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                        -
                        SummaryOriginating updateStatusLast updated
                        Event Viewer may close or you may receive an error when using Custom Views
                        When trying to expand, view or create Custom Views in Event Viewer, you may receive an error and the app may stop responding or close.

                        See details >                        		OS Build 10240.18244

                        June 11, 2019
                        KB4503291                        		Resolved
                        KB4507458                        		July 09, 2019
                        10:00 AM PT
                        Certain operations performed on a Cluster Shared Volume may fail
                        Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

                        See details >                        		OS Build 10240.18094

                        January 08, 2019
                        KB4480962                        		Mitigated
                        		April 25, 2019
                        02:00 PM PT
                        " @@ -72,15 +71,6 @@ sections:
                        " -- title: June 2019 -- items: - - type: markdown - text: " - - -
                        DetailsOriginating updateStatusHistory
                        Event Viewer may close or you may receive an error when using Custom Views
                        When trying to expand, view, or create Custom Views in Event Viewer, you may receive the error, \"MMC has detected an error in a snap-in and will unload it.\" and the app may stop responding or close. You may also receive the same error when using Filter Current Log in the Action menu with built-in views or logs. Built-in views and other features of Event Viewer should work as expected.

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4507458.

                        Back to top                        		OS Build 10240.18244

                        June 11, 2019
                        KB4503291                        		Resolved
                        KB4507458                        		Resolved:
                        July 09, 2019
                        10:00 AM PT

                        Opened:
                        June 12, 2019
                        11:11 AM PT
                        - " - - title: January 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml index 4bfa74c40c..f2f699cd5b 100644 --- a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml +++ b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml @@ -60,12 +60,10 @@ sections: - type: markdown text: "
                        This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                        - - - - - - + + + + @@ -79,32 +77,32 @@ sections:
                        " +- title: September 2019 +- items: + - type: markdown + text: " +
                        SummaryOriginating updateStatusLast updated
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 14393.3115

                        July 16, 2019
                        KB4507459                        		Investigating
                        		August 01, 2019
                        06:12 PM PT
                        Internet Explorer 11 and apps using the WebBrowser control may fail to render
                        JavaScript may fail to render as expected in Internet Explorer 11 and in apps using JavaScript or the WebBrowser control.

                        See details >                        		OS Build 14393.3085

                        July 09, 2019
                        KB4507460                        		Mitigated
                        		July 26, 2019
                        04:58 PM PT
                        SCVMM cannot enumerate and manage logical switches deployed on the host
                        For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host.

                        See details >                        		OS Build 14393.2639

                        November 27, 2018
                        KB4467684                        		Resolved
                        KB4507459                        		July 16, 2019
                        10:00 AM PT
                        Some applications may fail to run as expected on clients of AD FS 2016
                        Some applications may fail to run as expected on clients of Active Directory Federation Services 2016 (AD FS 2016)

                        See details >                        		OS Build 14393.2941

                        April 25, 2019
                        KB4493473                        		Resolved
                        KB4507459                        		July 16, 2019
                        10:00 AM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 14393.3025

                        June 11, 2019
                        KB4503267                        		Mitigated
                        		July 10, 2019
                        07:09 PM PT
                        Devices with Hyper-V enabled may receive BitLocker error 0xC0210000
                        Some devices with Hyper-V enabled may start into BitLocker recovery with error 0xC0210000.

                        See details >                        		OS Build 14393.2969

                        May 14, 2019
                        KB4494440                        		Resolved
                        KB4507460                        		July 09, 2019
                        10:00 AM PT
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

                        See details >                        		OS Build 14393.3204

                        September 10, 2019
                        KB4516044                        		Resolved
                        		September 17, 2019
                        04:47 PM PT
                        Apps and scripts using the NetQueryDisplayInformation API may fail with error
                        Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

                        See details >                        		OS Build 14393.3053

                        June 18, 2019
                        KB4503294                        		Resolved
                        KB4516044                        		September 10, 2019
                        10:00 AM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 14393.3115

                        July 16, 2019
                        KB4507459                        		Resolved
                        KB4512517                        		August 13, 2019
                        10:00 AM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 14393.3025

                        June 11, 2019
                        KB4503267                        		Resolved
                        KB4512495                        		August 17, 2019
                        02:00 PM PT
                        Certain operations performed on a Cluster Shared Volume may fail
                        Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

                        See details >                        		OS Build 14393.2724

                        January 08, 2019
                        KB4480961                        		Mitigated
                        		April 25, 2019
                        02:00 PM PT
                        Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
                        Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.

                        See details >                        		OS Build 14393.2608

                        November 13, 2018
                        KB4467691                        		Mitigated
                        		February 19, 2019
                        10:00 AM PT
                        Cluster service may fail if the minimum password length is set to greater than 14
                        The cluster service may fail to start with the error “2245 (NERR_PasswordTooShort)” if the Group Policy “Minimum Password Length” is configured with greater than 14 characters.

                        See details >                        		OS Build 14393.2639

                        November 27, 2018
                        KB4467684                        		Mitigated
                        		April 25, 2019
                        02:00 PM PT
                        + +
                        DetailsOriginating updateStatusHistory
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: After investigation, we have found that this issue does not affect this version of Windows.

                        Back to top                        		OS Build 14393.3204

                        September 10, 2019
                        KB4516044                        		Resolved
                        		Resolved:
                        September 17, 2019
                        04:47 PM PT

                        Opened:
                        September 13, 2019
                        05:25 PM PT
                        + " + +- title: August 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        Apps and scripts using the NetQueryDisplayInformation API may fail with error
                         Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

                        Affected platforms:
                        • Server: Windows Server 2019; Windows Server 2016
                        Resolution: This issue was resolved in KB4516044.

                        Back to top                        		OS Build 14393.3053

                        June 18, 2019
                        KB4503294                        		Resolved
                        KB4516044                        		Resolved:
                        September 10, 2019
                        10:00 AM PT

                        Opened:
                        August 01, 2019
                        05:00 PM PT
                        + " + - title: July 2019 - items: - type: markdown text: " - - - -
                        DetailsOriginating updateStatusHistory
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507459. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Next steps: At this time, we suggest that devices in an affected environment do not install KB4507459. We are working on a resolution and estimate a solution will be available in mid-August.

                        Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                        Back to top                        		OS Build 14393.3115

                        July 16, 2019
                        KB4507459                        		Investigating
                        		Last updated:
                        August 01, 2019
                        06:12 PM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Internet Explorer 11 and apps using the WebBrowser control may fail to render
                        Internet Explorer 11 may fail to render some JavaScript after installing KB4507460. You may also have issues with apps using JavaScript or the WebBrowser control, such as the present PowerPoint feature of Skype Meeting Broadcast.

                        Affected platforms:
                        • Client: Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server 2016
                        Workaround: To mitigate this issue, you need to Enable Script Debugging using one of the following ways.

                        You can configure the below registry key:
                        Registry setting: HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main
                        Value: Disable Script Debugger
                        Type: REG_SZ
                        Data: no

                        Or you can Enable Script Debugging in Internet Settings. You can open Internet Setting by either typing Internet Settings into the search box on Windows or by selecting Internet Options in Internet Explorer. Once open, select Advanced then Browsing and finally, select Enable Script Debugging.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 14393.3085

                        July 09, 2019
                        KB4507460                        		Mitigated
                        		Last updated:
                        July 26, 2019
                        04:58 PM PT

                        Opened:
                        July 26, 2019
                        04:58 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503267 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Workaround:
                        To mitigate this issue on an SCCM server:
                        1. Verify Variable Window Extension is enabled.
                        2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                        Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                        To mitigate this issue on a WDS server without SCCM:
                        1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                        2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                        3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                        Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 14393.3025

                        June 11, 2019
                        KB4503267                        		Mitigated
                        		Last updated:
                        July 10, 2019
                        07:09 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        - " - -- title: June 2019 -- items: - - type: markdown - text: " - - -
                        DetailsOriginating updateStatusHistory
                        Some applications may fail to run as expected on clients of AD FS 2016
                        Some applications may fail to run as expected on clients of Active Directory Federation Services 2016 (AD FS 2016) after installation of KB4493473 on the server. Applications that may exhibit this behavior use an IFRAME during non-interactive authentication requests and receive X-Frame Options set to DENY.

                        Affected platforms:
                        • Server: Windows Server 2016
                        Resolution: This issue was resolved in KB4507459.

                        Back to top                        		OS Build 14393.2941

                        April 25, 2019
                        KB4493473                        		Resolved
                        KB4507459                        		Resolved:
                        July 16, 2019
                        10:00 AM PT

                        Opened:
                        June 04, 2019
                        05:55 PM PT
                        - " - -- title: May 2019 -- items: - - type: markdown - text: " - - + +
                        DetailsOriginating updateStatusHistory
                        Devices with Hyper-V enabled may receive BitLocker error 0xC0210000
                        Some devices with Hyper-V enabled may enter BitLocker recovery mode and receive an error, \"0xC0210000\" after installing KB4494440 and restarting.

                        Affected platforms:
                        • Client: Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server 2016
                        Resolution: This issue was resolved in KB4507460.

                        Back to top                        		OS Build 14393.2969

                        May 14, 2019
                        KB4494440                        		Resolved
                        KB4507460                        		Resolved:
                        July 09, 2019
                        10:00 AM PT

                        Opened:
                        May 21, 2019
                        08:50 AM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507459. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                        HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: This issue was resolved in KB4512517 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                        Back to top                        		OS Build 14393.3115

                        July 16, 2019
                        KB4507459                        		Resolved
                        KB4512517                        		Resolved:
                        August 13, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503267 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512495.

                        Back to top                        		OS Build 14393.3025

                        June 11, 2019
                        KB4503267                        		Resolved
                        KB4512495                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        " @@ -122,7 +120,6 @@ sections: - type: markdown text: " -
                        DetailsOriginating updateStatusHistory
                        SCVMM cannot enumerate and manage logical switches deployed on the host
                        For hosts managed by System Center Virtual Machine Manager (VMM), VMM cannot enumerate and manage logical switches deployed on the host after installing KB4467684.

                        Additionally, if you do not follow the best practices, a stop error may occur in vfpext.sys on the hosts.

                        Affected platforms:
                        • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                        • Server: Windows Server 2016
                        Resolution: This issue was resolved in KB4507459.

                        Back to top                        		OS Build 14393.2639

                        November 27, 2018
                        KB4467684                        		Resolved
                        KB4507459                        		Resolved:
                        July 16, 2019
                        10:00 AM PT

                        Opened:
                        November 27, 2018
                        10:00 AM PT
                        Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
                        After installing KB4467691, Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.

                        Affected platforms:
                        • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                        • Server: Windows Server 2016
                        Workaround: Restart the affected machine using the Unified Extensible Firmware Interface (UEFI). Disable Secure Boot and then restart.

                        If BitLocker is enabled on your machine, you may have to go through BitLocker recovery after Secure Boot has been disabled.

                        Next steps: Lenovo and Fujitsu are aware of this issue. Please contact your OEM to ask if there is a firmware update available for your device.

                        Back to top                        		OS Build 14393.2608

                        November 13, 2018
                        KB4467691                        		Mitigated
                        		Last updated:
                        February 19, 2019
                        10:00 AM PT

                        Opened:
                        November 13, 2018
                        10:00 AM PT
                        Cluster service may fail if the minimum password length is set to greater than 14
                        After installing KB4467684, the cluster service may fail to start with the error \"2245 (NERR_PasswordTooShort)\" if the Group Policy \"Minimum Password Length\" is configured with greater than 14 characters.

                        Affected platforms:
                        • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                        • Server: Windows Server 2016
                        Workaround: Set the domain default \"Minimum Password Length\" policy to less than or equal to 14 characters.

                        Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 14393.2639

                        November 27, 2018
                        KB4467684                        		Mitigated
                        		Last updated:
                        April 25, 2019
                        02:00 PM PT

                        Opened:
                        November 27, 2018
                        10:00 AM PT
                        diff --git a/windows/release-information/status-windows-10-1703.yml b/windows/release-information/status-windows-10-1703.yml index 4dbe8ada26..c9f01b66d5 100644 --- a/windows/release-information/status-windows-10-1703.yml +++ b/windows/release-information/status-windows-10-1703.yml @@ -20,6 +20,12 @@ sections: text: " Find information on known issues for Windows 10, version 1703. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). + +
                        Current status as of August 23, 2019:
                        +
                        The Enterprise and Education editions of Windows 10, version 1703 (the Windows 10 Creators Update) will reach end of life on October 9, 2019. The Home, Pro, Pro for Workstations, and IoT Core editions reached end of service on October 8, 2018.

                        There is no extended support available for any edition of Windows 10, version 1703. Therefore, it will no longer be supported after October 9, 2019 and will not receive monthly security and quality updates containing protections from the latest security threats.

                        To continue receiving security and quality updates, Microsoft recommends that you update your devices to the latest version of Windows 10. For more information on end of service dates and currently supported versions of Windows 10, see the Windows lifecycle fact sheet. +
                        +
                        + " - items: @@ -60,8 +66,8 @@ sections: - type: markdown text: "
                        This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                        - - + +
                        SummaryOriginating updateStatusLast updated
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 15063.1955

                        July 16, 2019
                        KB4507467                        		Investigating
                        		August 01, 2019
                        06:12 PM PT
                        Devices with Hyper-V enabled may receive BitLocker error 0xC0210000
                        Some devices with Hyper-V enabled may start into BitLocker recovery with error 0xC0210000.

                        See details >                        		OS Build 15063.1805

                        May 14, 2019
                        KB4499181                        		Resolved
                        KB4507450                        		July 09, 2019
                        10:00 AM PT
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

                        See details >                        		OS Build 15063.2045

                        September 10, 2019
                        KB4516068                        		Resolved
                        		September 17, 2019
                        04:47 PM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 15063.1955

                        July 16, 2019
                        KB4507467                        		Resolved
                        KB4512507                        		August 13, 2019
                        10:00 AM PT
                        Certain operations performed on a Cluster Shared Volume may fail
                        Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

                        See details >                        		OS Build 15063.1563

                        January 08, 2019
                        KB4480973                        		Mitigated
                        		April 25, 2019
                        02:00 PM PT
                        " @@ -73,21 +79,22 @@ sections:
                        " +- title: September 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: After investigation, we have found that this issue does not affect this version of Windows.

                        Back to top                        		OS Build 15063.2045

                        September 10, 2019
                        KB4516068                        		Resolved
                        		Resolved:
                        September 17, 2019
                        04:47 PM PT

                        Opened:
                        September 13, 2019
                        05:25 PM PT
                        + " + - title: July 2019 - items: - type: markdown text: " - -
                        DetailsOriginating updateStatusHistory
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507467. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Next steps: At this time, we suggest that devices in an affected environment do not install KB4507467. We are working on a resolution and estimate a solution will be available in mid-August.

                        Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                        Back to top                        		OS Build 15063.1955

                        July 16, 2019
                        KB4507467                        		Investigating
                        		Last updated:
                        August 01, 2019
                        06:12 PM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        - " - -- title: May 2019 -- items: - - type: markdown - text: " - - +
                        DetailsOriginating updateStatusHistory
                        Devices with Hyper-V enabled may receive BitLocker error 0xC0210000
                        Some devices with Hyper-V enabled may enter BitLocker recovery mode and receive an error, \"0xC0210000\" after installing KB4499181 and restarting.

                        Affected platforms:
                        • Client: Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server 2016
                        Resolution: This issue was resolved in KB4507450.

                        Back to top                        		OS Build 15063.1805

                        May 14, 2019
                        KB4499181                        		Resolved
                        KB4507450                        		Resolved:
                        July 09, 2019
                        10:00 AM PT

                        Opened:
                        May 21, 2019
                        08:50 AM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507467. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                        HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: This issue was resolved in KB4512507 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                        Back to top                        		OS Build 15063.1955

                        July 16, 2019
                        KB4507467                        		Resolved
                        KB4512507                        		Resolved:
                        August 13, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        " diff --git a/windows/release-information/status-windows-10-1709.yml b/windows/release-information/status-windows-10-1709.yml index cee8270547..9bd26e7699 100644 --- a/windows/release-information/status-windows-10-1709.yml +++ b/windows/release-information/status-windows-10-1709.yml @@ -60,8 +60,9 @@ sections: - type: markdown text: "
                        This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                        - - + + +
                        SummaryOriginating updateStatusLast updated
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 16299.1296

                        July 16, 2019
                        KB4507465                        		Investigating
                        		August 01, 2019
                        06:12 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 16299.1217

                        June 11, 2019
                        KB4503284                        		Mitigated
                        		July 10, 2019
                        07:09 PM PT
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

                        See details >                        		OS Build 16299.1387

                        September 10, 2019
                        KB4516066                        		Mitigated
                        		September 16, 2019
                        05:36 PM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 16299.1296

                        July 16, 2019
                        KB4507465                        		Resolved
                        KB4512516                        		August 13, 2019
                        10:00 AM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 16299.1217

                        June 11, 2019
                        KB4503284                        		Resolved
                        KB4512494                        		August 16, 2019
                        02:00 PM PT
                        Certain operations performed on a Cluster Shared Volume may fail
                        Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

                        See details >                        		OS Build 16299.904

                        January 08, 2019
                        KB4480978                        		Mitigated
                        		April 25, 2019
                        02:00 PM PT
                        " @@ -73,13 +74,23 @@ sections:
                        " +- title: September 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

                        Workaround: To mitigate the issue, perform the following steps:
                        1. Select the Start button and type Services.
                        2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
                        3. Locate Startup type: and change it to Manual
                        4. Select Ok
                        5. The TabletInputService service is now in the default configuration and IME should work as expected.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 16299.1387

                        September 10, 2019
                        KB4516066                        		Mitigated
                        		Last updated:
                        September 16, 2019
                        05:36 PM PT

                        Opened:
                        September 13, 2019
                        05:25 PM PT
                        + " + - title: July 2019 - items: - type: markdown text: " - - + +
                        DetailsOriginating updateStatusHistory
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507465. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Next steps: At this time, we suggest that devices in an affected environment do not install KB4507465. We are working on a resolution and estimate a solution will be available in mid-August.

                        Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                        Back to top                        		OS Build 16299.1296

                        July 16, 2019
                        KB4507465                        		Investigating
                        		Last updated:
                        August 01, 2019
                        06:12 PM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503284 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Workaround:
                        To mitigate this issue on an SCCM server:
                        1. Verify Variable Window Extension is enabled.
                        2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                        Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                        To mitigate this issue on a WDS server without SCCM:
                        1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                        2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                        3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                        Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 16299.1217

                        June 11, 2019
                        KB4503284                        		Mitigated
                        		Last updated:
                        July 10, 2019
                        07:09 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507465. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                        HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: This issue was resolved in KB4512516 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                        Back to top                        		OS Build 16299.1296

                        July 16, 2019
                        KB4507465                        		Resolved
                        KB4512516                        		Resolved:
                        August 13, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503284 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512494.

                        Back to top                        		OS Build 16299.1217

                        June 11, 2019
                        KB4503284                        		Resolved
                        KB4512494                        		Resolved:
                        August 16, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        " diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml index fccb71eca1..a6be94d23c 100644 --- a/windows/release-information/status-windows-10-1803.yml +++ b/windows/release-information/status-windows-10-1803.yml @@ -20,6 +20,11 @@ sections: text: " Find information on known issues for Windows 10, version 1803. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). + +
                        Current status as of August 7, 2019:
                        +
                        Windows 10, version 1803 (the April 2018 Update) will reach end of service on November 12, 2019 for Home and Pro editions. We will begin updating devices running Windows 10, version 1803 to Windows 10, version 1903 (the May 2019 Update) starting July 16, 2019 to help ensure that these devices remain in a serviced and secure state. For more information, see the Windows 10, version 1903 section of the release information dashboard.
                        +
                        + " - items: @@ -60,8 +65,12 @@ sections: - type: markdown text: "
                        This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                        - - + + + + + +
                        SummaryOriginating updateStatusLast updated
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 17134.915

                        July 16, 2019
                        KB4507466                        		Investigating
                        		August 01, 2019
                        06:12 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 17134.829

                        June 11, 2019
                        KB4503286                        		Mitigated
                        		July 10, 2019
                        07:09 PM PT
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

                        See details >                        		OS Build 17134.1006

                        September 10, 2019
                        KB4516058                        		Mitigated
                        		September 16, 2019
                        05:36 PM PT
                        Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
                        You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not respond to \"wake up\" from sleep.

                        See details >                        		OS Build 17134.950

                        August 13, 2019
                        KB4512501                        		Mitigated
                        		September 11, 2019
                        05:32 PM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 17134.915

                        July 16, 2019
                        KB4507466                        		Resolved
                        KB4512501                        		August 13, 2019
                        10:00 AM PT
                        Notification issue: \"Your device is missing important security and quality fixes.\"
                        Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"

                        See details >                        		N/A

                        		Resolved
                        		September 03, 2019
                        12:32 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 17134.829

                        June 11, 2019
                        KB4503286                        		Resolved
                        KB4512509                        		August 19, 2019
                        02:00 PM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

                        See details >                        		OS Build 17134.950

                        August 13, 2019
                        KB4512501                        		Resolved
                        KB4512509                        		August 19, 2019
                        02:00 PM PT
                        Startup to a black screen after installing updates
                        Your device may startup to a black screen during the first logon after installing updates.

                        See details >                        		OS Build 17134.829

                        June 11, 2019
                        KB4503286                        		Mitigated
                        		June 14, 2019
                        04:41 PM PT
                        Certain operations performed on a Cluster Shared Volume may fail
                        Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

                        See details >                        		OS Build 17134.523

                        January 08, 2019
                        KB4480966                        		Mitigated
                        		April 25, 2019
                        02:00 PM PT
                        @@ -74,13 +83,34 @@ sections:
                        " +- title: September 2019 +- items: + - type: markdown + text: " + + + + +
                        DetailsOriginating updateStatusHistory
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

                        Workaround: To mitigate the issue, perform the following steps:
                        1. Select the Start button and type Services.
                        2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
                        3. Locate Startup type: and change it to Manual
                        4. Select Ok
                        5. The TabletInputService service is now in the default configuration and IME should work as expected.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 17134.1006

                        September 10, 2019
                        KB4516058                        		Mitigated
                        		Last updated:
                        September 16, 2019
                        05:36 PM PT

                        Opened:
                        September 13, 2019
                        05:25 PM PT
                        Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
                        After installing KB4512501, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10, version 1803
                        Workaround: To mitigate the issue, use the following steps:
                        1. Close the Windows Mixed Reality Portal, if it is running.
                        2. Open Task Manager by selecting the Start button and typing Task Manager.
                        3. In Task Manager under the Processes tab, right click or long press on “Windows Explorer” and select restart.
                        4. You can now open the Windows Mixed Reality Portal.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 17134.950

                        August 13, 2019
                        KB4512501                        		Mitigated
                        		Last updated:
                        September 11, 2019
                        05:32 PM PT

                        Opened:
                        September 11, 2019
                        05:32 PM PT
                        Notification issue: \"Your device is missing important security and quality fixes.\"
                        Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes\" in the Windows Update dialog and a red \"!\" in the task tray on the Windows Update tray icon. This notification is intended for devices that are 90 days or more out of date, but some users with installed updates released in June or July also saw this notification.

                        Affected platforms:
                        • Client: Windows 10, version 1803
                        • Server: Windows Server, version 1803
                        Resolution: This issue was resolved on the server side on August 30, 2019. Only devices that are out of date by 90 days or more should now see the notification. No action is required by the user to resolve this issue. If you are still seeing the \"Your device is missing important security and quality fixes\" notification, we recommend selecting Check for Updates in the Windows Update dialog. For instructions, see Update Windows 10. Microsoft always recommends trying to keep your devices up to date, as the monthly updates contain important security fixes. 

                        Back to top                        		N/A

                        		Resolved
                        		Resolved:
                        September 03, 2019
                        12:32 PM PT

                        Opened:
                        September 03, 2019
                        12:32 PM PT
                        + " + +- title: August 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        After installing KB4512501, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4512509. The ‘optional’ update will be available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512509 and install. For instructions, see Update Windows 10.

                        Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                        Back to top                        		OS Build 17134.950

                        August 13, 2019
                        KB4512501                        		Resolved
                        KB4512509                        		Resolved:
                        August 19, 2019
                        02:00 PM PT

                        Opened:
                        August 14, 2019
                        03:34 PM PT
                        + " + - title: July 2019 - items: - type: markdown text: " - - + +
                        DetailsOriginating updateStatusHistory
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507466. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Next steps: At this time, we suggest that devices in an affected environment do not install KB4507466. We are working on a resolution and estimate a solution will be available in mid-August.

                        Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                        Back to top                        		OS Build 17134.915

                        July 16, 2019
                        KB4507466                        		Investigating
                        		Last updated:
                        August 01, 2019
                        06:12 PM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503286 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Workaround:
                        To mitigate this issue on an SCCM server:
                        1. Verify Variable Window Extension is enabled.
                        2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                        Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                        To mitigate this issue on a WDS server without SCCM:
                        1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                        2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                        3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                        Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 17134.829

                        June 11, 2019
                        KB4503286                        		Mitigated
                        		Last updated:
                        July 10, 2019
                        07:09 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507466. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                        HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: This issue was resolved in KB4512501 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                        Back to top                        		OS Build 17134.915

                        July 16, 2019
                        KB4507466                        		Resolved
                        KB4512501                        		Resolved:
                        August 13, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503286 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512509.

                        Back to top                        		OS Build 17134.829

                        June 11, 2019
                        KB4503286                        		Resolved
                        KB4512509                        		Resolved:
                        August 19, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        " diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml index de3ecd7333..f32d6b5f10 100644 --- a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml @@ -18,7 +18,7 @@ sections: - items: - type: markdown text: " - Find information on known issues and the status of the rollout for Windows 10, version 1809 and Windows Server 2019. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). + Find information on known issues for Windows 10, version 1809 and Windows Server 2019. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
                        Current status:
                        Windows 10, version 1809 is designated for broad deployment and available for any user who manually selects “Check for updates” via Windows Update. The recommended servicing status is Semi-Annual Channel. @@ -64,8 +64,11 @@ sections: - type: markdown text: "
                        This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                        - - + + + + + @@ -79,13 +82,33 @@ sections:
                        " +- title: September 2019 +- items: + - type: markdown + text: " +
                        SummaryOriginating updateStatusLast updated
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 17763.652

                        July 22, 2019
                        KB4505658                        		Investigating
                        		August 01, 2019
                        06:12 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 17763.557

                        June 11, 2019
                        KB4503327                        		Mitigated
                        		July 10, 2019
                        07:09 PM PT
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

                        See details >                        		OS Build 17763.737

                        September 10, 2019
                        KB4512578                        		Mitigated
                        		September 16, 2019
                        05:36 PM PT
                        Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
                        You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not respond to \"wake up\" from sleep.

                        See details >                        		OS Build 17763.678

                        August 13, 2019
                        KB4511553                        		Mitigated
                        		September 11, 2019
                        05:32 PM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 17763.652

                        July 22, 2019
                        KB4505658                        		Resolved
                        KB4511553                        		August 13, 2019
                        10:00 AM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 17763.557

                        June 11, 2019
                        KB4503327                        		Resolved
                        KB4512534                        		August 17, 2019
                        02:00 PM PT
                        Apps and scripts using the NetQueryDisplayInformation API may fail with error
                        Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data.

                        See details >                        		OS Build 17763.55

                        October 09, 2018
                        KB4464330                        		Investigating
                        		August 01, 2019
                        05:00 PM PT
                        Startup to a black screen after installing updates
                        Your device may startup to a black screen during the first logon after installing updates.

                        See details >                        		OS Build 17763.557

                        June 11, 2019
                        KB4503327                        		Mitigated
                        		June 14, 2019
                        04:41 PM PT
                        Devices with some Asian language packs installed may receive an error
                        After installing the KB4493509 devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_F

                        See details >                        		OS Build 17763.437

                        April 09, 2019
                        KB4493509                        		Mitigated
                        		May 03, 2019
                        10:59 AM PT
                        Certain operations performed on a Cluster Shared Volume may fail
                        Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\".

                        See details >                        		OS Build 17763.253

                        January 08, 2019
                        KB4480116                        		Mitigated
                        		April 09, 2019
                        10:00 AM PT
                        + + +
                        DetailsOriginating updateStatusHistory
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

                        Workaround: To mitigate the issue, perform the following steps:
                        1. Select the Start button and type Services.
                        2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
                        3. Locate Startup type: and change it to Manual
                        4. Select Ok
                        5. The TabletInputService service is now in the default configuration and IME should work as expected.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 17763.737

                        September 10, 2019
                        KB4512578                        		Mitigated
                        		Last updated:
                        September 16, 2019
                        05:36 PM PT

                        Opened:
                        September 13, 2019
                        05:25 PM PT
                        Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
                        After installing KB4511553, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10, version 1803
                        Workaround: To mitigate the issue, use the following steps:
                        1. Close the Windows Mixed Reality Portal, if it is running.
                        2. Open Task Manager by selecting the Start button and typing Task Manager.
                        3. In Task Manager under the Processes tab, right click or long press on “Windows Explorer” and select restart.
                        4. You can now open the Windows Mixed Reality Portal.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 17763.678

                        August 13, 2019
                        KB4511553                        		Mitigated
                        		Last updated:
                        September 11, 2019
                        05:32 PM PT

                        Opened:
                        September 11, 2019
                        05:32 PM PT
                        + " + +- title: August 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        Apps and scripts using the NetQueryDisplayInformation API may fail with error
                         Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

                        Affected platforms:
                        • Server: Windows Server 2019; Windows Server 2016
                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 17763.55

                        October 09, 2018
                        KB4464330                        		Investigating
                        		Last updated:
                        August 01, 2019
                        05:00 PM PT

                        Opened:
                        August 01, 2019
                        05:00 PM PT
                        + " + - title: July 2019 - items: - type: markdown text: " - - + +
                        DetailsOriginating updateStatusHistory
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4505658. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Next steps: At this time, we suggest that devices in an affected environment do not install KB4505658. We are working on a resolution and estimate a solution will be available in mid-August.

                        Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                        Back to top                        		OS Build 17763.652

                        July 22, 2019
                        KB4505658                        		Investigating
                        		Last updated:
                        August 01, 2019
                        06:12 PM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503327 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Workaround:
                        To mitigate this issue on an SCCM server:
                        1. Verify Variable Window Extension is enabled.
                        2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                        Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                        To mitigate this issue on a WDS server without SCCM:
                        1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                        2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                        3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                        Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 17763.557

                        June 11, 2019
                        KB4503327                        		Mitigated
                        		Last updated:
                        July 10, 2019
                        07:09 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4505658. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                        HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: This issue was resolved in KB4511553 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                        Back to top                        		OS Build 17763.652

                        July 22, 2019
                        KB4505658                        		Resolved
                        KB4511553                        		Resolved:
                        August 13, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503327 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512534.

                        Back to top                        		OS Build 17763.557

                        June 11, 2019
                        KB4503327                        		Resolved
                        KB4512534                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        " @@ -103,7 +126,7 @@ sections: - type: markdown text: " - +
                        DetailsOriginating updateStatusHistory
                        Devices with some Asian language packs installed may receive an error
                        After installing the April 2019 Cumulative Update (KB4493509), devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.\"

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                        • Server: Windows Server, version 1809; Windows Server 2019
                        Workaround:
                        1. Uninstall and reinstall any recently added language packs. For instructions, see \"Manage the input and display language settings in Windows 10\".
                        2. Click Check for Updates and install the April 2019 Cumulative Update. For instructions, see \"Update Windows 10\".
                        Note: If reinstalling the language pack does not mitigate the issue, reset your PC as follows:
                        1. Go to Settings app -> Recovery.
                        2. Click on Get Started under \"Reset this PC\" recovery option.
                        3. Select \"Keep my Files\".
                        Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 17763.437

                        April 09, 2019
                        KB4493509                        		Mitigated
                        		Last updated:
                        May 03, 2019
                        10:59 AM PT

                        Opened:
                        May 02, 2019
                        04:36 PM PT
                        Devices with some Asian language packs installed may receive an error
                        After installing the April 2019 Cumulative Update (KB4493509), devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.\"

                        Affected platforms:
                        • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                        • Server: Windows Server, version 1809; Windows Server 2019
                        Workaround:
                        1. Uninstall and reinstall any recently added language packs. For instructions, see \"Manage the input and display language settings in Windows 10\".
                        2. Click Check for Updates and install the April 2019 Cumulative Update. For instructions, see \"Update Windows 10\".
                        Note: If reinstalling the language pack does not mitigate the issue, reset your PC as follows:
                          1. Go to Settings app -> Recovery.
                          2. Click on Get Started under \"Reset this PC\" recovery option.
                          3. Select \"Keep my Files\".
                        Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 17763.437

                        April 09, 2019
                        KB4493509                        		Mitigated
                        		Last updated:
                        May 03, 2019
                        10:59 AM PT

                        Opened:
                        May 02, 2019
                        04:36 PM PT
                        " diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index b2ca8f3142..d7af320a1c 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -18,7 +18,7 @@ sections: - items: - type: markdown text: " - Find information on known issues for Windows 10, version 1903 and Windows Server, version 1903. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s). + Find information on known issues and the status of the rollout for Windows 10, version 1903 and Windows Server, version 1903. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
                        Current status as of July 16, 2019:
                        @@ -65,19 +65,22 @@ sections: - type: markdown text: "
                        This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                        + + + + + + + + + + + + + - - - - - - - - - - @@ -91,25 +94,41 @@ sections:
                        " +- title: September 2019 +- items: + - type: markdown + text: " +
                        SummaryOriginating updateStatusLast updated
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

                        See details >                        		OS Build 18362.356

                        September 10, 2019
                        KB4515384                        		Mitigated
                        		September 16, 2019
                        05:36 PM PT
                        Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
                        Microsoft and NEC have found incompatibility issues with some devices with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903.

                        See details >                        		N/A

                        		Mitigated
                        		September 13, 2019
                        05:25 PM PT
                        Some users report issues related to the Start menu and Windows Desktop Search
                        Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

                        See details >                        		OS Build 18362.356

                        September 10, 2019
                        KB4515384                        		Investigating
                        		September 13, 2019
                        05:35 PM PT
                        Audio in games is quiet or different than expected
                        Microsoft has received reports that audio in certain games is quieter or different than expected.

                        See details >                        		OS Build 18362.356

                        September 10, 2019
                        KB4515384                        		Mitigated
                        		September 13, 2019
                        05:25 PM PT
                        Screenshots and Snips have an unnatural orange tint
                        Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

                        See details >                        		OS Build 18362.356

                        September 10, 2019
                        KB4516115                        		Resolved External
                        		September 11, 2019
                        08:54 PM PT
                        Windows Desktop Search may not return any results and may have high CPU usage
                        Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.

                        See details >                        		OS Build 18362.329

                        August 30, 2019
                        KB4512941                        		Resolved
                        KB4515384                        		September 10, 2019
                        10:00 AM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4512941                        		August 30, 2019
                        10:00 AM PT
                        Issues updating when certain versions of Intel storage drivers are installed
                        Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

                        See details >                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4512941                        		August 30, 2019
                        10:00 AM PT
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        Applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and VBScript may stop responding and you may receive an error.

                        See details >                        		OS Build 18362.295

                        August 13, 2019
                        KB4512508                        		Resolved
                        KB4512941                        		August 30, 2019
                        10:00 AM PT
                        Initiating a Remote Desktop connection may result in black screen
                        When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.

                        See details >                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4512941                        		August 30, 2019
                        10:00 AM PT
                        Windows Sandbox may fail to start with error code “0x80070002”
                        Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updates

                        See details >                        		OS Build 18362.116

                        May 20, 2019
                        KB4505057                        		Resolved
                        KB4512941                        		August 30, 2019
                        10:00 AM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 18362.175

                        June 11, 2019
                        KB4503293                        		Resolved
                        KB4512941                        		August 30, 2019
                        10:00 AM PT
                        Updates may fail to install and you may receive Error 0x80073701
                        Installation of updates may fail and you may receive an error, \"Updates Failed, There were problems installing some updates, but we'll try again later\" and \"Error 0x80073701.\"

                        See details >                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Investigating
                        		August 16, 2019
                        04:28 PM PT
                        Intermittent loss of Wi-Fi connectivity
                        Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver.

                        See details >                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Mitigated External
                        		August 01, 2019
                        08:44 PM PT
                        Gamma ramps, color profiles, and night light settings do not apply in some cases
                        Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

                        See details >                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Mitigated
                        		August 01, 2019
                        06:27 PM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after updating.

                        See details >                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Investigating
                        		August 01, 2019
                        06:12 PM PT
                        Issues updating when certain versions of Intel storage drivers are installed
                        Certain versions of Intel Rapid Storage Technology (Intel RST) drivers may cause updating to Windows 10, version 1903 to fail.

                        See details >                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Mitigated External
                        		August 01, 2019
                        05:58 PM PT
                        Display brightness may not respond to adjustments
                        Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers.

                        See details >                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Resolved
                        KB4505903                        		July 26, 2019
                        02:00 PM PT
                        RASMAN service may stop working and result in the error “0xc0000005”
                        The Remote Access Connection Manager (RASMAN) service may stop working and result in the error “0xc0000005” with VPN profiles configured as an Always On VPN connection.

                        See details >                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4505903                        		July 26, 2019
                        02:00 PM PT
                        The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU
                        Some apps or games that needs to perform graphics intensive operations may close or fail to open on Surface Book 2 devices with Nvidia dGPU.

                        See details >                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Investigating
                        		July 16, 2019
                        09:04 AM PT
                        Initiating a Remote Desktop connection may result in black screen
                        When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.

                        See details >                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Investigating
                        		July 12, 2019
                        04:42 PM PT
                        Loss of functionality in Dynabook Smartphone Link app
                        After updating to Windows 10, version 1903, you may experience a loss of functionality when using the Dynabook Smartphone Link application.

                        See details >                        		OS Build 18362.116

                        May 20, 2019
                        KB4505057                        		Resolved
                        		July 11, 2019
                        01:54 PM PT
                        Error attempting to update with external USB device or memory card attached
                        PCs with an external USB device or SD memory card attached may get error: \"This PC can't be upgraded to Windows 10.\"

                        See details >                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Resolved
                        		July 11, 2019
                        01:53 PM PT
                        Audio not working with Dolby Atmos headphones and home theater
                        Users may experience audio loss with Dolby Atmos headphones or Dolby Atmos home theater.

                        See details >                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Resolved
                        		July 11, 2019
                        01:53 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		OS Build 18362.175

                        June 11, 2019
                        KB4503293                        		Mitigated
                        		July 10, 2019
                        07:09 PM PT
                        Windows Sandbox may fail to start with error code “0x80070002”
                        Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language was changed between updates

                        See details >                        		OS Build 18362.116

                        May 20, 2019
                        KB4505057                        		Investigating
                        		June 10, 2019
                        06:06 PM PT
                        Unable to discover or connect to Bluetooth devices
                        Microsoft has identified compatibility issues with some versions of Realtek and Qualcomm Bluetooth radio drivers.

                        See details >                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Mitigated
                        		May 21, 2019
                        04:48 PM PT
                        Intel Audio displays an intcdaud.sys notification
                        Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in battery drain.

                        See details >                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Mitigated
                        		May 21, 2019
                        04:47 PM PT
                        Cannot launch Camera app
                        Microsoft and Intel have identified an issue affecting Intel RealSense SR300 or Intel RealSense S200 camera apps.

                        See details >                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Mitigated
                        		May 21, 2019
                        04:47 PM PT
                        + + + + + + +
                        DetailsOriginating updateStatusHistory
                        IME may become unresponsive or have High CPU usage
                        Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

                        Workaround: To mitigate the issue, perform the following steps:
                        1. Select the Start button and type Services.
                        2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
                        3. Locate Startup type: and change it to Manual
                        4. Select Ok
                        5. The TabletInputService service is now in the default configuration and IME should work as expected.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 18362.356

                        September 10, 2019
                        KB4515384                        		Mitigated
                        		Last updated:
                        September 16, 2019
                        05:36 PM PT

                        Opened:
                        September 13, 2019
                        05:25 PM PT
                        Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
                        Microsoft and NEC have found incompatibility issues with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903 on specific models of NEC devices. If these devices are updated to Windows 10, version 1903, they will no longer be able to use any Wi-Fi connections. The Wi-Fi driver may have a yellow exclamation point in device manager. The task tray icon for networking may show the icon for no internet and Network & Internet settings may not show any Wi-Fi networks.

                        To safeguard your update experience, we have applied a compatibility hold on the affected devices from being offered Windows 10, version 1903.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Workaround: If you are using an affected device and you have already installed Windows 10, version 1903, you can mitigate the issue disabling then re-enabling the Wi-Fi adapter in Device Manager. You should now be able to use Wi-Fi until your next reboot.

                        Next steps: Microsoft and NEC are working on a resolution and will provide an update in an upcoming release.

                        Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                        Back to top                        		N/A

                        		Mitigated
                        		Last updated:
                        September 13, 2019
                        05:25 PM PT

                        Opened:
                        September 13, 2019
                        05:25 PM PT
                        Some users report issues related to the Start menu and Windows Desktop Search
                        Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Next steps: We are presently investigating and will provide an update when more information is available.

                        Note As a first step with any issue you may encounter, we recommend you refer to our troubleshooting support guides. If you are having an issue with search, see Fix problems in Windows Search.

                        Back to top                        		OS Build 18362.356

                        September 10, 2019
                        KB4515384                        		Investigating
                        		Last updated:
                        September 13, 2019
                        05:35 PM PT

                        Opened:
                        September 11, 2019
                        05:18 PM PT
                        Audio in games is quiet or different than expected
                        Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Workaround: To mitigate the issue, open settings in the impacted game and disable multi-channel audio, if this option is available. You can also search in the Windows Control Panel for 3rd party audio device control panels and disable Multi-channel audio or Virtual Surround Sound, if these options are available.  

                        Next steps: We are working on a resolution and estimates a solution will be available in late September.

                        Back to top                        		OS Build 18362.356

                        September 10, 2019
                        KB4515384                        		Mitigated
                        		Last updated:
                        September 13, 2019
                        05:25 PM PT

                        Opened:
                        September 13, 2019
                        05:25 PM PT
                        Screenshots and Snips have an unnatural orange tint
                        When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        • Server: None
                        Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

                        Back to top                        		OS Build 18362.356

                        September 10, 2019
                        KB4516115                        		Resolved External
                        		Last updated:
                        September 11, 2019
                        08:54 PM PT

                        Opened:
                        September 11, 2019
                        08:54 PM PT
                        Windows Desktop Search may not return any results and may have high CPU usage
                        Microsoft is getting reports that a small number of users may not receive results when using Windows Desktop Search and may see high CPU usage from SearchUI.exe when searching after installing KB4512941. This issue is only encountered on devices in which searching the web from Windows Desktop Search has been disabled.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Resolution: This issue was resolved in KB4515384.

                        Back to top                        		OS Build 18362.329

                        August 30, 2019
                        KB4512941                        		Resolved
                        KB4515384                        		Resolved:
                        September 10, 2019
                        10:00 AM PT

                        Opened:
                        September 04, 2019
                        02:25 PM PT
                        + " + +- title: August 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                        After installing KB4512508, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                        Resolution: This issue was resolved in KB4512941. The ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512941 and install. For instructions, see Update Windows 10.

                        Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                        Back to top                        		OS Build 18362.295

                        August 13, 2019
                        KB4512508                        		Resolved
                        KB4512941                        		Resolved:
                        August 30, 2019
                        10:00 AM PT

                        Opened:
                        August 14, 2019
                        03:34 PM PT
                        Updates may fail to install and you may receive Error 0x80073701
                        Installation of updates may fail and you may receive the error message, \"Updates Failed, There were problems installing some updates, but we'll try again later\" or \"Error 0x80073701\" on the Windows Update dialog or within Update history.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        • Server: Windows Server, version 1903
                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Investigating
                        		Last updated:
                        August 16, 2019
                        04:28 PM PT

                        Opened:
                        August 16, 2019
                        01:41 PM PT
                        + " + - title: July 2019 - items: - type: markdown text: " - - + + + + - - -
                        DetailsOriginating updateStatusHistory
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Next steps: At this time, we suggest that devices in an affected environment do not install KB4497935. We are working on a resolution and estimate a solution will be available in mid-August.

                        Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                        Back to top                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Investigating
                        		Last updated:
                        August 01, 2019
                        06:12 PM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Issues updating when certain versions of Intel storage drivers are installed
                        Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

                        To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

                        Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.6.1044.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        • Server: Windows Server, version 1903
                        Next steps: To resolve this issue, you will need to update the Intel RST drivers for your device to version 15.5.2.1054 or a later.  Check with your device manufacturer (OEM) to see if an updated driver is available and install it. You can also download the latest Intel RST drivers directly from Intel at Intel® Rapid Storage Technology (Intel® RST) User Interface and Driver. Once your drivers are updated, you can restart the installation process for the May 2019 Update. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                        Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool. 

                        Back to top                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Mitigated External
                        		Last updated:
                        August 01, 2019
                        05:58 PM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Domain connected devices that use MIT Kerberos realms will not start up
                        Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

                        To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                        Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                        HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                        • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                        Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                        Back to top                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4512941                        		Resolved:
                        August 30, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Issues updating when certain versions of Intel storage drivers are installed
                        Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

                        To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

                        Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        • Server: Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                        Back to top                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4512941                        		Resolved:
                        August 30, 2019
                        10:00 AM PT

                        Opened:
                        July 25, 2019
                        06:10 PM PT
                        Initiating a Remote Desktop connection may result in black screen
                        When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        • Server: Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512941.

                        Back to top                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4512941                        		Resolved:
                        August 30, 2019
                        10:00 AM PT

                        Opened:
                        July 12, 2019
                        04:42 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503293 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512941.

                        Back to top                        		OS Build 18362.175

                        June 11, 2019
                        KB4503293                        		Resolved
                        KB4512941                        		Resolved:
                        August 30, 2019
                        10:00 AM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        The dGPU may occasionally disappear from device manager on Surface Book 2 with dGPU
                        Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing unit (dGPU). After updating to Windows 10, version 1903 (May 2019 Feature Update), some apps or games that needs to perform graphics intensive operations may close or fail to open.

                        To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPUs from being offered Windows 10, version 1903, until this issue is resolved.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Workaround: To mitigate the issue if you are already on Windows 10, version 1903, you can restart the device or select the Scan for hardware changes button in the Action menu or on the toolbar in Device Manager.

                        Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Investigating
                        		Last updated:
                        July 16, 2019
                        09:04 AM PT

                        Opened:
                        July 12, 2019
                        04:20 PM PT
                        Initiating a Remote Desktop connection may result in black screen
                        When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        • Server: Windows Server, version 1903
                        Next steps: We are working on a resolution that will be made available in upcoming release.

                        Back to top                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Investigating
                        		Last updated:
                        July 12, 2019
                        04:42 PM PT

                        Opened:
                        July 12, 2019
                        04:42 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503293 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Workaround:
                        To mitigate this issue on an SCCM server:
                        1. Verify Variable Window Extension is enabled.
                        2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                        Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                        To mitigate this issue on a WDS server without SCCM:
                        1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                        2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                        3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                        Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 18362.175

                        June 11, 2019
                        KB4503293                        		Mitigated
                        		Last updated:
                        July 10, 2019
                        07:09 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        - " - -- title: June 2019 -- items: - - type: markdown - text: " - -
                        DetailsOriginating updateStatusHistory
                        RASMAN service may stop working and result in the error “0xc0000005”
                        The Remote Access Connection Manager (RASMAN) service may stop working and you may receive the error “0xc0000005” on devices where the diagnostic data level is manually configured to the non-default setting of 0. You may also receive an error in the Application section of Windows Logs in Event Viewer with Event ID 1000 referencing “svchost.exe_RasMan” and “rasman.dll”.

                        This issue only occurs when a VPN profile is configured as an Always On VPN (AOVPN) connection with or without device tunnel. This does not affect manual only VPN profiles or connections.

                        Affected platforms
                        • Client: Windows 10, version 1903
                        Resolution: This issue was resolved in KB4505903.

                        Back to top                        		OS Build 18362.145

                        May 29, 2019
                        KB4497935                        		Resolved
                        KB4505903                        		Resolved:
                        July 26, 2019
                        02:00 PM PT

                        Opened:
                        June 28, 2019
                        05:01 PM PT
                        " @@ -118,13 +137,9 @@ sections: - type: markdown text: " + - - - - - diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml index 23ba82cf44..02b0c3aa47 100644 --- a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml +++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml @@ -60,8 +60,10 @@ sections: - type: markdown text: "
                        This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                        DetailsOriginating updateStatusHistory
                        Windows Sandbox may fail to start with error code “0x80070002”
                        Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language is changed during the update process when installing Windows 10, version 1903.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Resolution: This issue was resolved in KB4512941.

                        Back to top                        		OS Build 18362.116

                        May 20, 2019
                        KB4505057                        		Resolved
                        KB4512941                        		Resolved:
                        August 30, 2019
                        10:00 AM PT

                        Opened:
                        May 24, 2019
                        04:20 PM PT
                        Intermittent loss of Wi-Fi connectivity
                        Some older computers may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).

                        To safeguard your upgrade experience, we have applied a hold on devices with this Qualcomm driver from being offered Windows 10, version 1903, until the updated driver is installed.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Workaround: Before updating to Windows 10, version 1903, you will need to download and install an updated Wi-Fi driver from your device manufacturer (OEM).
                         
                        Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.

                        Back to top                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Mitigated External
                        		Last updated:
                        August 01, 2019
                        08:44 PM PT

                        Opened:
                        May 21, 2019
                        07:13 AM PT
                        Gamma ramps, color profiles, and night light settings do not apply in some cases
                        Microsoft has identified some scenarios where gamma ramps, color profiles and night light settings may stop working.

                        Microsoft has identified some scenarios in which these features may have issues or stop working, for example:
                        • Connecting to (or disconnecting from) an external monitor, dock, or projector
                        • Rotating the screen
                        • Updating display drivers or making other display mode changes
                        • Closing full screen applications
                        • Applying custom color profiles
                        • Running applications that rely on custom gamma ramps
                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Workaround: If you find that your night light has stopped working, try turning the night light off and on, or restarting your computer. For other color setting issues, restart your computer to correct the issue.

                        Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Mitigated
                        		Last updated:
                        August 01, 2019
                        06:27 PM PT

                        Opened:
                        May 21, 2019
                        07:28 AM PT
                        Display brightness may not respond to adjustments
                        Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers. After updating to Windows 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change.

                        To safeguard your update experience, we have applied a compatibility hold on devices with certain Intel drivers from being offered Windows 10, version 1903, until this issue is resolved.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Resolution: This issue was resolved in KB4505903 and the safeguard hold has been removed. Please ensure you have applied the resolving update before attempting to update to the Windows 10 May 2019 Update (version 1903). Please note, it can take up to 48 hours for the safeguard to be removed.

                        Back to top                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Resolved
                        KB4505903                        		Resolved:
                        July 26, 2019
                        02:00 PM PT

                        Opened:
                        May 21, 2019
                        07:56 AM PT
                        Loss of functionality in Dynabook Smartphone Link app
                        Some users may experience a loss of functionality after updating to Windows 10, version 1903 when using the Dynabook Smartphone Link application on Windows devices. Loss of functionality may affect the display of phone numbers in the Call menu and the ability to answer phone calls on the Windows PC.

                        To safeguard your update experience, we have applied a compatibility hold on devices with Dynabook Smartphone Link from being offered Windows 10, version 1903, until this issue is resolved.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                        Back to top                        		OS Build 18362.116

                        May 20, 2019
                        KB4505057                        		Resolved
                        		Resolved:
                        July 11, 2019
                        01:54 PM PT

                        Opened:
                        May 24, 2019
                        03:10 PM PT
                        Error attempting to update with external USB device or memory card attached
                        If you have an external USB device or SD memory card attached when installing Windows 10, version 1903, you may get an error message stating \"This PC can't be upgraded to Windows 10.\" This is caused by inappropriate drive reassignment during installation.

                        Sample scenario: An update to Windows 10, version 1903 is attempted on a computer that has a thumb drive inserted into its USB port. Before the update, the thumb drive is mounted in the system as drive G based on the existing drive configuration. After the feature update is installed; however, the device is reassigned a different drive letter (e.g., drive H).

                        Note The drive reassignment is not limited to removable drives. Internal hard drives may also be affected.

                        To safeguard your update experience, we have applied a hold on devices with an external USB device or SD memory card attached from being offered Windows 10, version 1903 until this issue is resolved.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                        Back to top                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Resolved
                        		Resolved:
                        July 11, 2019
                        01:53 PM PT

                        Opened:
                        May 21, 2019
                        07:38 AM PT
                        Audio not working with Dolby Atmos headphones and home theater
                        After updating to Windows 10, version 1903, you may experience loss of audio with Dolby Atmos for home theater (free extension) or Dolby Atmos for headphones (paid extension) acquired through the Microsoft Store due to a licensing configuration error.
                         
                        This occurs due to an issue with a Microsoft Store licensing component, where license holders are not able to connect to the Dolby Access app and enable Dolby Atmos extensions.
                         
                        To safeguard your update experience, we have applied protective hold on devices from being offered Windows 10, version 1903 until this issue is resolved. This configuration error will not result in loss of access for the acquired license once the problem is resolved.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Resolution: This issue is now resolved and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                        Back to top                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Resolved
                        		Resolved:
                        July 11, 2019
                        01:53 PM PT

                        Opened:
                        May 21, 2019
                        07:16 AM PT
                        Windows Sandbox may fail to start with error code “0x80070002”
                        Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language is changed during the update process when installing Windows 10, version 1903.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 18362.116

                        May 20, 2019
                        KB4505057                        		Investigating
                        		Last updated:
                        June 10, 2019
                        06:06 PM PT

                        Opened:
                        May 24, 2019
                        04:20 PM PT
                        Unable to discover or connect to Bluetooth devices
                        Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek and Qualcomm. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek or Qualcomm Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        • Server: Windows Server, version 1903
                        Workaround: Check with your device manufacturer (OEM) to see if an updated driver is available and install it.

                        • For Qualcomm drivers, you will need to install a driver version greater than 10.0.1.11.
                        • For Realtek drivers, you will need to install a driver version greater than 1.5.1011.0.
                        Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool. 

                        Next steps: Microsoft is working with Realtek and Qualcomm to release new drivers for all affected system via Windows Update.  


                        Back to top                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Mitigated
                        		Last updated:
                        May 21, 2019
                        04:48 PM PT

                        Opened:
                        May 21, 2019
                        07:29 AM PT
                        Intel Audio displays an intcdaud.sys notification
                        Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in higher than normal battery drain. If you see an intcdaud.sys notification or “What needs your attention” notification when trying to update to Windows 10, version 1903, you have an affected Intel Audio Display device driver installed on your machine (intcdaud.sys, versions 10.25.0.3 through 10.25.0.8).
                          
                        To safeguard your update experience, we have applied a compatibility hold on devices with drivers from being offered Windows 10, version 1903 until updated device drivers have been installed.

                        Affected platforms:
                        • Client: Windows 10, version 1903; Windows 10, version 1809
                        Workaround:
                        On the “What needs your attention\" notification, click the Back button to remain on your current version of Windows 10. (Do not click Confirm as this will proceed with the update and you may experience compatibility issues.) Affected devices will automatically revert to the previous working configuration.

                        For more information, see Intel's customer support guidance and the Microsoft knowledge base article KB4465877.

                        Note We recommend you do not attempt to update your devices until newer device drivers are installed.

                        Next steps: You can opt to wait for newer drivers to be installed automatically through Windows Update or check with the computer manufacturer for the latest device driver software availability and installation procedures.

                        Back to top                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Mitigated
                        		Last updated:
                        May 21, 2019
                        04:47 PM PT

                        Opened:
                        May 21, 2019
                        07:22 AM PT
                        Cannot launch Camera app
                        Microsoft and Intel have identified an issue affecting Intel RealSense SR300 and Intel RealSense S200 cameras when using the Camera app. After updating to the Windows 10 May 2019 Update and launching the Camera app, you may get an error message stating:

                        \"Close other apps, error code: 0XA00F4243.”


                        To safeguard your update experience, we have applied a protective hold on machines with Intel RealSense SR300 or Intel RealSense S200 cameras installed from being offered Windows 10, version 1903, until this issue is resolved.

                        Affected platforms:
                        • Client: Windows 10, version 1903
                        Workaround: To temporarily resolve this issue, perform one of the following:

                        • Unplug your camera and plug it back in.

                        or

                        • Disable and re-enable the driver in Device Manager. In the Search box, type \"Device Manager\" and press Enter. In the Device Manager dialog box, expand Cameras, then right-click on any RealSense driver listed and select Disable device. Right click on the driver again and select Enable device.

                        or

                        • Restart the RealSense service. In the Search box, type \"Task Manager\" and hit Enter. In the Task Manager dialog box, click on the Services tab, right-click on RealSense, and select Restart. 
                        Note This workaround will only resolve the issue until your next system restart.

                        Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		OS Build 18362.116

                        May 21, 2019
                        KB4505057                        		Mitigated
                        		Last updated:
                        May 21, 2019
                        04:47 PM PT

                        Opened:
                        May 21, 2019
                        07:20 AM PT
                        - - + + + +
                        SummaryOriginating updateStatusLast updated
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		June 11, 2019
                        KB4503292                        		Mitigated
                        		July 10, 2019
                        02:59 PM PT
                        System may be unresponsive after restart with certain McAfee antivirus products
                        Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup.

                        See details >                        		April 09, 2019
                        KB4493472                        		Mitigated
                        		April 25, 2019
                        02:00 PM PT
                        You may receive an error when opening or using the Toshiba Qosmio AV Center
                        Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

                        See details >                        		August 13, 2019
                        KB4512506                        		Investigating
                        		September 13, 2019
                        04:25 PM PT
                        Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
                        Windows updates that are SHA-2 signed are not available with Symantec or Norton antivirus program installed

                        See details >                        		August 13, 2019
                        KB4512506                        		Resolved External
                        		August 27, 2019
                        02:29 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		June 11, 2019
                        KB4503292                        		Resolved
                        KB4512514                        		August 17, 2019
                        02:00 PM PT
                        IA64 and x64 devices may fail to start after installing updates
                        After installing updates released on or after August 13, 2019, IA64 and x64 devices using EFI Boot may fail to start.

                        See details >                        		August 13, 2019
                        KB4512506                        		Mitigated
                        		August 17, 2019
                        12:59 PM PT
                        " @@ -72,20 +74,30 @@ sections:
                        " +- title: September 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        You may receive an error when opening or using the Toshiba Qosmio AV Center
                        After installing KB4512506, you may receive an error when opening or using the Toshiba Qosmio AV Center. You may also receive an error in Event Log related to cryptnet.dll.

                        Affected platforms:
                        • Client: Windows 7 SP1
                        Next steps: Microsoft is working with Dynabook to resolve this issue and estimate a solution will be available late September.

                        Back to top                        		August 13, 2019
                        KB4512506                        		Investigating
                        		Last updated:
                        September 13, 2019
                        04:25 PM PT

                        Opened:
                        September 10, 2019
                        09:48 AM PT
                        + " + +- title: August 2019 +- items: + - type: markdown + text: " + + + +
                        DetailsOriginating updateStatusHistory
                        Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
                        Symantec identified the potential for a negative interaction that may occur after Windows Updates code signed with SHA-2 only certificates are installed on devices with Symantec or Norton antivirus programs installed. The software may not correctly identify files included in the update as code signed by Microsoft, putting the device at risk for a delayed or incomplete update.

                        Affected platforms:
                        • Client: Windows 7 SP1
                        • Server: Windows Server 2008 R2 SP1
                        Resolution: The safeguard hold has been removed. Symantec has completed its evaluation of the impact of this update and future updates to Windows 7/Windows 2008 R2 and has determined that there is no increased risk of a false positive detection for all in-field versions of Symantec Endpoint Protection and Norton antivirus programs. See the Symantec support article for additional detail and please reach out to Symantec or Norton support if you encounter any issues.

                        Back to top                        		August 13, 2019
                        KB4512506                        		Resolved External
                        		Last updated:
                        August 27, 2019
                        02:29 PM PT

                        Opened:
                        August 13, 2019
                        10:05 AM PT
                        IA64 and x64 devices may fail to start after installing updates
                        IA64 devices (in any configuration) and x64 devices using EFI boot that were provisioned after the July 9th updates and/or skipped the recommended update (KB3133977), may fail to start with the following error:
                        \"File: \\Windows\\system32\\winload.efi
                        Status: 0xc0000428
                        Info: Windows cannot verify the digital signature for this file.\"

                        Affected platforms:
                        • Client: Windows 7 SP1
                        • Server: Windows Server 2008 R2 SP1
                        Take Action: To resolve this issue please follow the steps outlined in the SHA-2 support FAQ article for error code 0xc0000428.

                        Back to top                        		August 13, 2019
                        KB4512506                        		Mitigated
                        		Last updated:
                        August 17, 2019
                        12:59 PM PT

                        Opened:
                        August 13, 2019
                        08:34 AM PT
                        + " + - title: July 2019 - items: - type: markdown text: " - -
                        DetailsOriginating updateStatusHistory
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503292 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Workaround:
                        To mitigate this issue on an SCCM server, set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.

                        Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                        To mitigate this issue on a WDS server without SCCM:
                        1. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                        2. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                        Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		June 11, 2019
                        KB4503292                        		Mitigated
                        		Last updated:
                        July 10, 2019
                        02:59 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        - " - -- title: April 2019 -- items: - - type: markdown - text: " - - +
                        DetailsOriginating updateStatusHistory
                        System may be unresponsive after restart with certain McAfee antivirus products
                        Microsoft and McAfee have identified an issue on devices with McAfee Endpoint Security (ENS) Threat Prevention 10.x or McAfee Host Intrusion Prevention (Host IPS) 8.0 or McAfee VirusScan Enterprise (VSE) 8.8 installed. It may cause the system to have slow startup or become unresponsive at restart after installing this update. 

                        Affected platforms:
                        • Client:  Windows 8.1; Windows 7 SP1
                        • Server:  Windows Server 2012 R2; Windows Server 2008 R2 SP1
                        Workaround: Guidance for McAfee customers can be found in the following McAfee support articles: 
                        Next steps: We are presently investigating this issue with McAfee. We will provide an update once we have more information.

                        Back to top                        		April 09, 2019
                        KB4493472                        		Mitigated
                        		Last updated:
                        April 25, 2019
                        02:00 PM PT

                        Opened:
                        April 09, 2019
                        10:00 AM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503292 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512514.

                        Back to top                        		June 11, 2019
                        KB4503292                        		Resolved
                        KB4512514                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        " diff --git a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml index 36e559e6aa..57124dd060 100644 --- a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml +++ b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml @@ -60,9 +60,9 @@ sections: - type: markdown text: "
                        This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                        - + + -
                        SummaryOriginating updateStatusLast updated
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		June 11, 2019
                        KB4503276                        		Mitigated
                        		July 10, 2019
                        07:09 PM PT
                        Windows RT 8.1 devices may have issues opening Internet Explorer 11
                        On Windows RT 8.1 devices, Internet Explorer 11 may not open and you may receive an error.

                        See details >                        		September 10, 2019
                        KB4516067                        		Investigating
                        		September 13, 2019
                        05:25 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		June 11, 2019
                        KB4503276                        		Resolved
                        KB4512478                        		August 17, 2019
                        02:00 PM PT
                        Japanese IME doesn't show the new Japanese Era name as a text input option
                        If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

                        See details >                        		April 25, 2019
                        KB4493443                        		Mitigated
                        		May 15, 2019
                        05:53 PM PT
                        System may be unresponsive after restart with certain McAfee antivirus products
                        Devices with McAfee Endpoint Security Threat Prevention 10.x, Host Intrusion Prevention 8.0, or VirusScan Enterprise 8.8 may be slow or unresponsive at startup.

                        See details >                        		April 09, 2019
                        KB4493446                        		Mitigated
                        		April 18, 2019
                        05:00 PM PT
                        Certain operations performed on a Cluster Shared Volume may fail
                        Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.

                        See details >                        		January 08, 2019
                        KB4480963                        		Mitigated
                        		April 25, 2019
                        02:00 PM PT
                        " @@ -74,12 +74,21 @@ sections:
                        " +- title: September 2019 +- items: + - type: markdown + text: " + + +
                        DetailsOriginating updateStatusHistory
                        Windows RT 8.1 devices may have issues opening Internet Explorer 11
                        On Windows 8.1 RT devices, Internet Explorer 11 may not open and you may receive the error, \"C:\\Program Files\\Internet Explorer\\iexplore.exe: A certificate was explicitly revoked by its issuer.\"


                        Affected platforms:
                        • Client: Windows RT 8.1
                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		September 10, 2019
                        KB4516067                        		Investigating
                        		Last updated:
                        September 13, 2019
                        05:25 PM PT

                        Opened:
                        September 13, 2019
                        05:25 PM PT
                        + " + - title: July 2019 - items: - type: markdown text: " - +
                        DetailsOriginating updateStatusHistory
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503276 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Workaround:
                        To mitigate this issue on an SCCM server:
                        1. Verify Variable Window Extension is enabled.
                        2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                        Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                        To mitigate this issue on a WDS server without SCCM:
                        1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                        2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                        3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                        Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		June 11, 2019
                        KB4503276                        		Mitigated
                        		Last updated:
                        July 10, 2019
                        07:09 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503276 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512478.

                        Back to top                        		June 11, 2019
                        KB4503276                        		Resolved
                        KB4512478                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        " @@ -92,15 +101,6 @@ sections:
                        " -- title: April 2019 -- items: - - type: markdown - text: " - - -
                        DetailsOriginating updateStatusHistory
                        System may be unresponsive after restart with certain McAfee antivirus products
                        Microsoft and McAfee have identified an issue on devices with McAfee Endpoint Security (ENS) Threat Prevention 10.x or McAfee Host Intrusion Prevention (Host IPS) 8.0 or McAfee VirusScan Enterprise (VSE) 8.8 installed. It may cause the system to have slow startup or become unresponsive at restart after installing this update. 

                        Affected platforms:
                        • Client:  Windows 8.1; Windows 7 SP1
                        • Server:  Windows Server 2012 R2; Windows Server 2008 R2 SP1
                        Workaround: Guidance for McAfee customers can be found in the following McAfee support articles:  
                        Next steps: We are presently investigating this issue with McAfee. We will provide an update once we have more information. 

                        Back to top                        		April 09, 2019
                        KB4493446                        		Mitigated
                        		Last updated:
                        April 18, 2019
                        05:00 PM PT

                        Opened:
                        April 09, 2019
                        10:00 AM PT
                        - " - - title: January 2019 - items: - type: markdown diff --git a/windows/release-information/status-windows-server-2008-sp2.yml b/windows/release-information/status-windows-server-2008-sp2.yml index f3d9d5d69b..92caeeca25 100644 --- a/windows/release-information/status-windows-server-2008-sp2.yml +++ b/windows/release-information/status-windows-server-2008-sp2.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
                        This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                        - +
                        SummaryOriginating updateStatusLast updated
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		June 11, 2019
                        KB4503273                        		Mitigated
                        		July 10, 2019
                        02:59 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		June 11, 2019
                        KB4503273                        		Resolved
                        KB4512499                        		August 17, 2019
                        02:00 PM PT
                        " @@ -76,6 +76,6 @@ sections: - type: markdown text: " - +
                        DetailsOriginating updateStatusHistory
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503273 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Workaround:
                        To mitigate this issue on an SCCM server, set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.

                        Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                        To mitigate this issue on a WDS server without SCCM:
                        1. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                        2. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                        Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		June 11, 2019
                        KB4503273                        		Mitigated
                        		Last updated:
                        July 10, 2019
                        02:59 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503273 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512499.

                        Back to top                        		June 11, 2019
                        KB4503273                        		Resolved
                        KB4512499                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        " diff --git a/windows/release-information/status-windows-server-2012.yml b/windows/release-information/status-windows-server-2012.yml index 55b84c6427..53d71fb08e 100644 --- a/windows/release-information/status-windows-server-2012.yml +++ b/windows/release-information/status-windows-server-2012.yml @@ -60,7 +60,7 @@ sections: - type: markdown text: "
                        This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                        - +
                        SummaryOriginating updateStatusLast updated
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		June 11, 2019
                        KB4503285                        		Mitigated
                        		July 10, 2019
                        07:09 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                        See details >                        		June 11, 2019
                        KB4503285                        		Resolved
                        KB4512512                        		August 17, 2019
                        02:00 PM PT
                        Japanese IME doesn't show the new Japanese Era name as a text input option
                        If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

                        See details >                        		April 25, 2019
                        KB4493462                        		Mitigated
                        		May 15, 2019
                        05:53 PM PT
                        Certain operations performed on a Cluster Shared Volume may fail
                        Certain operations, such as rename, performed on files or folders on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.

                        See details >                        		January 08, 2019
                        KB4480975                        		Mitigated
                        		April 25, 2019
                        02:00 PM PT
                        @@ -78,7 +78,7 @@ sections: - type: markdown text: " - +
                        DetailsOriginating updateStatusHistory
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503285 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Workaround:
                        To mitigate this issue on an SCCM server:
                        1. Verify Variable Window Extension is enabled.
                        2. Set the values of TFTP block size to 4096 and TFTP window size to 1. For guidance on how to configure them, see Customize the RamDisk TFTP block and window sizes on PXE-enabled distribution points.
                        Note Try the default values for TFTP block size and TFTP window size first but depending on your environment and overall settings, you may need to adjust them for your setup. You can also try the Enable a PXE responder without Windows Deployment Service setting. For more information on this setting, see Install and configure distribution points in Configuration Manager.

                        To mitigate this issue on a WDS server without SCCM:
                        1. In WDS TFTP settings, verify Variable Window Extension is enabled.
                        2. In the Boot Configuration Data (BCD) of the imported image, set RamDiskTFTPBlockSize to 1456.
                        3. In the BCD of the imported image, set RamDiskTFTPWindowSize to 4.
                        Note Try the default values for RamDiskTFTPBlockSize and RamDiskTFTPWindowSize first but depending on your environment and overall settings, you may need to adjust them for your setup.

                        Next steps: We are working on a resolution and will provide an update in an upcoming release.

                        Back to top                        		June 11, 2019
                        KB4503285                        		Mitigated
                        		Last updated:
                        July 10, 2019
                        07:09 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        Devices starting using PXE from a WDS or SCCM servers may fail to start
                        Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503285 on a WDS server.

                        Affected platforms:
                        • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                        Resolution: This issue was resolved in KB4512512.

                        Back to top                        		June 11, 2019
                        KB4503285                        		Resolved
                        KB4512512                        		Resolved:
                        August 17, 2019
                        02:00 PM PT

                        Opened:
                        July 10, 2019
                        02:51 PM PT
                        " diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml index c7a8b5e2d7..531c4806b0 100644 --- a/windows/release-information/windows-message-center.yml +++ b/windows/release-information/windows-message-center.yml @@ -1,11 +1,11 @@ ### YamlMime:YamlDocument documentType: LandingData -title: Windows 10 message center +title: Windows message center metadata: document_id: - title: Windows 10 message center - description: Windows 10 message center + title: Windows message center + description: Windows message center keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories ms.localizationpriority: high author: greg-lindsay @@ -50,6 +50,18 @@ sections: text: " + + + + + + + + + + + + @@ -73,8 +85,8 @@ Given the potential impact to customers and their businesses, we have also relea diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 14b733039f..328ee569c2 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -35,6 +35,8 @@ "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", "ms.topic": "article", + "manager": "dansimp", + "audience": "ITPro", "feedback_system": "GitHub", "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", diff --git a/windows/security/identity-protection/access-control/access-control.md b/windows/security/identity-protection/access-control/access-control.md index 36a6c863ed..8e6cf74f38 100644 --- a/windows/security/identity-protection/access-control/access-control.md +++ b/windows/security/identity-protection/access-control/access-control.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/access-control/active-directory-accounts.md b/windows/security/identity-protection/access-control/active-directory-accounts.md index 9b684b3be6..50958f0314 100644 --- a/windows/security/identity-protection/access-control/active-directory-accounts.md +++ b/windows/security/identity-protection/access-control/active-directory-accounts.md @@ -7,12 +7,12 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium -ms.date: 04/19/2017 +ms.date: 08/23/2019 ms.reviewer: --- @@ -330,9 +330,7 @@ Windows Server Kerberos authentication is achieved by the use of a special Kerbe ### KRBTGT account maintenance considerations -A strong password is assigned to the KRBTGT account automatically. Be sure that you change the password on a regular schedule. The password for the KDC account is used to derive a secret key for encrypting and decrypting the TGT requests that are issued. The password for a domain trust account is used to derive an inter-realm key for encrypting referral tickets. - -On occasion, the KRBTGT account password requires a reset, for example, when an attempt to change the password on the KRBTGT account fails. In order to resolve this issue, you reset the KRBTGT user account password twice by using Active Directory Users and Computers. You must reset the password twice because the KRBTGT account stores only two of the most recent passwords in the password history. By resetting the password twice, you effectively clear all passwords from the password history. +A strong password is assigned to the KRBTGT and trust accounts automatically. Like any privileged service accounts, organizations should change these passwords on a regular schedule. The password for the KDC account is used to derive a secret key for encrypting and decrypting the TGT requests that are issued. The password for a domain trust account is used to derive an inter-realm key for encrypting referral tickets. Resetting the password requires you either to be a member of the Domain Admins group, or to have been delegated with the appropriate authority. In addition, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority. diff --git a/windows/security/identity-protection/access-control/active-directory-security-groups.md b/windows/security/identity-protection/access-control/active-directory-security-groups.md index 4981294bac..afaaca56b3 100644 --- a/windows/security/identity-protection/access-control/active-directory-security-groups.md +++ b/windows/security/identity-protection/access-control/active-directory-security-groups.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/access-control/dynamic-access-control.md b/windows/security/identity-protection/access-control/dynamic-access-control.md index 73b4f343aa..1ef5a24b40 100644 --- a/windows/security/identity-protection/access-control/dynamic-access-control.md +++ b/windows/security/identity-protection/access-control/dynamic-access-control.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index 65a665503d..33ef3a0add 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/access-control/microsoft-accounts.md b/windows/security/identity-protection/access-control/microsoft-accounts.md index 0b346118ef..d1f2624bf6 100644 --- a/windows/security/identity-protection/access-control/microsoft-accounts.md +++ b/windows/security/identity-protection/access-control/microsoft-accounts.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index d8db3e63d2..f8a3185eb0 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -194,9 +194,9 @@ The SECURITY\_NT\_AUTHORITY (S-1-5) predefined identifier authority produces SID | S-1-5-2 | Network | A group that includes all users who are logged on by means of a network connection. Access tokens for interactive users do not contain the Network SID.| | S-1-5-3 | Batch | A group that includes all users who have logged on by means of a batch queue facility, such as task scheduler jobs.| | S-1-5-4 | Interactive| A group that includes all users who log on interactively. A user can start an interactive logon session by logging on directly at the keyboard, by opening a Remote Desktop Services connection from a remote computer, or by using a remote shell such as Telnet. In each case, the user's access token contains the Interactive SID. If the user signs in by using a Remote Desktop Services connection, the user's access token also contains the Remote Interactive Logon SID.| -| S-1-5-5- *X *- *Y * | Logon Session| The *X * and *Y * values for these SIDs uniquely identify a particular logon session.| +| S-1-5-5- *X*-*Y* | Logon Session| The *X* and *Y* values for these SIDs uniquely identify a particular logon session.| | S-1-5-6 | Service| A group that includes all security principals that have signed in as a service.| -| S-1-5-7 | Anonymous Logon| A user who has connected to the computer without supplying a user name and password.
                        The Anonymous Logon identity is different from the identity that is used by Internet Information Services (IIS) for anonymous web access. IIS uses an actual account—by default, IUSR_ *ComputerName *, for anonymous access to resources on a website. Strictly speaking, such access is not anonymous because the security principal is known even though unidentified people are using the account. IUSR_ *ComputerName * (or whatever you name the account) has a password, and IIS logs on the account when the service starts. As a result, the IIS "anonymous" user is a member of Authenticated Users but Anonymous Logon is not.| +| S-1-5-7 | Anonymous Logon| A user who has connected to the computer without supplying a user name and password.
                        The Anonymous Logon identity is different from the identity that is used by Internet Information Services (IIS) for anonymous web access. IIS uses an actual account—by default, IUSR_ *ComputerName*, for anonymous access to resources on a website. Strictly speaking, such access is not anonymous because the security principal is known even though unidentified people are using the account. IUSR_ *ComputerName* (or whatever you name the account) has a password, and IIS logs on the account when the service starts. As a result, the IIS "anonymous" user is a member of Authenticated Users but Anonymous Logon is not.| | S-1-5-8| Proxy| Does not currently apply: this SID is not used.| | S-1-5-9 | Enterprise Domain Controllers| A group that includes all domain controllers in a forest of domains.| | S-1-5-10 | Self| A placeholder in an ACE for a user, group, or computer object in Active Directory. When you grant permissions to Self, you grant them to the security principal that is represented by the object. During an access check, the operating system replaces the SID for Self with the SID for the security principal that is represented by the object.| diff --git a/windows/security/identity-protection/access-control/security-principals.md b/windows/security/identity-protection/access-control/security-principals.md index bc865d734c..111f5d902d 100644 --- a/windows/security/identity-protection/access-control/security-principals.md +++ b/windows/security/identity-protection/access-control/security-principals.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/access-control/service-accounts.md b/windows/security/identity-protection/access-control/service-accounts.md index cd289738ae..bc52668527 100644 --- a/windows/security/identity-protection/access-control/service-accounts.md +++ b/windows/security/identity-protection/access-control/service-accounts.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index 978d72142a..48f324427e 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -255,7 +255,7 @@ The Network Service account is similar to an Authenticated User account. The Net | Well-Known SID/RID | S-1-5-20 | |Object Class| Foreign Security Principal| |Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| -|Default User Rights| [Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege
                        [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege
                        [Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege
                        [Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege
                        [Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege
                        [Restore files and directories](/windows/device-security/security-policy-settings/restore-files-and-directories): SeRestorePrivilege
                        [Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege
                        | +|Default User Rights| [Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege
                        [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege
                        [Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege
                        [Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege
                        [Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege
                        [Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege
                        | ## NTLM Authentication diff --git a/windows/security/identity-protection/change-history-for-access-protection.md b/windows/security/identity-protection/change-history-for-access-protection.md index 5244518021..954dd6020d 100644 --- a/windows/security/identity-protection/change-history-for-access-protection.md +++ b/windows/security/identity-protection/change-history-for-access-protection.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/configure-s-mime.md b/windows/security/identity-protection/configure-s-mime.md index daccf69649..8e823b08e6 100644 --- a/windows/security/identity-protection/configure-s-mime.md +++ b/windows/security/identity-protection/configure-s-mime.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/credential-guard/additional-mitigations.md b/windows/security/identity-protection/credential-guard/additional-mitigations.md index c67ea0ab51..63a6a403c2 100644 --- a/windows/security/identity-protection/credential-guard/additional-mitigations.md +++ b/windows/security/identity-protection/credential-guard/additional-mitigations.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -71,7 +71,7 @@ Then on the devices that are running Windows Defender Credential Guard, enroll t **Enrolling devices in a certificate** Run the following command: -``` syntax +```powershell CertReq -EnrollCredGuardCert MachineAuthentication ``` @@ -87,7 +87,7 @@ Beginning with the Windows Server 2008 R2 domain functional level, domain contro - The [get-IssuancePolicy.ps1](#bkmk-getscript) shows all of the issuance policies that are available on the certificate authority. From a Windows PowerShell command prompt, run the following command: - ``` syntax + ```powershell .\get-IssuancePolicy.ps1 –LinkedToGroup:All ``` @@ -96,7 +96,7 @@ Beginning with the Windows Server 2008 R2 domain functional level, domain contro - The [set-IssuancePolicyToGroupLink.ps1](#bkmk-setscript) creates a Universal security group, creates an organizational unit, and links the issuance policy to that Universal security group. From a Windows PowerShell command prompt, run the following command: - ``` syntax + ```powershell .\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:"" –groupOU:"" –groupName:”" ``` @@ -143,7 +143,7 @@ Here is a list of scripts mentioned in this topic. Save this script file as get-IssuancePolicy.ps1. -``` syntax +```powershell ####################################### ## Parameters to be defined ## ## by the user ## diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md index bb9bbc4a97..60d02adb71 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index 400ce3d5d2..00a4a3e6bb 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -1,6 +1,6 @@ --- title: How Windows Defender Credential Guard works -description: Using virtualization-based security, Windows Defender Credential Guard features a new component called the isolated LSA process, which stores and protects secrets, isolating them from the rest of the operating system, so that only privileged system software can access them. +description: Using virtualization-based security, Windows Defender Credential Guard features a new component called the isolated LSA process, which stores and protects secrets, isolating them from the rest of the operating system, so that only privileged system software can access them. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 1a19c1ea01..e2c7665e97 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -16,7 +16,7 @@ ms.date: 08/17/2017 ms.reviewer: --- -# Windows Defender Credential Guard: Known issues +# Windows Defender Credential Guard: Known issues **Applies to** - Windows 10 @@ -34,14 +34,14 @@ The following known issue has been fixed in the [Cumulative Security Update for The following known issues have been fixed by servicing releases made available in the Cumulative Security Updates for April 2017: -- [KB4015217 Windows Defender Credential Guard generates double bad password count on Active Directory domain-joined Windows 10 machines](https://support.microsoft.com/help/4015217/windows-10-update-kb4015217) +- [KB4015217 Windows Defender Credential Guard generates double bad password count on Active Directory domain-joined Windows 10 machines](https://support.microsoft.com/help/4015217/windows-10-update-kb4015217) This issue can potentially lead to unexpected account lockouts. See also Microsoft® Knowledge Base articles [KB4015219](https://support.microsoft.com/help/4015219/windows-10-update-kb4015219) and [KB4015221](https://support.microsoft.com/help/4015221/windows-10-update-kb4015221) -- [KB4033236 Two incorrect logon attempts sent to Active Directory after Windows Defender Credential Guard installed on Windows 10](https://support.microsoft.com/help/4033236/two-incorrect-logon-attempts-sent-to-active-directory-after-credential?preview) +- [KB4033236 Two incorrect logon attempts sent to Active Directory after Windows Defender Credential Guard installed on Windows 10](https://support.microsoft.com/help/4033236/two-incorrect-logon-attempts-sent-to-active-directory-after-credential?preview) - This issue can potentially lead to unexpected account lockouts. The issue was fixed in servicing updates for each of the following operating systems: + This issue can potentially lead to unexpected account lockouts. The issue was fixed in servicing updates for each of the following operating systems: - Windows 10 Version 1607 and Windows Server 2016: [KB4015217 (OS Build 14393.1066 and 14393.1083)](https://support.microsoft.com/help/4015217) @@ -52,30 +52,30 @@ The following known issues have been fixed by servicing releases made available The following issue affects the Java GSS API. See the following Oracle bug database article: -- [JDK-8161921: Windows 10 Windows Defender Credential Guard does not allow sharing of TGT with Java](http://bugs.java.com/bugdatabase/view_bug.do?bug_id=8161921) +- [JDK-8161921: Windows 10 Windows Defender Credential Guard does not allow sharing of TGT with Java](http://bugs.java.com/bugdatabase/view_bug.do?bug_id=8161921) When Windows Defender Credential Guard is enabled on Windows 10, the Java GSS API will not authenticate. This is expected behavior because Windows Defender Credential Guard blocks specific application authentication capabilities and will not provide the TGT session key to applications regardless of registry key settings. For further information see [Application requirements](https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-requirements#application-requirements). The following issue affects Cisco AnyConnect Secure Mobility Client: -- [Blue screen on Windows 10 computers running Windows Defender Device Guard and Windows Defender Credential Guard with Cisco Anyconnect 4.3.04027](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc66692) \* +- [Blue screen on Windows 10 computers running Windows Defender Device Guard and Windows Defender Credential Guard with Cisco Anyconnect 4.3.04027](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc66692) \* *Registration required to access this article. The following issue affects McAfee Application and Change Control (MACC): -- [KB88869 Windows 10 machines exhibit high CPU usage with McAfee Application and Change Control (MACC) installed when Windows Defender Credential Guard is enabled](https://kc.mcafee.com/corporate/index?page=content&id=KB88869) [1] +- [KB88869 Windows 10 machines exhibit high CPU usage with McAfee Application and Change Control (MACC) installed when Windows Defender Credential Guard is enabled](https://kc.mcafee.com/corporate/index?page=content&id=KB88869) [1] The following issue affects AppSense Environment Manager. For further information, see the following Knowledge Base article: -- [Installing AppSense Environment Manager on Windows 10 machines causes LSAISO.exe to exhibit high CPU usage when Windows Defender Credential Guard is enabled](http://www.appsense.com/kb/160525073917945) [1] \** +- [Installing AppSense Environment Manager on Windows 10 machines causes LSAISO.exe to exhibit high CPU usage when Windows Defender Credential Guard is enabled](http://www.appsense.com/kb/160525073917945) [1] \** The following issue affects Citrix applications: -- Windows 10 machines exhibit high CPU usage with Citrix applications installed when Windows Defender Credential Guard is enabled. [1] +- Windows 10 machines exhibit high CPU usage with Citrix applications installed when Windows Defender Credential Guard is enabled. [1] [1] Products that connect to Virtualization Based Security (VBS) protected processes can cause Windows Defender Credential Guard-enabled Windows 10 or Windows Server 2016 machines to exhibit high CPU usage. For technical and troubleshooting information, see the following Microsoft Knowledge Base article: -- [KB4032786 High CPU usage in the LSAISO process on Windows 10 or Windows Server 2016](https://support.microsoft.com/help/4032786) +- [KB4032786 High CPU usage in the LSAISO process on Windows 10 or Windows Server 2016](https://support.microsoft.com/help/4032786) For further technical information on LSAISO.exe, see the MSDN article: [Isolated User Mode (IUM) Processes](https://msdn.microsoft.com/library/windows/desktop/mt809132(v=vs.85).aspx) @@ -86,7 +86,7 @@ For further technical information on LSAISO.exe, see the MSDN article: [Isolated ## Vendor support See the following article on Citrix support for Secure Boot: -- [Citrix Support for Secure Boot](https://www.citrix.com/blogs/2016/12/08/windows-server-2016-hyper-v-secure-boot-support-now-available-in-xenapp-7-12/) +- [Citrix Support for Secure Boot](https://www.citrix.com/blogs/2016/12/08/windows-server-2016-hyper-v-secure-boot-support-now-available-in-xenapp-7-12/) Windows Defender Credential Guard is not supported by either these products, products versions, computer systems, or Windows 10 versions: diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 3fe994764f..71715e1e9d 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -106,16 +106,17 @@ You can do this by using either the Control Panel or the Deployment Image Servic > [!NOTE] > You can also enable Windows Defender Credential Guard by setting the registry entries in the [FirstLogonCommands](https://msdn.microsoft.com/library/windows/hardware/dn922797.aspx) unattend setting. - + + ### Enable Windows Defender Credential Guard by using the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool You can also enable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). ``` -DG_Readiness_Tool_v3.5.ps1 -Enable -AutoReboot +DG_Readiness_Tool_v3.6.ps1 -Enable -AutoReboot ``` > [!IMPORTANT] -> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSAch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. > This is a known issue. ### Review Windows Defender Credential Guard performance @@ -135,7 +136,7 @@ You can view System Information to check that Windows Defender Credential Guard You can also check that Windows Defender Credential Guard is running by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). ``` -DG_Readiness_Tool_v3.5.ps1 -Ready +DG_Readiness_Tool_v3.6.ps1 -Ready ``` > [!IMPORTANT] > When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSAch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. @@ -199,7 +200,8 @@ To disable Windows Defender Credential Guard, you can use the following set of p For more info on virtualization-based security and Windows Defender Device Guard, see [Windows Defender Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide). - + + #### Disable Windows Defender Credential Guard by using the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool You can also disable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). @@ -208,7 +210,7 @@ You can also disable Windows Defender Credential Guard by using the [Windows Def DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot ``` > [!IMPORTANT] -> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSAch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. > This is a known issue. #### Disable Windows Defender Credential Guard for a virtual machine diff --git a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md index 2e1a83d9b7..b2f1d37cea 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -96,7 +96,7 @@ Then on the devices that are running Windows Defender Credential Guard, enroll t **Enrolling devices in a certificate** Run the following command: -``` syntax +```powershell CertReq -EnrollCredGuardCert MachineAuthentication ``` @@ -112,7 +112,7 @@ Beginning with the Windows Server 2008 R2 domain functional level, domain contro - The [get-IssuancePolicy.ps1](#bkmk-getscript) shows all of the issuance policies that are available on the certificate authority. From a Windows PowerShell command prompt, run the following command: - ``` syntax + ```powershell .\get-IssuancePolicy.ps1 –LinkedToGroup:All ``` @@ -121,7 +121,7 @@ Beginning with the Windows Server 2008 R2 domain functional level, domain contro - The [set-IssuancePolicyToGroupLink.ps1](#bkmk-setscript) creates a Universal security group, creates an organizational unit, and links the issuance policy to that Universal security group. From a Windows PowerShell command prompt, run the following command: - ``` syntax + ```powershell .\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:"" –groupOU:"" –groupName:”" ``` @@ -172,7 +172,7 @@ Here is a list of scripts mentioned in this topic. Save this script file as get-IssuancePolicy.ps1. -``` syntax +```powershell ####################################### ## Parameters to be defined ## ## by the user ## @@ -363,7 +363,7 @@ write-host "There are no issuance policies which are not mapped to groups" Save the script file as set-IssuancePolicyToGroupLink.ps1. -``` syntax +```powershell ####################################### ## Parameters to be defined ## ## by the user ## diff --git a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md index b3ceb19440..bd6b456162 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 8c3d26bfae..cacd765584 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md index 0b6d13f777..ae294baabb 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -25,7 +25,7 @@ Here is a list of scripts mentioned in this topic. Save this script file as get-IssuancePolicy.ps1. -``` syntax +```powershell ####################################### ## Parameters to be defined ## ## by the user ## @@ -216,7 +216,7 @@ write-host "There are no issuance policies which are not mapped to groups" Save the script file as set-IssuancePolicyToGroupLink.ps1. -``` syntax +```powershell ####################################### ## Parameters to be defined ## ## by the user ## diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md index bdcdac0346..e5422219e7 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard.md +++ b/windows/security/identity-protection/credential-guard/credential-guard.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/enterprise-certificate-pinning.md b/windows/security/identity-protection/enterprise-certificate-pinning.md index 6747177c1d..b45b7ac061 100644 --- a/windows/security/identity-protection/enterprise-certificate-pinning.md +++ b/windows/security/identity-protection/enterprise-certificate-pinning.md @@ -2,10 +2,10 @@ title: Enterprise Certificate Pinning ms.mktglfcycl: manage ms.sitesec: library -description: Enterprise certificate pinning is a Windows feature for remembering, or “pinning” a root, issuing certificate authority, or end entity certificate to a given domain name. +description: Enterprise certificate pinning is a Windows feature for remembering, or “pinning” a root, issuing certificate authority, or end entity certificate to a given domain name. audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index c23f167615..3da855c332 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -319,7 +319,7 @@ This example configures Wi-Fi as a trusted signal (Windows 10, version 1803) ### How to configure Multifactor Unlock policy settings -You need a Windows 10, version 1709 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business Group Policy settings, which includes multi-factor unlock. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1709. +You need a Windows 10, version 1709 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business Group Policy settings, which includes multi-factor unlock. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1709. Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. @@ -332,6 +332,7 @@ The Group Policy object contains the policy settings needed to trigger Windows H > * PIN **must** be in at least one of the groups > * Trusted signals **must** be combined with another credential provider > * You cannot use the same unlock factor to satisfy both categories. Therefore, if you include any credential provider in both categories, it means it can satisfy either category, but not both. +> * The multifactor unlock feature is also supported via the Passport for Work CSP. See [Passport For Work CSP](https://docs.microsoft.com/windows/client-management/mdm/passportforwork-csp) for more information. 1. Start the **Group Policy Management Console** (gpmc.msc) 2. Expand the domain and select the **Group Policy Object** node in the navigation pane. diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index 3c60042dd6..18314f3f58 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -44,7 +44,7 @@ Windows Hello provides many benefits, including: - Support for Windows Hello is built into the operating system so you can add additional biometric devices and polices as part of a coordinated rollout or to individual employees or groups using Group Policy or Mobile Device Management (MDM) configurations service provider (CSP) policies.
                        For more info about the available Group Policies and MDM CSPs, see the [Implement Windows Hello for Business in your organization](hello-manage-in-organization.md) topic. -## Where is Microsoft Hello data stored? +## Where is Windows Hello data stored? The biometric data used to support Windows Hello is stored on the local device only. It doesn’t roam and is never sent to external devices or servers. This separation helps to stop potential attackers by providing no single collection point that an attacker could potentially compromise to steal biometric data. Additionally, even if an attacker was actually able to get the biometric data, it still can’t be easily converted to a form that could be recognized by the biometric sensor. ## Has Microsoft set any device requirements for Windows Hello? diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index 60e829af0c..4563787217 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -38,7 +38,7 @@ A new Active Directory Federation Services farm should have a minimum of two fed Prepare the Active Directory Federation Services deployment by installing and updating two Windows Server 2016 Servers. Ensure the update listed below is applied to each server before continuing. -## Update Windows Server 2016 +## Update Windows Server 2016 Sign-in the federation server with _local admin_ equivalent credentials. 1. Ensure Windows Server 2016 is current by running **Windows Update** from **Settings**. Continue this process until no further updates are needed. If you’re not using Windows Update for updates, please advise the [Windows Server 2016 update history page](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) to make sure you have the latest updates available installed. diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md deleted file mode 100644 index 30b809ce8c..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md +++ /dev/null @@ -1,549 +0,0 @@ ---- -title: Configure or Deploy Multifactor Authentication Services (Windows Hello for Business) -description: How to Configure or Deploy Multifactor Authentication Services for Windows Hello for Business -keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security, mobile -audience: ITPro -author: mapalko -ms.author: mapalko -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -localizationpriority: medium -ms.date: 08/19/2018 -ms.reviewer: ---- -# Configure or Deploy Multifactor Authentication Services - -**Applies to** -- Windows 10, version 1703 or later -- On-premises deployment -- Certificate trust - - -On-premises deployments must use an on-premises MFA Server that provides an AD FS Multifactor authentication adapter. It can be an Azure Multi-Factor Authentication Server or a third-party MFA solution. - ->[!TIP] ->Please make sure you've read [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) before proceeding any further. - -## Prerequisites - -The Azure MFA Server and User Portal servers have several prerequisites and must have connectivity to the Internet. - -### Primary MFA Server - -The Azure MFA server uses a primary and secondary replication model for its configuration database. The primary Azure MFA server hosts the writable partition of the configuration database. All secondary Azure MFA servers hosts read-only partitions of the configuration database. All production environment should deploy a minimum of two MFA Servers. - -For this documentation, the primary MFA uses the name **mf*a*** or **mfa.corp.contoso.com**. All secondary servers use the name **mfa*n*** or **mfa*n*.corp.contoso.com**, where *n* is the number of the deployed MFA server. - -The primary MFA server is also responsible for synchronizing from Active Directory. Therefore, the primary MFA server should be domain joined and fully patched. - -#### Enroll for Server Authentication - -The communication between the primary MFA server, secondary MFA servers, User Portal servers, and the client is protected using TLS, which needs a server authentication certificate. - -Sign-in the primary MFA server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (mfa.corp.contoso.com). Click **Add**. Click **OK** when finished. -9. Click **Enroll**. - -A server authentication certificate should appear in the computer’s Personal certificate store. - -#### Install the Web Server Role - -The Azure MFA server does not require the Web Server role, however, User Portal and the optional Mobile Application server communicate with the MFA server database using the MFA Web Services SDK. The MFA Web Services SDK uses the Web Server role. - -To install the Web Server (IIS) role, please follow [Installing IIS 7 on Windows Server 2008 or Windows Server 2008 R2](https://docs.microsoft.com/iis/install/installing-iis-7/installing-iis-7-and-above-on-windows-server-2008-or-windows-server-2008-r2) or [Installing IIS 8.5 on Windows Server 2012 R2](https://docs.microsoft.com/iis/install/installing-iis-85/installing-iis-85-on-windows-server-2012-r2) depending on the host Operating System you're going to use. - -The following services are required: -* Common Parameters > Default Document. -* Common Parameters > Directory Browsing. -* Common Parameters > HTTP Errors. -* Common Parameters > Static Content. -* Health and Diagnostics > HTTP Logging. -* Performance > Static Content Compression. -* Security > Request Filtering. -* Security > Basic Authentication. -* Management Tools > IIS Management Console. -* Management Tools > IIS 6 Management Compatibility. -* Application Development > ASP.NET 4.5. - -#### Update the Server - -Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. - -#### Configure the IIS Server Certificate - -The TLS protocol protects all the communication to and from the MFA server. To enable this protection, you must configure the default web site to use the previously enrolled server authentication certificate. - -Sign in the primary MFA server with _administrator_ equivalent credentials. -1. From **Administrators**, Start the **Internet Information Services (IIS) Manager** console -2. In the navigation pane, expand the node with the same name as the local computer. Expand **Settings** and select **Default Web Site**. -3. In the **Actions** pane, click **Bindings**. -4. In the **Site Bindings** dialog, Click **Add**. -5. In the **Add Site Binding** dialog, select **https** from the **Type** list. In the **SSL certificate** list, select the certificate with the name that matches the FQDN of the computer. -6. Click **OK**. Click **Close**. From the **Action** pane, click **Restart**. - -#### Configure the Web Service’s Security - -The Azure MFA Server service runs in the security context of the Local System. The MFA User Portal gets its user and configuration information from the Azure MFA server using the MFA Web Services. Access control to the information is gated by membership to the **Phonefactor Admins** security group. You need to configure the Web Service’s security to ensure the User Portal and the Mobile Application servers can securely communicate to the Azure MFA Server. Also, all User Portal server administrators must be included in the **Phonefactor Admins** security group. - -Sign in the domain controller with _domain administrator_ equivalent credentials. - -##### Create Phonefactor Admin group - -1. Open **Active Directory Users and Computers** -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **Group**. -3. In the **New Object – Group** dialog box, type **Phonefactor Admins** in Group name. -4. Click **OK**. - -##### Add accounts to the Phonefactor Admins group - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select Users. In the content pane. Right-click the **Phonefactor Admins** security group and select **Properties**. -3. Click the **Members** tab. -4. Click **Add**. Click **Object Types..** In the **Object Types** dialog box, select **Computers** and click **OK**. Enter the following user and/or computers accounts in the **Enter the object names to select** box and then click **OK**. - * The computer account for the primary MFA Server - * Group or user account that will manage the User Portal server. - - -#### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: - -* Confirm the hosts of the MFA service has enrolled a server authentication certificate with the proper names. - * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: - * Certificate serial number - * Certificate thumbprint - * Common name of the certificate - * Subject alternate name of the certificate - * Name of the physical host server - * The issued date - * The expiration date - * Issuing CA Vendor (if a third-party certificate) - -* Confirm the Web Services Role was installed with the correct configuration (including Basic Authentication, ASP.NET 4.5, etc). -* Confirm the host has all the available updates from Windows Update. -* Confirm you bound the server authentication certificate to the IIS web site. -* Confirm you created the Phonefactor Admins group. -* Confirm you added the computer account hosting the MFA service to the Phonefactor Admins group and any user account who are responsible for administrating the MFA server or User Portal. - -### User Portal Server - -The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. User Portal Administrators may be set up and granted permission to add new users and update existing users. - -The User Portal web site uses the user database that is synchronized across the MFA Servers, which enables a design to support multiple web servers for the User Portal and those servers can support internal and external customers. While the user portal web site can be installed directly on the MFA server, it is recommended to install the User Portal on a server separate from the MFA Server to protect the MFA user database, as a layered, defense-in-depth security design. - -#### Enroll for Server Authentication - -Internal and external users use the User Portal to manage their multifactor authentication settings. To protect this communication, you need to enroll all User Portal servers with a server authentication certificate. You can use an enterprise certificate to protect communication to internal User Portal servers. - -For external User Portal servers, it is typical to request a server authentication certificate from a public certificate authority. Contact a public certificate authority for more information on requesting a certificate for public use. Follow the procedures below to enroll an enterprise certificate on your User Portal server. - -Sign-in the User Portal server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (app1.corp.contoso.com). -9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your User Portal service (mfaweb.corp.contoso.com). -10. Click **Add**. Click **OK** when finished. -11. Click **Enroll**. - -A server authentication certificate should appear in the computer’s Personal certificate store. - -#### Install the Web Server Role - -To do this, please follow the instructions mentioned in the previous [Install the Web Server Role](#install-the-web-server-role) section. However, do **not** install Security > Basic Authentication. The user portal server does not require this. - -#### Update the Server - -Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. - -#### Set the IIS Server Certificate - -To do this, please follow the instructions mentioned in the previous [Configure the IIS Server’s Certificate](#configure-the-iis-server-certificate) section. - -#### Create WebServices SDK user account - -The User Portal and Mobile Application web services need to communicate with the configuration database hosted on the primary MFA server. These services use a user account to communicate to authenticate to the primary MFA server. You can think of the WebServices SDK account as a service account used by other servers to access the WebServices SDK on the primary MFA server. - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **User**. -3. In the **New Object – User** dialog box, type **PFWSDK_\** in the **First name** and **User logon name** boxes, where *\* is the name of the primary MFA server running the Web Services SDK. Click **Next**. -4. Type a strong password and confirm it in the respective boxes. Clear **User must change password at next logon**. Click **Next**. Click **Finish** to create the user account. - -#### Add the MFA SDK user account to the Phonefactor Admins group - -Adding the WebServices SDK user account to the Phonefactor Admins group provides the user account with the proper authorization needed to access the configuration data on the primary MFA server using the WebServices SDK. - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select **Users**. In the content pane. Right-click the **Phonefactor Admins** security group and select Properties. -3. Click the Members tab. -4. Click **Add**. Click **Object Types..** Type the PFWSDK_\ user name in the **Enter the object names to select** box and then click **OK**. - * The computer account for the primary MFA Server - * The Webservices SDK user account - * Group or user account that will manage the User Portal server. - - -#### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: - -* Confirm the hosts of the user portal are properly configure for load balancing and high-availability. -* Confirm the hosts of the user portal have enrolled a server authentication certificate with the proper names. - * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: - * Certificate serial number - * Certificate thumbprint - * Common name of the certificate - * Subject alternate name of the certificate - * Name of the physical host server - * The issued date - * The expiration date - * Issuing CA Vendor (if a third-party certificate) - -* Confirm the Web Server Role was properly configured on all servers. -* Confirm all the hosts have the latest updates from Windows Update. -* Confirm you created the web service SDK domain account and the account is a member of the Phonefactor Admins group. - -## Installing Primary Azure MFA Server - -When you install Azure Multi-Factor Authentication Server, you have the following options: -1. Install Azure Multi-Factor Authentication Server locally on the same server as AD FS -2. Install the Azure Multi-Factor Authentication adapter locally on the AD FS server, and then install Multi-Factor Authentication Server on a different computer (preferred deployment for production environments) - -See [Configure Azure Multi-Factor Authentication Server to work with AD FS in Windows Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12) to view detailed installation and configuration options. - -Sign-in the federation server with _Domain Admin_ equivalent credentials and follow [To install and configure the Azure Multi-Factor Authentication server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#to-install-and-configure-the-azure-multi-factor-authentication-server) for an express setup with the configuration wizard. You can re-run the authentication wizard by selecting it from the Tools menu on the server. - ->[!IMPORTANT] ->Only follow the above mention article to install Azure MFA Server. Once it is intstalled, continue configuration using this article. - -### Configuring Company Settings - -You need to configure the MFA server with the default settings it applies to each user account when it is imported or synchronized from Active Directory. - -Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. -1. Start the **Multi-Factor Server** application -2. Click **Company Settings**. -3. On the **General** Tab, select **Fail Authentication** from the **When internet is not accessible** list. -4. In **User defaults**, select **Phone Call** or **Text Message** - **Note:** You can use the mobile application; however, the configuration is beyond the scope of this document. Read [Getting started the MFA Server Mobile App Web Service](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice) to configure and use mobile application multi-factor authentication or the Install User Portal topic in the Multi-Factor Server help. -5. Select **Enable Global Services** if you want to allow Multi-Factor Authentications to be made to telephone numbers in rate zones that have an associated charge. -6. Clear the **User can change phone** check box to prevent users from changing their phone during the Multi-Factor Authentication call or in the User Portal. A consistent configuration is for users to change their phone numbers in Active Directory and let those changes synchronize to the multi-factor server using the Synchronization features in Directory Integration. -7. Select **Fail Authentication** from the **When user is disabled** list. Users should provision their account through the user portal. -8. Select the appropriate language from the **Phone call language**, **Text message language**, **Mobile app language**, and **OATH token language** lists. -9. Under default PIN rules, Select the User can change PIN check box to enable users to change their PIN during multi-factor authentication and through the user portal. -10. Configure the minimum length for the PIN. -11. Select the **Prevent weak PINs** check box to reject weak PINs. A weak PIN is any PIN that could be easily guessed by a hacker: 3 sequential digits, 3 repeating digits, or any 4 digit subset of user phone number are not allowed. If you clear this box, then there are no restrictions on PIN format. For example: User tries to reset PIN to 1235 and is rejected because it's a weak PIN. User will be prompted to enter a valid PIN. -12. Select the **Expiration days** check box if you want to expire PINs. If enabled, provide a numeric value representing the number of days the PIN is valid. -13. Select the **PIN history** check box if you want to remember previously used PINs for the user. PIN History stores old PINs for each user. Users are not allowed to reset their PIN to any value stored in their PIN History. When cleared, no PIN History is stored. The default value is 5 and range is 1 to 10. - -![Azure MFA Server Company settings configured](images/hello-mfa-company-settings.png) - -### Configuring Email Settings and Content - -If you are deploying in a lab or proof-of-concept, then you have the option of skipping this step. In a production environment, ideally, you’ll want to setup the Azure Multifactor Authentication Server and its user portal web interface prior to sending the email. The email gives your users time to visit the user portal and configure the multi-factor settings. - -Now that you have imported or synchronized with your Azure Multi-Factor Authentication server, it is advised that you send your users an email that informs them that they have been enrolled in multi-factor authentication. - -With the Azure Multi-Factor Authentication Server there are various ways to configure your users for using multi-factor authentication. For instance, if you know the users’ phone numbers or were able to import the phone numbers into the Azure Multi-Factor Authentication Server from their company’s directory, the email will let users know that they have been configured to use Azure Multi-Factor Authentication, provide some instructions on using Azure Multi-Factor Authentication and inform the user of the phone number they will receive their authentications on. - -The content of the email will vary depending on the method of authentication that has been set for the user (e.g. phone call, SMS, mobile application). For example, if the user is required to use a PIN when they authenticate, the email will tell them what their initial PIN has been set to. Users are usually required to change their PIN during their first authentication. - -If users’ phone numbers have not been configured or imported into the Azure Multi-Factor Authentication Server, or users are pre-configured to use the mobile application for authentication, you can send them an email that lets them know that they have been configured to use Azure Multi-Factor Authentication and it will direct them to complete their account enrollment through the Azure Multi-Factor Authentication User Portal. A hyperlink will be included that the user clicks on to access the User Portal. When the user clicks on the hyperlink, their web browser will open and take them to their company’s Azure Multi-Factor Authentication User Portal. - -#### Settings - -By clicking the email icon on the left you can setup the settings for sending these emails. This is where you can enter the SMTP information of your mail server and it allows you to send a blanket wide email by adding a check to the Send mails to users check box. - -#### Content - -On the Email Content tab, you will see all of the various email templates that are available to choose from. So, depending on how you have configured your users to use multi-factor authentication, you can choose the template that best suits you. - -##### Edit the Content Settings - -The Azure MFA server does not send emails, even when configured to do so, until you configured the sender information for each email template listed in the Content tab. - -Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. Click **Email** from the list of icons and click the **Email Content** tab. -3. Select an email template from the list of templates. Click **Edit**. -4. In the **Edit Email** dialog, in the **From** text box, type the email address of the person or group that should appear to have sent the email. - ![Edit email dialog within content settings](images/hello-mfa-content-edit-email.png) - -5. Optionally, customize other options in the email template. -6. When finished editing the template, Click **Apply**. -7. Click **Next** to move to the next email in the list. Repeat steps 4 and 6 to edit the changes. -8. Click **Close** when you are done editing the email templates. - -### Configuring Directory Integration Settings and Synchronization - -Synchronization keeps the Multi-Factor Authentication user database synchronized with the users in Active Directory or another LDAP Lightweight Directory Access Protocol directory. The process is similar to Importing Users from Active Directory, but periodically polls for Active Directory user and security group changes to process. It also provides for disabling or removing users removed from a container or security group and removing users deleted from Active Directory. - -It is important to use a different group memberships for synchronizing users from Active Directory and for enabling Windows Hello for Business. Keeping the group memberships separated enables you to synchronize users and configure MFA options without immediately deploying Windows Hello for Business to that user. This deployment approach provides the maximum flexibility, which gives users the ability to configure their settings before they provision Windows Hello for Business. To start provisioning, simply add the group used for synchronization to the Windows Hello for Business Users group (or equivalent if you use custom names). - -#### MultiFactorAuthAdSync Service - -The MultiFactorAuthAdSync service is a Windows service that performs the periodic polling of Active Directory. It is installed in a Stopped state and is started by the MultiFactorAuth service when configured to run. If you have a multi-server Multi-Factor Authentication configuration, the MultiFactorAuthAdSync may only be run on a single server. - -The MultiFactorAuthAdSync service uses the DirSync LDAP server extension provided by Microsoft to efficiently poll for changes. This DirSync control caller must have the "directory get changes" right and DS-Replication-Get-Changes extended control access right. By default, these rights are assigned to the Administrator and LocalSystem accounts on domain controllers. The MultiFactorAuthAdSync service is configured to run as LocalSystem by default. Therefore, it is simplest to run the service on a domain controller. The service can run as an account with lesser permissions if you configure it to always perform a full synchronization. This is less efficient, but requires less account privileges. - -#### Settings - -Configuring the directory synchronization between Active Directory and the Azure MFA server is easy. - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. -3. Click the **Synchronization** tab. -4. Select **Use Active Directory**. -5. Select **Include trusted domains** to have the Multi-Factor Authentication Server attempt to connect to domains trusted by the current domain, another domain in the forest, or domains involved in a forest trust. When not importing or synchronizing users from any of the trusted domains, clear the check box to improve performance. - -#### Synchronization - -The MFA server uses synchronization items to synchronize users from Active Directory to the MFA server database. Synchronization items enables you to synchronize a collection of users based security groups or Active Directory containers. - -You can configure synchronization items based on different criteria and filters. For the purpose of configuring Windows Hello for Business, you need to create a synchronization item based membership of the Windows Hello for Business user group. This ensures the same users who receive Windows Hello for Business policy settings are the same users synchronized to the MFA server (and are the same users with permission to enroll in the certificate). This significantly simplifies deployment and troubleshooting. - -See [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint) for more details. - -##### To add a synchronization item - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. -3. Select the **Synchronization** tab. -4. On the **Synchronization** tab, click **Add**. - ![Azure MFA Server - add synchronization item screen](images/hello-mfa-sync-item.png) - -5. In the **Add Synchronization Item** dialog, select **Security Groups** from the **View** list. -6. Select the group you are using for replication from the list of groups -7. Select **Selected Security Groups – Recursive** or, select **Security Group** from the **Import** list if you do not plan to nest groups. -8. Select **Add new users and Update existing users**. -9. Select **Disable/Remove users no longer a member** and select **Disable** from the list. -10. Select the attributes appropriate for your environment for **Import phone** and **Backup**. -11. Select **Enabled** and select **Only New Users with Phone Number** from the list. -12. Select **Send email** and select **New and Updated Users**. - -##### Configure synchronization item defaults - -1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Method Defaults** tab. -2. Select the default second factor authentication method. For example, if the second factor of authentication is a text message, select **Text message**. Select if the direction of text message authentication and if the authentication should use a one-time password or one-time password and PIN (Ensure users are configured to create a PIN if the default second factor of communication requires a PIN). - -##### Configure synchronization language defaults - -1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Language Defaults** tab. -2. Select the appropriate default language for these groups of users synchronized by these synchronization item. -3. If creating a new synchronization item, click **Add** to save the item. If editing an existing synchronization item, click **Apply** and then click **Close**. - ->[!TIP] ->For more information on these settings and the behaviors they control, see [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint). - -### Installing the MFA Web Services SDK - -The Web Service SDK section allows the administrator to install the Multi-Factor Authentication Web Service SDK. The Web Service SDK is an IIS (Internet Information Server) web service that provides an interface for integrating the full features of the Multi-Factor Authentication Server into most any application. The Web Service SDK uses the Multi-Factor Authentication Server as the data store. - -Remember the Web Services SDK is only need on the primary Multi-Factor to easily enable other servers access to the configuration information. The prerequisites section guided you through installing and configuring the items needed for the Web Services SDK, however the installer will validate the prerequisites and make suggest any corrective action needed. - -Please follow the instructions under [Install the web service SDK](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice#install-the-web-service-sdk) to install the MFA Web Services SDK. - -## Install Secondary MFA Servers - -Additional MFA servers provided redundancy of the MFA configuration. The MFA server models uses one primary MFA server with multiple secondary servers. Servers within the same group establish communication with the primary server for that group. The primary server replicates to each of the secondary servers. You can use groups to partition the data stored on different servers, for example you can create a group for each domain, forest, or organizational unit. - -Follow the same procedures for installing the primary MFA server software for each additional server. Remember that each server must be activated. - -Sign in the secondary MFA server with _domain administrator_ equivalent credentials. -1. Once the Multi-Factor Authentication Server console starts, you must configure the current server’s replication group membership. You have the option to join an existing group or create a new group. When joining an existing group, the server becomes a secondary server in the existing replication group. When creating a new group, the server becomes the primary server of that replication group. Click **OK**. - **Note:** Group membership cannot be changed after activation. If a server was joined to the wrong group, it must be activated again to join a different group. Please contact support for assistance with deactivating and reactivating a server. -2. The console asks you if you want to enable replication by running the **Multi-Server Configuration Wizard**. Click **Yes**. -3. In the **Multi-Server Configuration Wizard**, leave **Active Directory** selected and clear **Certificates**. Click **Next**. -4. On the **Active Directory** page, the wizard determines what configuration is needed to enable replication. Typically, the wizard recommends adding the computer account for the current server to the **PhoneFactor Admin** group. Click **Next** to add the computer account to the group. -5. On the **Multi-Server Configuration Complete** page, click **Finish** to reboot the computer to update its group membership. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm you downloaded the latest Azure MFA Server from the Azure Portal. -* Confirm the server has Internet connectivity. -* Confirm you installed and activated the Azure MFA Server. -* Confirm your Azure MFA Server configuration meets your organization’s needs (Company Settings, Email Settings, etc). -* Confirm you created Directory Synchronization items based on your deployment to synchronize users from Active Directory to the Azure MFA server. - * For example, you have security groups representing each collection of users that represent a phase of your deployment and a corresponding synchronization item for each of those groups. - -* Confirm the Azure MFA server properly communicates with the Azure MFA cloud service by testing multifactor authentication with a newly synchronized user account. -* Confirm you installed the Web Service SDK on the primary MFA server. -* Confirm your MFA servers have adequate redundancy, should you need to promote a secondary server to the primary server. - - -## Installing the User Portal Server - -You previously configured the User Portal settings on the primary MFA server. The User Portal web application communicates to the primary MFA server using the Web Services SDK to retrieve these settings. This configuration is ideal to ensure you can scale up the User Portal application to meet the needs of your internal users. - -### Copying the User Portal Installation file - -Sign in the primary MFA server with _local administrator_ equivalent credentials. -1. Open Windows Explorer. -2. Browse to the C:\Program Files\MultiFactor Authentication Server folder. -3. Copy the **MultiFactorAuthenticationUserPortalSetup64.msi** file to a folder on the User Portal server. - -### Configure Virtual Directory name - -Sign in the User Portal server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to the folder to which you saved the installation file from the previous step. -2. Run the **MultiFactorAuthenticationUserPortalSetup64.msi**. The installation package asks if you want to download **Visual Studio C++ Redistributable for Visual Studio 2015**. Click **Yes**. When prompted, select **Save As**. The downloaded file is missing its file extension. **Save the file with a .exe extension and install the runtime**. -3. Run the installation package again. The installer package asks about the C++ runtime again; however, this is for the X64 version (the previous prompt was for x86). Click **Yes** to download the installation package and select **Save As** so you can save the downloaded file with a .exe extension. **Install** the run time. -4. Run the User Portal installation package. On the **Select Installation Address** page, use the default settings for **Site** and **Application Pool** settings. You can modify the Virtual directory to use a name that is more fitting for the environment, such as **mfa** (This virtual directory must match the virtual directory specified in the User Portal settings). Click **Next**. -5. Click **Close**. - -### Edit MFA User Portal config file - -Sign in the User Portal server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to C:\inetpub\wwwroot\MultiFactorAuth (or appropriate directory based on the virtual directory name) and edit the **web.config** file. -2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. -3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. -4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. -5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from **“** to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. ). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the Internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **web.config** file after changes have been made. - -### Create a DNS entry for the User Portal web site - -Sign-in the domain controller or administrative workstation with _Domain Admin_ equivalent credentials. -1. Open the **DNS Management** console. -2. In the navigation pane, expand the domain controller name node and **Forward Lookup Zones**. -3. In the navigation pane, select the node that has the name of your internal Active Directory domain name. -4. In the navigation pane, right-click the domain name node and click **New Host (A or AAAA)**. -5. In the **name** box, type the host name of the User Portal, such as *mfaweb* (this name must match the name of the certificate used to secure communication to the User Portal). In the IP address box, type the load balanced **IP address** of the User Portal. Click **Add Host**. -6. Close the **DNS Management** console. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the user portal application is properly installed on all user portal hosts -* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. -* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME -* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. -* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. -* Confirm you saved the changes to the web.config file. - -### Validating your work - -Windows Hello for Business is a distributed system, which on the surface appears complex and difficult. The key to a successful Windows Hello for Business deployment is to validate phases of work prior to moving to the next phase. - -Using a web browser, navigate to the URL provided in the *pf_up_pfwssdk_PfWsSdk* named value in the web.config file of any one of the user portal servers. The URL should be protected by a server authentication certificate and should prompt you for authentication. Authenticate to the web site using the username and password provided in the web.config file. Successful authentication and page view confirms the Web SDK configured on the primary MFA server is correctly configured and ready to work with the user portal. - -### Configuring the User Portal - -The User Portal section allows the administrator to install and configure the Multi-Factor Authentication User Portal. The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. -User Portal Administrators may be set up and granted permission to add new users and update existing users. - -#### Settings - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the Multi-Factor Authentication Server console. -2. From the Multi-Factor Authentication Server window, click the User Portal icon. - ![Azure MFA Server - User Portal settings](images/hello-mfa-user-portal-settings.png) - -3. On the Settings tab, type the URL your users use to access the User Portal. The URL should begin with https, such as `https://mfaportal.corp.contoso.com/mfa`. -The Multi-Factor Authentication Server uses this information when sending emails to users. -4. Select Allow users to log in and Allow user enrollment check boxes. -5. Select Allow users to select method. Select Phone call and select Text message (you can select Mobile application later once you have deployed the Mobile application web service). Select Automatically trigger user’s default method. -6. Select Allow users to select language. -7. Select Use security questions for fallback and select 4 from the Questions to answer list. - ->[!TIP] ->For more information on these settings and the behaviors they control, see [Deploy the user portal for the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal). - -#### Administrators - -The User Portal Settings tab allows the administrator to install and configure the User Portal. -1. Open the Multi-Factor Authentication Server console. -2. From the Multi-Factor Authentication Server window, click the User Portal icon. -3. On the Administrators tab, Click Add -4. In the Add Administrator dialog, Click Select User… to pick a user to install and manage the User Portal. Use the default permissions. -5. Click Add. - ->[!TIP] ->For more information on these settings and the behaviors they control, read the **Multi-Factor Authentication Server Help content**. - -#### Security Questions - -[Security questions](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#security-questions) for the User Portal may be customized to meet your requirements. The questions defined here will be offered as options for each of the four security questions a user is prompted to configure during their first log on to User Portal. The order of the questions is important since the first four items in the list will be used as defaults for the four security questions. - -#### Trusted IPs - -The [Trusted IPs](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#trusted-ips) tab allows you to skip Multi-Factor Authentication for User Portal log ins originating from specific IPs. For example, if users use the User Portal from the office and from home, you may decide you don't want their phones ringing for Multi-Factor Authentication while at the office. For this, you would specify the office subnet as a trusted IP entry. - -## Configure the AD FS Server to use the MFA for multifactor authentication - -You need to configure the AD FS server to use the MFA server. You do this by Installing the MFA Adapter on the primary AD FS Server. - -### Install the MFA AD FS Adapter - -Follow [Install a standalone instance of the AD FS adapter by using the Web Service SDK](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12#install-a-standalone-instance-of-the-ad-fs-adapter-by-using-the-web-service-sdk). You should follow this instructions on all AD FS servers. You can find the files needed on the MFA server. - -### Edit the MFA AD FS Adapter config file on all ADFS Servers - -Sign in the primary AD FS server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to **C:\inetpub\wwwroot\MultiFactorAuth** (or appropriate directory based on the virtual directory name) and edit the **MultiFactorAuthenticationAdfsAdapter.config** file. -2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. -3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. -4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. -5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from “ to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. ). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the Internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **MultiFactorAuthenticationAdfsAdapter.config** file after changes have been made. - -### Edit the AD FS Adapter Windows PowerShell cmdlet - -Sign in the primary AD FS server with _local administrator_ equivalent credentials. - -Edit the **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script adding `-ConfigurationFilePath ` to the end of the `Register-AdfsAuthenticationProvider` command where **\** is the full path to the **MultiFactorAuthenticationAdfsAdapter.config** file. - -### Run the AD FS Adapter PowerShell cmdlet - -Sign in the primary AD FS server with local administrator equivalent credentials. - -Run **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script in PowerShell to register the adapter. The adapter is registered as **WindowsAzureMultiFactorAuthentication**. - ->[!NOTE] ->You must restart the AD FS service for the registration to take effect. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the user portal application is properly installed on all user portal hosts -* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. -* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME -* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. -* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. -* Confirm you saved the changes to the web.config file. -* Confirm you restarted the AD FS Service after completing the configuration. - -## Test Multifactor Authentication - -Now, you should test your Azure Multi-Factor Authentication server configuration before proceeding any further in the deployment. The AD FS and Azure Multi-Factor Authentication server configurations are complete. - -1. In the **Multi-Factor Authentication** server, on the left, click **Users**. -2. In the list of users, select a user that is enabled and has a valid phone number to which you have access. -3. Click **Test**. -4. In the **Test User** dialog, provide the user’s password to authenticate the user to Active Directory. - -The Multi-Factor Authentication server communicates with the Azure MFA cloud service to perform a second factor authentication for the user. The Azure MFA cloud service contacts the phone number provided and asks for the user to perform the second factor authentication configured for the user. Successfully providing the second factor should result in the Multi-factor authentication server showing a success dialog. - - -## Follow the Windows Hello for Business on premises certificate trust deployment guide -1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) -2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) -3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) -4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md index 00344d3bd5..c9b80af1e6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md @@ -24,7 +24,7 @@ ms.reviewer: - Certificate trust -You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md index 13beb24a52..ff7f5deec6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md @@ -16,36 +16,19 @@ localizationpriority: medium ms.date: 08/19/2018 ms.reviewer: --- -# Validate and Deploy Multifactor Authentication Services (MFA) +# Validate and Deploy Multi-factor Authentication (MFA) **Applies to** -- Windows 10, version 1703 or later -- On-premises deployment -- Certificate trust +- Windows 10, version 1703 or later +- On-premises deployment +- Certificate trust -Windows Hello for Business requires all users perform multi-factor authentication prior to creating and registering a Windows Hello for Business credential. Windows Hello for Business deployments use Azure Multi-Factor Authentication (Azure MFA) services for the secondary authentication. On-Premises deployments use Azure MFA server, an on-premises implementation that do not require synchronizing Active Directory credentials to Azure Active Directory. +Windows Hello for Business requires all users perform multi-factor authentication prior to creating and registering a Windows Hello for Business credential. On-premises deployments can use certificates, third-party authentication providers for AD FS, or a custom authentication provider for AD FS as an on-premises MFA option. -Azure Multi-Factor Authentication is an easy to use, scalable, and reliable solution that provides a second method of authentication so your users are always protected. -* **Easy to Use** - Azure Multi-Factor Authentication is simple to set up and use. The extra protection that comes with Azure Multi-Factor Authentication allows users to manage their own devices. Best of all, in many instances it can be set up with just a few simple clicks. -* **Scalable** - Azure Multi-Factor Authentication uses the power of the cloud and integrates with your on-premises AD and custom applications. This protection is even extended to your high-volume, mission-critical scenarios. -* **Always Protected** - Azure Multi-Factor Authentication provides strong authentication using the highest industry standards. -* **Reliable** - We guarantee 99.9% availability of Azure Multi-Factor Authentication. The service is considered unavailable when it is unable to receive or process verification requests for the two-step verification. +For information on available third-party authentication methods see [Configure Additional Authentication Methods for AD FS](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs). For creating a custom authentication method see [Build a Custom Authentication Method for AD FS in Windows Server](https://docs.microsoft.com/windows-server/identity/ad-fs/development/ad-fs-build-custom-auth-method) -## On-Premises Azure MFA Server - -On-premises deployments, both key and certificate trust, use the Azure MFA server where the credentials are not synchronized to Azure Active Directory. - -### Infrastructure - -A lab or proof-of-concept environment does not need high-availability or scalability. However, a production environment needs both of these. Ensure your environment considers and incorporates these factors, as necessary. All production environments should have a minimum of two MFA servers—one primary and one secondary server. The environment should have a minimum of two User Portal Servers that are load balanced using hardware or Windows Network Load Balancing. - -Please follow [Download the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#download-the-azure-multi-factor-authentication-server) to download Azure MFA server. - ->[!IMPORTANT] ->Make sure to validate the requirements for Azure MFA server, as outlined in [Install and Configure the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#install-and-configure-the-azure-multi-factor-authentication-server) before proceeding. Do not use installation instructions provided in the article. - -Once you have validated all the requirements, please proceed to [Configure or Deploy Multifactor Authentication Services](hello-cert-trust-deploy-mfa.md). +Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multi-factor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-authentication-policies). ## Follow the Windows Hello for Business on premises certificate trust deployment guide 1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md index 48fdad4ba0..2e79df76db 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md @@ -85,8 +85,8 @@ Sign-in to a certificate authority or management workstations with _Enterprise A 3. In the **Certificate Templates Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. 4. Click the **Superseded Templates** tab. Click **Add**. 5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. -6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **Add**. -7. From the **Add Superseded Template** dialog, select the **Kerberos Authentication** certificate template and click **Add**. +6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. Click **Add**. +7. From the **Add Superseded Template** dialog, select the **Kerberos Authentication** certificate template and click **OK**. Click **Add**. 8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. 9. Click **OK** and close the **Certificate Templates** console. diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md index ffee400b8c..72257804e5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md @@ -21,7 +21,6 @@ ms.reviewer: **Applies to** - Windows 10, version 1703 or later - Windows Hello for Business is the springboard to a world without passwords. It replaces username and password sign-in to Windows with strong user authentication based on an asymmetric key pair. This deployment guide is to guide you through deploying Windows Hello for Business, based on the planning decisions made using the Planning a Windows Hello for Business Deployment Guide. It provides you with the information needed to successfully deploy Windows Hello for Business in an existing environment. @@ -52,16 +51,18 @@ The trust model determines how you want users to authenticate to the on-premises * The certificate-trust model is for enterprise that *do* want to issue end-entity certificates to their users and have the benefits of certificate expiration and renewal, similar to how smart cards work today. * The certificate trust model also supports enterprises which are not ready to deploy Windows Server 2016 Domain Controllers. ->[!NOTE] ->RDP does not support authentication with Windows Hello for business key trust deployments. RDP is only supported with certificate trust deployments at this time. +> [!NOTE] +> Remote Desktop Protocol (RDP) does not support authentication with Windows Hello for Business key trust deployments. RDP is only supported with certificate trust deployments at this time. See [Remote Desktop](hello-feature-remote-desktop.md) to learn more. -Following are the various deployment guides included in this topic: +Following are the various deployment guides and models included in this topic: - [Hybrid Azure AD Joined Key Trust Deployment](hello-hybrid-key-trust.md) - [Hybrid Azure AD Joined Certificate Trust Deployment](hello-hybrid-cert-trust.md) - [Azure AD Join Single Sign-on Deployment Guides](hello-hybrid-aadj-sso.md) - [On Premises Key Trust Deployment](hello-deployment-key-trust.md) - [On Premises Certificate Trust Deployment](hello-deployment-cert-trust.md) +> [!NOTE] +> For Windows Hello for Business hybrid [certificate trust prerequisites](hello-hybrid-cert-trust-prereqs.md#directory-synchronization) and [key trust prerequisites](hello-hybrid-key-trust-prereqs.md#directory-synchronization) deployments, you will need Azure Active Directory Connect to synchronize user accounts in the on-premises Active Directory with Azure Active Directory. For on-premises deployments, both key and certificate trust, use the Azure MFA server where the credentials are not synchronized to Azure Active Directory. Learn how to [deploy Multifactor Authentication Services (MFA) for key trust](hello-key-trust-validate-deploy-mfa.md) and [for certificate trust](hello-cert-trust-validate-deploy-mfa.md) deployments. ## Provisioning diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index 8eecd51ab4..5738d0e7ff 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -187,12 +187,17 @@ If the error occurs again, check the error code against the following table to s                         - - + + + + + + + - + diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.md b/windows/security/identity-protection/hello-for-business/hello-faq.md index d1ba25aae2..0cfbf47cc6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.md +++ b/windows/security/identity-protection/hello-for-business/hello-faq.md @@ -22,7 +22,7 @@ ms.reviewer: - Windows 10 ## What about virtual smart cards? -Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future but not date at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends new Windows 10 deployments to use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8. +Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date is set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends new Windows 10 deployments to use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8. ## What about convenience PIN? Microsoft is committed to its vision of a world without passwords. We recognize the *convenience* provided by convenience PIN, but it stills uses a password for authentication. Microsoft recommends customers using Windows 10 and convenience PINs should move to Windows Hello for Business. New Windows 10 deployments should deploy Windows Hello for Business and not convenience PINs. Microsoft will be deprecating convenience PINs in the future and will publish the date early to ensure customers have adequate lead time to deploy Windows Hello for Business. @@ -45,7 +45,7 @@ The statement "PIN is stronger than Password" is not directed at the strength of The **Key Admins** and **Enterprise Key Admins** groups are created when you install the first Windows Server 2016 domain controller into a domain. Domain controllers running previous versions of Windows Server cannot translate the security identifier (SID) to a name. To resolve this, transfer the PDC emulator domain role to a domain controller running Windows Server 2016. ## Can I use a convenience PIN with Azure AD? -It is currently possible to set a convience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convience PIN is not supported for Azure Active Directory user accounts. It is only supported for on-premises only Domain Joined users and local account users. +It is currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN is not supported for Azure Active Directory user accounts. It is only supported for on-premises only Domain Joined users and local account users. ## Can I use an external camera when my laptop is closed or docked? No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further. @@ -80,7 +80,7 @@ If your environment uses Microsoft Intune, you need these additional URLs: - portal.manage.microsoft.com ## What is the difference between non-destructive and destructive PIN reset? -Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once on-boarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provided a second factor of authentication, and reset their PIN without re-provisioning a new Windows Hello for Business enrollment. This is a non-destructive PIN reset because the user does not delete the current credential and obtain a new one. Read [PIN Reset](hello-features.md#pin-reset) from our [Windows Hello for Business Features](hello-features.md) page for more information. +Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once on-boarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provided a second factor of authentication, and reset their PIN without re-provisioning a new Windows Hello for Business enrollment. This is a non-destructive PIN reset because the user does not delete the current credential and obtain a new one. Read [PIN Reset](hello-feature-pin-reset.md) page for more information. Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. with destructive PIN reset, users that have forgotten their PIN can authenticate using their password, perform a second factor of authentication to re-provision their Windows Hello for Business credential. Re-provisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. Also, for hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services. diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md new file mode 100644 index 0000000000..4b08f7b6f1 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md @@ -0,0 +1,45 @@ +--- +title: Conditional Access +description: Conditional Access +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, conditional access +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# Conditional access + +**Requirements:** + +* Azure Active Directory +* Hybrid Windows Hello for Business deployment + +In a mobile-first, cloud-first world, Azure Active Directory enables single sign-on to devices, applications, and services from anywhere. With the proliferation of devices (including BYOD), work off corporate networks, and 3rd party SaaS applications, IT professionals are faced with two opposing goals: + +* Empower the end users to be productive wherever and whenever +* Protect the corporate assets at any time + +To improve productivity, Azure Active Directory provides your users with a broad range of options to access your corporate assets. With application access management, Azure Active Directory enables you to ensure that only the right people can access your applications. What if you want to have more control over how the right people are accessing your resources under certain conditions? What if you even have conditions under which you want to block access to certain applications even for the right people? For example, it might be OK for you if the right people are accessing certain applications from a trusted network; however, you might not want them to access these applications from a network you don't trust. You can address these questions using conditional access. + +Read [Conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal) to learn more about Conditional Access. Afterwards, read [Getting started with conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal-get-started) to start deploying Conditional access. + +## Related topics + +* [Windows Hello for Business](hello-identity-verification.md) +* [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +* [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +* [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +* [Windows Hello and password changes](hello-and-password-changes.md) +* [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +* [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md new file mode 100644 index 0000000000..1db3c21e10 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md @@ -0,0 +1,90 @@ +--- +title: Dual Enrollment +description: Dual Enrollment +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, dual enrollment, +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# Dual Enrollment + +**Requirements** + +* Hybrid and On-premises Windows Hello for Business deployments +* Enterprise Joined or Hybrid Azure joined devices +* Windows 10, version 1709 + +> [!NOTE] +> This feature was previously known as **Privileged Credential** but was renamed to **Dual Enrollment** to prevent any confusion with the **Privileged Access Workstation** feature. + +> [!IMPORTANT] +> Dual enrollment does not replace or provide the same security as Privileged Access Workstations feature. Microsoft encourages enterprises to use the Privileged Access Workstations for their privileged credential users. Enterprises can consider Windows Hello for Business dual enrollment in situations where the Privileged Access feature cannot be used. Read [Privileged Access Workstations](https://docs.microsoft.com/windows-server/identity/securing-privileged-access/privileged-access-workstations) for more information. + +Dual enrollment enables administrators to perform elevated, administrative functions by enrolling both their non-privileged and privileged credentials on their device. + +By design, Windows 10 does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, **Allow enumeration of emulated smart card for all users**, you can configure a device to enumerate all enrolled Windows Hello for Business credentials on selected devices. + +With this setting, administrative users can sign-in to Windows 10, version 1709 using their non-privileged Windows Hello for Business credentials for normal work flow such as email, but can launch Microsoft Management Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command line applications by using **runas.exe** combined with the **/smartcard** argument. This enables administrators to perform their day-to-day operations without needing to sign-in and out, or use fast user switching when alternating between privileged and non-privileged workloads. + +> [!IMPORTANT] +> You must configure a Windows 10 computer for Windows Hello for Business dual enrollment before either user (privileged or non-privileged) provisions Windows Hello for Business. Dual enrollment is a special setting that is configured on the Windows Hello container during creation. + +## Configure Windows Hello for Business Dual Enrollment + +In this task you will + +* Configure Active Directory to support Domain Administrator enrollment +* Configure Dual Enrollment using Group Policy + +### Configure Active Directory to support Domain Administrator enrollment + +The designed Windows for Business configuration has you give the **Key Admins** (or **KeyCredential Admins** when using domain controllers prior to Windows Server 2016) group read and write permissions to the msDS-KeyCredentialsLink attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy. + +Active Directory Domain Services uses AdminSDHolder to secure privileged users and groups from unintentional modification by comparing and replacing the security on privileged users and groups to match those defined on the AdminSDHolder object on an hourly cycle. For Windows Hello for Business, your domain administrator account may receive the permissions but will they will disappear from the user object unless you give the AdminSDHolder read and write permissions to the msDS-KeyCredential attribute. + +Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. + +1. Type the following command to add the **allow** read and write property permissions for msDS-KeyCredentialLink attribute for the **Key Admins** (or **KeyCredential Admins**) group on the AdminSDHolder object.
                        +```dsacls "CN=AdminSDHolder,CN=System,DC=domain,DC=com" /g "[domainName\keyAdminGroup]":RPWP;msDS-KeyCredentialLink```
                        +where **DC=domain,DC=com** is the LDAP path of your Active Directory domain and **domainName\keyAdminGroup]** is the NetBIOS name of your domain and the name of the group you use to give access to keys based on your deployment. For example:
                        +```dsacls "CN=AdminSDHolder,CN=System,DC=corp,DC=mstepdemo,DC=net" /g "mstepdemo\Key Admins":RPWP;msDS-KeyCredentialLink``` +2. To trigger security descriptor propagation, open **ldp.exe**. +3. Click **Connection** and select **Connect...** Next to **Server**, type the name of the domain controller that holds the PDC role for the domain. Next to **Port**, type **389** and click **OK**. +4. Click **Connection** and select **Bind...** Click **OK** to bind as the currently signed-in user. +5. Click **Browser** and select **Modify**. Leave the **DN** text box blank. Next to **Attribute**, type **RunProtectAdminGroupsTask**. Next to **Values**, type **1**. Click **Enter** to add this to the **Entry List**. +6. Click **Run** to start the task. +7. Close LDP. + +### Configuring Dual Enrollment using Group Policy + +You configure Windows 10 to support dual enrollment using the computer configuration portion of a Group Policy object. + +1. Using the Group Policy Management Console (GPMC), create a new domain-based Group Policy object and link it to an organizational Unit that contains Active Directory computer objects used by privileged users. +2. Edit the Group Policy object from step 1. +3. Enable the **Allow enumeration of emulated smart cards for all users** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. +4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. +5. Restart computers targeted by this Group Policy object. + +The computer is ready for dual enrollment. Sign-in as the privileged user first and enroll for Windows Hello for Business. Once completed, sign-out and sign-in as the non-privileged user and enroll for Windows Hello for Business. You can now use your privileged credential to perform privileged tasks without using your password and without needing to switch users. + +## Related topics + +* [Windows Hello for Business](hello-identity-verification.md) +* [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +* [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +* [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +* [Windows Hello and password changes](hello-and-password-changes.md) +* [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +* [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md new file mode 100644 index 0000000000..62304559ae --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md @@ -0,0 +1,68 @@ +--- +title: Conditional Access +description: Conditional Access +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, conditional access +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# Dynamic lock + +**Requirements:** + +* Windows 10, version 1703 + +Dynamic lock enables you to configure Windows 10 devices to automatically lock when Bluetooth paired device signal falls below the maximum Received Signal Strength Indicator (RSSI) value. You configure the dynamic lock policy using Group Policy. You can locate the policy setting at **Computer Configuration\Administrative Templates\Windows Components\Windows Hello for Business**. The name of the policy is **Configure dynamic lock factors**. + +The Group Policy Editor, when the policy is enabled, creates a default signal rule policy with the following value: + +``` + + + +``` + +>[!IMPORTANT] +>Microsoft recommends using the default values for this policy settings. Measurements are relative based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. + +For this policy setting, the **type** and **scenario** attribute values are static and cannot change. The **classofDevice** is configurable but Phone is the only currently supported configuration. The attribute defaults to Phones sand uses the values from the following table: + +|Description|Value| +|:-------------|:-------:| +|Miscellaneous|0| +|Computer|256| +|Phone|512| +|LAN/Network Access Point|768| +|Audio/Video|1024| +|Peripheral|1280| +|Imaging|1536| +|Wearable|1792| +|Toy|2048| +|Health|2304| +|Uncategorized|7936| + +The **rssiMin** attribute value signal indicates the strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows 10 to lock the device once the signal strength weakens by more than measurement of 10. + +RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other. + +## Related topics + +* [Windows Hello for Business](hello-identity-verification.md) +* [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +* [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +* [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +* [Windows Hello and password changes](hello-and-password-changes.md) +* [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +* [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md new file mode 100644 index 0000000000..6e32dda47f --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -0,0 +1,127 @@ +--- +title: Pin Reset +description: Pin Reset +keywords: identity, PIN, Hello, passport, WHFB, hybrid, cert-trust, device, reset +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# PIN reset + +**Applies to:** + +- Windows 10, version 1709 or later + +## Hybrid Deployments + +**Requirements:** + +- Azure Active Directory +- Hybrid Windows Hello for Business deployment +- Azure AD registered, Azure AD joined, and Hybrid Azure AD joined +- Windows 10, version 1709 or later, **Enterprise Edition** + +The Microsoft PIN reset services enables you to help users recover who have forgotten their PIN. Using Group Policy, Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables users to reset their forgotten PIN through settings or above the lock screen without requiring re-enrollment. + +>[!IMPORTANT] +> The Microsoft PIN Reset service only works with Windows 10, version 1709 or later **Enterprise Edition**. The feature does not work with the **Pro** edition.] + +### Onboarding the Microsoft PIN reset service to your Intune tenant + +Before you can remotely reset PINs, you must on-board the Microsoft PIN reset service to your Azure Active Directory tenant, and configure devices you manage. + +### Connect Azure Active Directory with the PIN reset service + +1. Visit [Microsoft PIN Reset Service Integration website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Azure Active Directory tenant. +2. After you log in, click **Accept** to give consent for the PIN reset service to access your account.
                        +![PIN reset service application in Azure](images/pinreset/pin-reset-service-home-screen.png)
                        +3. In the Azure portal, you can verify that the Microsoft PIN reset service is integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant.
                        +![PIN reset service permissions page](images/pinreset/pin-reset-service-application.png) + +### Configure Windows devices to use PIN reset using Group Policy + +You configure Windows 10 to use the Microsoft PIN Reset service using the computer configuration portion of a Group Policy object. + +1. Using the Group Policy Management Console (GPMC), scope a domain-based Group Policy to computer accounts in Active Directory. +2. Edit the Group Policy object from step 1. +3. Enable the **Use PIN Recovery** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. +4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. + +### Configure Windows devices to use PIN reset using Microsoft Intune + +To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 custom device policy](https://docs.microsoft.com/intune/custom-settings-windows-10) to enable the feature. Configure the policy using the following Windows policy configuration service provider (CSP): + +#### Create a PIN Reset Device configuration profile using Microsoft Intune + +1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. +2. You need your tenant ID to complete the following task. You can discovery your tenant ID viewing the **Properties** of your Azure Active Directory from the Azure Portal. It will be listed under Directory ID. You can also use the following command in a command Window on any Azure AD joined or hybrid Azure AD joined computer.
                        + + ``` + dsregcmd /status | findstr -snip "tenantid" + ``` + +1. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. Click **Create profile**. +1. Type **Use PIN Recovery** in the **Name** field. Select **Windows 10 and later** from the **Platform** list. Select **Custom** from the **Profile type** list. +1. In the **Custom OMA-URI Settings** blade, Click **Add**. +1. In the **Add Row** blade, type **PIN Reset Settings** in the **Name** field. In the **OMA-URI** field, type **./Device/Vendor/MSFT/PassportForWork/*tenant ID*/Policies/EnablePinRecovery** where *tenant ID* is your Azure Active Directory tenant ID from step 2. +1. Select **Boolean** from the **Data type** list and select **True** from the **Value** list. +1. Click **OK** to save the row configuration. Click **OK** to close the Custom OMA-URI Settings blade. Click **Create to save the profile. + +#### Assign the PIN Reset Device configuration profile using Microsoft Intune + +1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. +2. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. From the list of device configuration profiles, click the profile that contains the PIN reset configuration. +3. In the device configuration profile, click **Assignments**. +4. Use the **Include** and/or **Exclude** tabs to target the device configuration profile to select groups. + +## On-premises Deployments + +**Requirements** + +* Active Directory +* On-premises Windows Hello for Business deployment +* Reset from settings - Windows 10, version 1703, Professional +* Reset above Lock - Windows 10, version 1709, Professional + +On-premises deployments provide users with the ability to reset forgotten PINs either through the settings page or from above the user's lock screen. Users must know or be provided their password for authentication, must perform a second factor of authentication, and then re-provision Windows Hello for Business. + +>[!IMPORTANT] +>Users must have corporate network connectivity to domain controllers and the federation service to reset their PINs. + +### Reset PIN from Settings + +1. Sign-in to Windows 10, version 1703 or later using an alternate credential. +2. Open **Settings**, click **Accounts**, click **Sign-in options**. +3. Under **PIN**, click **I forgot my PIN** and follow the instructions. + +#### Reset PIN above the Lock Screen + + 1. On Windows 10, version 1709, click **I forgot my PIN** from the Windows Sign-in + 2. Enter your password and press enter. + 3. Follow the instructions provided by the provisioning process + 4. When finished, unlock your desktop using your newly created PIN. + +>[!NOTE] +> Visit the [Windows Hello for Business Videos](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos.md) page and watch the [Windows Hello for Business forgotten PIN user experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience) video. + +## Related topics + +- [Windows Hello for Business](hello-identity-verification.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md new file mode 100644 index 0000000000..981587e970 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -0,0 +1,74 @@ +--- +title: Remote Desktop +description: Remote Desktop +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, remote desktop, RDP +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# Remote Desktop + +**Requirements** + +- Windows 10 +- Certificate trust deployments +- Hybrid and On-premises Windows Hello for Business deployments +- Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices +- Certificate trust deployments + +Windows Hello for Business supports using a certificate deployed to a WHFB container to a remote desktop to a server or another device. This functionality is not supported for key trust deployments. This feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. + +Microsoft continues to investigate supporting this feature for key trust deployments in a future release. + +## Remote Desktop with Biometrics + +**Requirements** + +- Hybrid and On-premises Windows Hello for Business deployments +- Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices +- Certificate trust deployments +- Biometric enrollments +- Windows 10, version 1809 + +Users using earlier versions of Windows 10 could remote desktop to using Windows Hello for Business but were limited to the using their PIN as their authentication gesture. Windows 10, version 1809 introduces the ability for users to authenticate to a remote desktop session using their Windows Hello for Business biometric gesture. The feature is on by default, so your users can take advantage of it as soon as they upgrade to Windows 10, version 1809. + +### How does it work + +Windows generates and stores cryptographic keys using a software component called a key storage provider (KSP). Software-based keys are created and stored using the Microsoft Software Key Storage Provider. Smart card keys are created and stored using the Microsoft Smart Card Key Storage Provider. Keys created and protected by Windows Hello for Business are created and stored using the Microsoft Passport Key Storage Provider. + +A certificate on a smart card starts with creating an asymmetric key pair using the Microsoft Smart Card KSP. Windows requests a certificate based on the key pair from your enterprises issuing certificate authority, which returns a certificate that is stored in the user's Personal certificate store. The private key remains on the smart card and the public key is stored with the certificate. Metadata on the certificate (and the key) store the key storage provider used to create the key (remember the certificate contains the public key). + +This same concept applies to Windows Hello for Business. Except, the keys are created using the Microsoft Passport KSP and the user's private key remains protected by the device's security module (TPM) and the user's gesture (PIN/biometric). The certificate APIs hide this complexity. When an application uses a certificate, the certificate APIs locate the keys using the saved key storage provider. The key storage providers directs the certificate APIs on which provider they use to find the private key associated with the certificate. This is how Windows knows you have a smart card certificate without the smart card inserted (and prompts you to insert the smart card). + +Windows Hello for Business emulates a smart card for application compatibility. Versions of Windows 10 prior to version 1809, would redirect private key access for Windows Hello for Business certificate to use its emulated smart card using the Microsoft Smart Card KSP, which would enable the user to provide their PIN. Windows 10, version 1809 no longer redirects private key access for Windows Hello for Business certificates to the Microsoft Smart Card KSP-- it continues using the Microsoft Passport KSP. The Microsoft Passport KSP enabled Windows 10 to prompt the user for their biometric gesture or PIN. + +### Compatibility + +Users appreciate convenience of biometrics and administrators value the security however, you may experience compatibility issues with your applications and Windows Hello for Business certificates. You can relax knowing a Group Policy setting and a [MDM URI](https://docs.microsoft.com/windows/client-management/mdm/passportforwork-csp) exist to help you revert to the previous behavior for those users who need it. + +![WHFB Certificate GP Setting](images/rdpbio/rdpbiopolicysetting.png) + +> [!IMPORTANT] +> The remote desktop with biometric feature does not work with [Dual Enrollment](hello-feature-dual-enrollment.md) feature or scenarios where the user provides alternative credentials. Microsoft continues to investigate supporting the feature. + +## Related topics + +- [Windows Hello for Business](hello-identity-verification.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-features.md b/windows/security/identity-protection/hello-for-business/hello-features.md index 1a029f2dc9..83a4dc444e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-features.md +++ b/windows/security/identity-protection/hello-for-business/hello-features.md @@ -20,247 +20,17 @@ ms.date: 05/05/2018 # Windows Hello for Business Features **Applies to:** -- Windows 10 -Consider these additional features you can use after your organization deploys Windows Hello for Business. +- Windows 10 -- [Conditional access](#conditional-access) -- [Dynamic lock](#dynamic-lock) -- [PIN reset](#pin-reset) -- [Dual Enrollment](#dual-enrollment) -- [Remote Desktop with Biometrics](#remote-desktop-with-biometrics) +Consider these additional features you can use after your organization deploys Windows Hello for Business. -## Conditional access - -**Requirements:** -* Azure Active Directory -* Hybrid Windows Hello for Business deployment - - -In a mobile-first, cloud-first world, Azure Active Directory enables single sign-on to devices, applications, and services from anywhere. With the proliferation of devices (including BYOD), work off corporate networks, and 3rd party SaaS applications, IT professionals are faced with two opposing goals:+ -* Empower the end users to be productive wherever and whenever -* Protect the corporate assets at any time - -To improve productivity, Azure Active Directory provides your users with a broad range of options to access your corporate assets. With application access management, Azure Active Directory enables you to ensure that only the right people can access your applications. What if you want to have more control over how the right people are accessing your resources under certain conditions? What if you even have conditions under which you want to block access to certain applications even for the right people? For example, it might be OK for you if the right people are accessing certain applications from a trusted network; however, you might not want them to access these applications from a network you don't trust. You can address these questions using conditional access. - -Read [Conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal) to learn more about Conditional Access. Afterwards, read [Getting started with conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal-get-started) to start deploying Conditional access. - -## Dynamic lock - -**Requirements:** -* Windows 10, version 1703 - -Dynamic lock enables you to configure Windows 10 devices to automatically lock when Bluetooth paired device signal falls below the maximum Received Signal Strength Indicator (RSSI) value. You configure the dynamic lock policy using Group Policy. You can locate the policy setting at **Computer Configuration\Administrative Templates\Windows Components\Windows Hello for Business**. The name of the policy is **Configure dynamic lock factors**. - -The Group Policy Editor, when the policy is enabled, creates a default signal rule policy with the following value: - ->[!IMPORTANT] ->Microsoft recommends using the default values for this policy settings. Measurements are relative based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. - -``` - - - -``` - -For this policy setting, the **type** and **scenario** attribute values are static and cannot change. The **classofDevice** attribute defaults Phones and uses the values from the following table - -|Description|Value| -|:-------------|:-------:| -|Miscellaneous|0| -|Computer|256| -|Phone|512| -|LAN/Network Access Point|768| -|Audio/Video|1024| -|Peripheral|1280| -|Imaging|1536| -|Wearable|1792| -|Toy|2048| -|Health|2304| -|Uncategorized|7936| - -The **rssiMin** attribute value signal indicates the strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows 10 to lock the device once the signal strength weakens by more than measurement of 10. - -RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other. - -## PIN reset - -**Applies to:** -- Windows 10, version 1709 or later - - -### Hybrid Deployments - -**Requirements:** -- Azure Active Directory -- Hybrid Windows Hello for Business deployment -- Azure AD registered, Azure AD joined, and Hybrid Azure AD joined -- Windows 10, version 1709 or later, **Enterprise Edition** - -The Microsoft PIN reset services enables you to help users who have forgotten their PIN. Using Group Policy, Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables users to reset their forgotten PIN through settings or above the lock screen without requiring re-enrollment. - ->[!IMPORTANT] -> The Microsoft PIN Reset service only works with Windows 10, version 1709 or later **Enterprise Edition**. The feature does not work with the **Pro** edition.] - -#### Onboarding the Microsoft PIN reset service to your Intune tenant - -Before you can remotely reset PINs, you must on-board the Microsoft PIN reset service to your Azure Active Directory tenant, and configure devices you manage. - -#### Connect Azure Active Directory with the PIN reset service - -1. Visit [Microsoft PIN Reset Service Integration website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Azure Active Directory tenant. -2. After you log in, click **Accept** to give consent for the PIN reset service to access your account.
                        -![PIN reset service application in Azure](images/pinreset/pin-reset-service-home-screen.png)
                        -3. In the Azure portal, you can verify that the Microsoft PIN reset service is integrated from the **Enterprise applications**, **All applications** blade.
                        -![PIN reset service permissions page](images/pinreset/pin-reset-service-application.png) - -#### Configure Windows devices to use PIN reset using Group Policy -You configure Windows 10 to use the Microsoft PIN Reset service using the computer configuration portion of a Group Policy object. - -1. Using the Group Policy Management Console (GPMC), scope a domain-based Group Policy to computer accounts in Active Directory. -2. Edit the Group Policy object from step 1. -3. Enable the **Use PIN Recovery** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. -4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. - -#### Configure Windows devices to use PIN reset using Microsoft Intune -To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 custom device policy](https://docs.microsoft.com/intune/custom-settings-windows-10) to enable the feature. Configure the policy using the following Windows policy configuration service provider (CSP): - -##### Create a PIN Reset Device configuration profile using Microsoft Intune - -1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. -2. You need your tenant ID to complete the following task. You can discovery your tenant ID viewing the **Properties** of your Azure Active Directory from the Azure Portal. You can also use the following command in a command Window on any Azure AD joined or hybrid Azure AD joined computer.
                        - ``` - dsregcmd /status | findstr -snip "tenantid" - ``` -3. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. Click **Create profile**. -4. Type **Use PIN Recovery** in the **Name** field. Select **Windows 10 and later** from the **Platform** list. Select **Custom** from the **Profile type** list. -5. In the **Custom OMA-URI Settings** blade, Click **Add**. -6. In the **Add Row** blade, type **PIN Reset Settings** in the **Name** field. In the **OMA-URI** field, type **./Device/Vendor/MSFT/PassportForWork/*tenant ID*/Policies/EnablePinRecovery** where *tenant ID* is your Azure Active Directory tenant ID from step 2. -7. Select **Boolean** from the **Data type** list and select **True** from the **Value** list. -8. Click **OK** to save the row configuration. Click **OK** to close the Custom OMA-URI Settings blade. Click **Create to save the profile. - -##### Assign the PIN Reset Device configuration profile using Microsoft Intune -1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. -2. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. From the list of device configuration profiles, click the profile that contains the PIN reset configuration. -3. In the device configuration profile, click **Assignments**. -4. Use the **Include** and/or **Exclude** tabs to target the device configuration profile to select groups. - -### On-premises Deployments - -** Requirements** -* Active Directory -* On-premises Windows Hello for Business deployment -* Reset from settings - Windows 10, version 1703, Professional -* Reset above Lock - Windows 10, version 1709, Professional - -On-premises deployments provide users with the ability to reset forgotten PINs either through the settings page or from above the user's lock screen. Users must know or be provided their password for authentication, must perform a second factor of authentication, and then re-provision Windows Hello for Business. - ->[!IMPORTANT] ->Users must have corporate network connectivity to domain controllers and the federation service to reset their PINs. - -#### Reset PIN from Settings -1. Sign-in to Windows 10, version 1703 or later using an alternate credential. -2. Open **Settings**, click **Accounts**, click **Sign-in options**. -3. Under **PIN**, click **I forgot my PIN** and follow the instructions. - -#### Reset PIN above the Lock Screen - 1. On Windows 10, version 1709, click **I forgot my PIN** from the Windows Sign-in - 2. Enter your password and press enter. - 3. Follow the instructions provided by the provisioning process - 4. When finished, unlock your desktop using your newly created PIN. - ->[!NOTE] -> Visit the [Windows Hello for Business Videos](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos.md) page and watch the [Windows Hello for Business forgotten PIN user experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience) video. - -## Dual Enrollment - -**Requirements** -* Hybrid and On-premises Windows Hello for Business deployments -* Enterprise Joined or Hybrid Azure joined devices -* Windows 10, version 1709 - -> [!NOTE] -> This feature was previously known as **Privileged Credential** but was renamed to **Dual Enrollment** to prevent any confusion with the **Privileged Access Workstation** feature. - -> [!IMPORTANT] -> Dual enrollment does not replace or provide the same security as Privileged Access Workstations feature. Microsoft encourages enterprises to use the Privileged Access Workstations for their privileged credential users. Enterprises can consider Windows Hello for Business dual enrollment in situations where the Privileged Access feature cannot be used. Read [Privileged Access Workstations](https://docs.microsoft.com/windows-server/identity/securing-privileged-access/privileged-access-workstations) for more information. - -Dual enrollment enables administrators to perform elevated, administrative functions by enrolling both their non-privileged and privileged credentials on their device. - -By design, Windows 10 does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, **Allow enumeration of emulated smart card for all users**, you can configure a device to enumerate all enrolled Windows Hello for Business credentials on selected devices. - -With this setting, administrative users can sign-in to Windows 10, version 1709 using their non-privileged Windows Hello for Business credentials for normal work flow such as email, but can launch Microsoft Management Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command line applications by using **runas.exe** combined with the **/smartcard** argument. This enables administrators to perform their day-to-day operations without needing to sign-in and out, or use fast user switching when alternating between privileged and non-privileged workloads. - -> [!IMPORTANT] -> You must configure a Windows 10 computer for Windows Hello for Business dual enrollment before either user (privileged or non-privileged) provisions Windows Hello for Business. Dual enrollment is a special setting that is configured on the Windows Hello container during creation. - -### Configure Windows Hello for Business Dual Enroll -In this task you will -- Configure Active Directory to support Domain Administrator enrollment -- Configure Dual Enrollment using Group Policy - -#### Configure Active Directory to support Domain Administrator enrollment -The designed Windows for Business configuration has you give the **Key Admins** (or **KeyCredential Admins** when using domain controllers prior to Windows Server 2016) group read and write permissions to the msDS-KeyCredentialsLink attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy. - -Active Directory Domain Services uses AdminSDHolder to secure privileged users and groups from unintentional modification by comparing and replacing the security on privileged users and groups to match those defined on the AdminSDHolder object on an hourly cycle. For Windows Hello for Business, your domain administrator account may receive the permissions but will they will disappear from the user object unless you give the AdminSDHolder read and write permissions to the msDS-KeyCredential attribute. - -Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. - -1. Type the following command to add the **allow** read and write property permissions for msDS-KeyCredentialLink attribute for the **Key Admins** (or **KeyCredential Admins**) group on the AdminSDHolder object.
                        -```dsacls "CN=AdminSDHolder,CN=System,DC=domain,DC=com" /g "[domainName\keyAdminGroup]":RPWP;msDS-KeyCredentialLink```
                        -where **DC=domain,DC=com** is the LDAP path of your Active Directory domain and **domainName\keyAdminGroup]** is the NetBIOS name of your domain and the name of the group you use to give access to keys based on your deployment. For example:
                        -```dsacls "CN=AdminSDHolder,CN=System,DC=corp,DC=mstepdemo,DC=net" /g "mstepdemo\Key Admins":RPWP;msDS-KeyCredentialLink``` -2. To trigger security descriptor propagation, open **ldp.exe**. -3. Click **Connection** and select **Connect...** Next to **Server**, type the name of the domain controller that holds the PDC role for the domain. Next to **Port**, type **389** and click **OK**. -4. Click **Connection** and select **Bind...** Click **OK** to bind as the currently signed-in user. -5. Click **Browser** and select **Modify**. Leave the **DN** text box blank. Next to **Attribute**, type **RunProtectAdminGroupsTask**. Next to **Values**, type **1**. Click **Enter** to add this to the **Entry List**. -6. Click **Run** to start the task. -7. Close LDP. - -#### Configuring Dual Enrollment using Group Policy -You configure Windows 10 to support dual enrollment using the computer configuration portion of a Group Policy object. - -1. Using the Group Policy Management Console (GPMC), create a new domain-based Group Policy object and link it to an organizational Unit that contains Active Directory computer objects used by privileged users. -2. Edit the Group Policy object from step 1. -3. Enable the **Allow enumeration of emulated smart cards for all users** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. -4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. -5. Restart computers targeted by this Group Policy object. - -The computer is ready for dual enrollment. Sign-in as the privileged user first and enroll for Windows Hello for Business. Once completed, sign-out and sign-in as the non-privileged user and enroll for Windows Hello for Business. You can now use your privileged credential to perform privileged tasks without using your password and without needing to switch users. - -## Remote Desktop with Biometrics - -> [!Warning] -> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -**Requirements** -- Hybrid and On-premises Windows Hello for Business deployments -- Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices -- Certificate trust deployments -- Biometric enrollments -- Windows 10, version 1809 - -Users using earlier versions of Windows 10 could remote desktop to using Windows Hello for Business but were limited to the using their PIN as their authentication gesture. Windows 10, version 1809 introduces the ability for users to authenticate to a remote desktop session using their Windows Hello for Business biometric gesture. The feature is on by default, so your users can take advantage of it as soon as they upgrade to Windows 10, version 1809. - -> [!IMPORTANT] -> The remote desktop with biometrics feature only works with certificate trust deployments. The feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. Microsoft continues to investigate supporting this feature for key trust deployments. - -### How does it work -It start with creating cryptographic keys. Windows generates and stores cryptographic keys using a software component called a key storage provider (KSP). Software-based keys are created and stored using the Microsoft Software Key Storage Provider. Smart card keys are created and stored using the Microsoft Smart Card Key Storage Provider. Keys created and protected by Windows Hello for Business are created and stored using the Microsoft Passport Key Storage Provider. - -A certificate on a smart card starts with creating an asymmetric key pair using the Microsoft Smart Card KSP. Windows requests a certificate based on the key pair from your enterprises issuing certificate authority, which returns a certificate that is stored in the user's Personal certificate store. The private key remains on the smart card and the public key is stored with the certificate. Metadata on the certificate (and the key) store the key storage provider used to create the key (remember the certificate contains the public key). - -This same concept applies to Windows Hello for Business. Except, the keys are created using the Microsoft Passport KSP and the user's private key remains protected by the device's security module (TPM) and the user's gesture (PIN/biometric). The certificate APIs hide this complexity. When an application uses a certificate, the certificate APIs locate the keys using the saved key storage provider. The key storage providers directs the certificate APIs on which provider they use to find the private key associated with the certificate. This is how Windows knows you have a smart card certificate without the smart card inserted (and prompts you to insert the smart card). - -Windows Hello for Business emulates a smart card for application compatibility. Versions of Windows 10 prior to version 1809, would redirect private key access for Windows Hello for Business certificate to use its emulated smart card using the Microsoft Smart Card KSP, which would enable the user to provide their PIN. Windows 10, version 1809 no longer redirects private key access for Windows Hello for Business certificates to the Microsoft Smart Card KSP-- it continues using the Microsoft Passport KSP. The Microsoft Passport KSP enabled Windows 10 to prompt the user for their biometric gesture or PIN. - -### Compatibility -Users appreciate convenience of biometrics and administrators value the security however, you may experience compatibility issues with your applications and Windows Hello for Business certificates. You can relax knowing a Group Policy setting and a [MDM URI](https://docs.microsoft.com/windows/client-management/mdm/passportforwork-csp) exist to help you revert to the previous behavior for those users who need it. - -![WHFB Certificate GP Setting](images/rdpbio/rdpbiopolicysetting.png) - -> [!IMPORTANT] -> The remote desktop with biometric feature does not work with [Dual Enrollment](#dual-enrollment) feature or scenarios where the user provides alternative credentials. Microsoft continues to investigate supporting the feature.\ +- [Conditional Access](hello-feature-conditional-access.md) +- [Dual Enrollment](hello-feature-dual-enrollment.md) +- [Dynamic lock](hello-feature-dynamic-lock.md) +- [Multifactor Unlock](feature-multifactor-unlock.md) +- [PIN Reset](hello-feature-pin-reset.md) +- [Remote Desktop](hello-feature-remote-desktop.md) ## Related topics diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index 9a2711dc1c..c876fbd351 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -32,6 +32,8 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Domain joined provisioning in an On-premises Key Trust deployment](#domain-joined-provisioning-in-an-on-premises-key-trust-deployment)
                        [Domain joined provisioning in an On-premises Certificate Trust deployment](#domain-joined-provisioning-in-an-on-premises-certificate-trust-deployment)
                        +> [!NOTE] +> The flows in this section are not exhaustive for every possible scenario. For example, Federated Key Trust is also a supported configuration. ## Azure AD joined provisioning in a Managed environment diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index 26b5607798..f32db55329 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -71,7 +71,7 @@ Azure AD Join is intended for organizations that desire to be cloud-first or clo [Join Type](#join-type), [Hybrid Azure AD Joined](#hybrid-azure-ad-joined) ### More information - - [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction). +- [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction). [Return to Top](hello-how-it-works-technology.md) ## Azure AD Registered diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index 847bbfdf0e..d1c11a2a8c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -309,13 +309,13 @@ Sign-in a workstation with access equivalent to a _domain user_. ![Intune Windows Hello for Business policy settings](images/aadj/IntuneWHFBPolicy-01.png) 11. Select the appropriate configuration for the following settings. - * **Lowercase letters in PIN** - * **Uppercase letters in PIN** - * **Special characters in PIN** - * **PIN expiration (days)** - * **Remember PIN history** - > [!NOTE] - > The Windows Hello for Business PIN is not a symmetric key (a password). A copy of the current PIN is not stored locally or on a server like in the case of passwords. Making the PIN as complex and changed frequently as a password increases the likelihood of forgotten PINs. Additionally, enabling PIN history is the only scenario that requires Windows 10 to store older PIN combinations (protected to the current PIN). Windows Hello for Business combined with a TPM provides anti-hammering functionality that prevents brute force attacks of the user's PIN. If you are concerned with user-to-user shoulder surfacing, rather that forcing complex PIN that change frequently, consider using the [Multifactor Unlock](feature-multifactor-unlock.md) feature. + * **Lowercase letters in PIN** + * **Uppercase letters in PIN** + * **Special characters in PIN** + * **PIN expiration (days)** + * **Remember PIN history** + > [!NOTE] + > The Windows Hello for Business PIN is not a symmetric key (a password). A copy of the current PIN is not stored locally or on a server like in the case of passwords. Making the PIN as complex and changed frequently as a password increases the likelihood of forgotten PINs. Additionally, enabling PIN history is the only scenario that requires Windows 10 to store older PIN combinations (protected to the current PIN). Windows Hello for Business combined with a TPM provides anti-hammering functionality that prevents brute force attacks of the user's PIN. If you are concerned with user-to-user shoulder surfacing, rather that forcing complex PIN that change frequently, consider using the [Multifactor Unlock](feature-multifactor-unlock.md) feature. 12. Select **Yes** next to **Allow biometric authentication** if you want to allow users to use biometrics (fingerprint and/or facial recognition) to unlock the device. To further secure the use of biometrics, select **Yes** to **Use enhanced anti-spoofing, when available**. 13. Select **No** to **Allow phone sign-in**. This feature has been deprecated. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 2fc0996eb0..5136ececee 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -79,7 +79,7 @@ The easiest way to verify the onPremisesDistingushedNamne attribute is synchroni 1. Open a web browser and navigate to https://graphexplorer.azurewebsites.net/ 2. Click **Login** and provide Azure credentials -3. In the Azure AD Graph Explorer URL, type https://graph.windows.net/myorganization/users/[userid], where **[userid] is the user principal name of user in Azure Active Directory. Click **Go** +3. In the Azure AD Graph Explorer URL, type https://graph.windows.net/myorganization/users/[userid], where **[userid]** is the user principal name of user in Azure Active Directory. Click **Go** 4. In the returned results, review the JSON data for the **onPremisesDistinguishedName** attribute. Ensure the attribute has a value and the value is accurate for the given user. ![Azure AD Connect On-Prem DN Attribute](images/aadjcert/aadconnectonpremdn.png) @@ -535,7 +535,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Azure Portal](https://portal.azure.com/). 2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. ![Microsoft Intune Console](images/aadjcert/microsoftintuneconsole.png) -3. Select **Device Configuration**, and then select **Certificate Authority**. +3. Select **Device Configuration**, and then select **Certificate Connectors**. ![Intune Certificate Authority](images/aadjcert/intunedeviceconfigurationcertauthority.png) 4. Click **Add**, and then click **Download the certificate connector software** under the **Steps to install connector for SCEP** section. ![Intune Download Certificate connector](images/aadjcert/intunedownloadcertconnector.png) @@ -610,7 +610,7 @@ Sign-in the NDES server with access equivalent to _domain admin_. 1. Open a command prompt. 2. Type the following command to confirm the NDES Connector's last connection time is current.
                        -```reg query hklm\software\Micosoft\MicrosoftIntune\NDESConnector\ConnectionStatus```
                        +```reg query hklm\software\Microsoft\MicrosoftIntune\NDESConnector\ConnectionStatus```
                        3. Close the command prompt. 4. Open **Internet Explorer**. 5. In the navigation bar, type
                        @@ -636,7 +636,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 8. Click **Members**. Use the **Select members** pane to add members to this group. When finished click **Select**. 9. Click **Create**. -### Create a SCEP Certificte Profile +### Create a SCEP Certificate Profile Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Azure Portal](https://portal.azure.com/). @@ -656,15 +656,16 @@ Sign-in a workstation with access equivalent to a _domain user_. 10. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list. 11. Select **Custom** from the **Subject name format** list. 12. Next to **Custom**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate. -13. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. -14. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority. +13. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** value. +14. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. +15. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority. ![WHFB SCEP certificate profile Trusted Certificate selection](images/aadjcert/intunewhfbscepprofile-01.png) -15. Under **Extended key usage**, type **Smart Card Logon** under Name. Type **1.3.6.1.4.1.311.20.2.2 under **Object identifier**. Click **Add**. -16. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. +16. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. +17. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. ![WHFB SCEP certificate Profile EKUs](images/aadjcert/intunewhfbscepprofile-03.png) -17. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests amongst the URLs listed in the SCEP certificate profile. -18. Click **OK**. -19. Click **Create**. +18. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. +19. Click **OK**. +20. Click **Create**. ### Assign Group to the WHFB Certificate Enrollment Certificate Profile Sign-in a workstation with access equivalent to a _domain user_. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index 1df71e5f3d..433457239a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -196,10 +196,19 @@ In a federated Azure AD configuration, devices rely on Active Directory Federati Windows current devices authenticate using Integrated Windows Authentication to an active WS-Trust endpoint (either 1.3 or 2005 versions) hosted by the on-premises federation service. +When you're using AD FS, you need to enable the following WS-Trust endpoints: +`/adfs/services/trust/2005/windowstransport` +`/adfs/services/trust/13/windowstransport` +`/adfs/services/trust/2005/usernamemixed` +`/adfs/services/trust/13/usernamemixed` +`/adfs/services/trust/2005/certificatemixed` +`/adfs/services/trust/13/certificatemixed` + +> [!WARNING] +> Both **adfs/services/trust/2005/windowstransport** or **adfs/services/trust/13/windowstransport** should be enabled as intranet facing endpoints only and must NOT be exposed as extranet facing endpoints through the Web Application Proxy. To learn more on how to disable WS-Trust WIndows endpoints, see [Disable WS-Trust Windows endpoints on the proxy](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs#disable-ws-trust-windows-endpoints-on-the-proxy-ie-from-extranet). You can see what endpoints are enabled through the AD FS management console under **Service** > **Endpoints**. + > [!NOTE] -> When using AD FS, either **adfs/services/trust/13/windowstransport** or **adfs/services/trust/2005/windowstransport** must be enabled. If you are using the Web Authentication Proxy, also ensure that this endpoint is published through the proxy. You can see what end-points are enabled through the AD FS management console under **Service > Endpoints**. -> -> If you don't have AD FS as your on-premises federation service, follow the instructions of your vendor to make sure they support WS-Trust 1.3 or 2005 end-points and that these are published through the Metadata Exchange file (MEX). +>If you don’t have AD FS as your on-premises federation service, follow the instructions from your vendor to make sure they support WS-Trust 1.3 or 2005 endpoints and that these are published through the Metadata Exchange file (MEX). The following claims must exist in the token received by Azure DRS for device registration to complete. Azure DRS will create a device object in Azure AD with some of this information which is then used by Azure AD Connect to associate the newly created device object with the computer account on-premises. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md index 71517e7da8..cd40458897 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md @@ -74,6 +74,9 @@ The two directories used in hybrid deployments must be synchronized. You need A Organizations using older directory synchronization technology, such as DirSync or Azure AD sync, need to upgrade to Azure AD Connect. In case the schema of your local AD DS was changed since the last directory synchronization, you may need to [refresh directory schema](https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-installation-wizard#refresh-directory-schema). +> [!NOTE] +> Windows Hello for Business is tied between a user and a device. Both the user and device need to be synchronized between Azure Active Directory and Active Directory. + ### Section Review > [!div class="checklist"] > * Azure Active Directory Connect directory synchronization diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index 1629f3eb9a..1cf7fcb2cd 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -114,7 +114,7 @@ Sign-in a certificate authority or management workstations with *Domain Admin* e 1. Open the **Certificate Authority** management console. 2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template** console, right-click the **Exchange Enrollment Agent** template in the details pane and click **Duplicate Template**. +3. In the **Certificate Template** console, right-click the **Exchange Enrollment Agent (Offline request)** template in the details pane and click **Duplicate Template**. 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. 5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. 6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md index 05a4294ad7..80325188e6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md @@ -26,7 +26,7 @@ ms.reviewer: ## Policy Configuration -You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 Creators Edition (1703) to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. @@ -151,7 +151,7 @@ The default configuration for Windows Hello for Business is to prefer hardware p You can enable and deploy the **Use a hardware security device** Group Policy Setting to force Windows Hello for Business to only create hardware protected credentials. Users that sign-in from a computer incapable of creating a hardware protected credential do not enroll for Windows Hello for Business. -Another policy setting becomes available when you enable the **Use a hardware security device** Group Policy setting that enables you to prevent Windows Hello for Business enrollment from using version 1.2 Trusted Platform Modules (TPM). Version 1.2 TPMs typically perform cryptographic operations slower than version 2.0 TPMs and are more unforgiving during anti-hammering and PIN lockout activities. Therefore, some organization may want not want slow sign-in performance and management overhead associated with version 1.2 TPMs. To prevent Windows Hello for Business from using version 1.2 TPMs, simply select the TPM 1.2 check box after you enable the Use a hardware security device Group Policy object. +Another policy setting becomes available when you enable the **Use a hardware security device** Group Policy setting that enables you to prevent Windows Hello for Business enrollment from using version 1.2 Trusted Platform Modules (TPM). Version 1.2 TPMs typically perform cryptographic operations slower than version 2.0 TPMs and are more unforgiving during anti-hammering and PIN lockout activities. Therefore, some organization may not want slow sign-in performance and management overhead associated with version 1.2 TPMs. To prevent Windows Hello for Business from using version 1.2 TPMs, simply select the TPM 1.2 check box after you enable the Use a hardware security device Group Policy object. #### Use biometrics diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index aa99101b75..0977f9b6a8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -39,7 +39,7 @@ Begin configuring device registration to support Hybrid Windows Hello for Busine To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-setup/) -Next, follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-hybrid-azuread-joined-devices-setup) page. In the **Configuration steps** section, identify your configuration at the top of the table (either **Windows current and password hash sync** or **Windows current and federation**) and perform only the steps identified with a check mark. +Next, follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-manual) page. In the **Configuration steps** section, identify your configuration at the top of the table (either **Windows current and password hash sync** or **Windows current and federation**) and perform only the steps identified with a check mark.

                        diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md index cdc50b7691..1f4f6b976d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md @@ -19,11 +19,11 @@ ms.reviewer: # Hybrid Azure AD joined Key Trust Deployment **Applies to** -- Windows 10, version 1703 or later -- Hybrid deployment -- Key trust - +- Windows 10, version 1703 or later +- Hybrid deployment +- Key trust + Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in a hybrid key trust scenario. It is recommended that you review the Windows Hello for Business planning guide prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. You can review the [planning guide](https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-planning-guide) and download the [planning worksheet](https://go.microsoft.com/fwlink/?linkid=852514). @@ -31,10 +31,11 @@ It is recommended that you review the Windows Hello for Business planning guide This deployment guide provides guidance for new deployments and customers who are already federated with Office 365. These two scenarios provide a baseline from which you can begin your deployment. ## New Deployment Baseline ## + The new deployment baseline helps organizations who are moving to Azure and Office 365 to include Windows Hello for Business as part of their deployments. This baseline is good for organizations who are looking to deploy proof of concepts as well as IT professionals who want to familiarize themselves Windows Hello for Business by deploying a lab environment. - + This baseline provides detailed procedures to move your environment from an on-premises only environment to a hybrid environment using Windows Hello for Business to authenticate to Azure Active Directory and to your on-premises Active Directory using a single Windows sign-in. - + Your next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. > [!div class="nextstepaction"] @@ -42,9 +43,8 @@ Your next step is to familiarize yourself with the prerequisites needed for the

                        -
                        - ## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. Overview (*You are here*) 2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md index c38ab35a87..122053e414 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -26,7 +26,7 @@ ms.reviewer: ## Policy Configuration -You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 Creators Edition (1703) to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index 161c10f243..a6364bad59 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -38,7 +38,7 @@ A new Active Directory Federation Services farm should have a minimum of two fed Prepare the Active Directory Federation Services deployment by installing and updating two Windows Server 2016 Servers. Ensure the update listed below is applied to each server before continuing. -## Update Windows Server 2016 +## Update Windows Server 2016 Sign-in the federation server with _local admin_ equivalent credentials. 1. Ensure Windows Server 2016 is current by running **Windows Update** from **Settings**. Continue this process until no further updates are needed. If you’re not using Windows Update for updates, please review the [Windows Server 2016 update history page](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) to make sure you have the latest updates available installed. diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md deleted file mode 100644 index b2c377057f..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md +++ /dev/null @@ -1,549 +0,0 @@ ---- -title: Configure or Deploy Multifactor Authentication Services (Windows Hello for Business) -description: How to Configure or Deploy Multifactor Authentication Services for Windows Hello for Business -keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security, mobile -audience: ITPro -author: mapalko -ms.author: mapalko -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -localizationpriority: medium -ms.date: 08/19/2018 -ms.reviewer: ---- -# Configure or Deploy Multifactor Authentication Services - -**Applies to** -- Windows 10, version 1703 or later -- On-premises deployment -- Key trust - - -On-premises deployments must use the On-premises Azure MFA Server using the AD FS adapter model Optionally, you can use a third-party MFA server that provides an AD FS Multifactor authentication adapter. - ->[!TIP] ->Please make sure you've read [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) before proceeding any further. - -## Prerequisites - -The Azure MFA Server and User Portal servers have several perquisites and must have connectivity to the Internet. - -### Primary MFA Server - -The Azure MFA server uses a primary and secondary replication model for its configuration database. The primary Azure MFA server hosts the writable partition of the configuration database. All secondary Azure MFA servers hosts read-only partitions of the configuration database. All production environment should deploy a minimum of two MFA Servers. - -For this documentation, the primary MFA uses the name **mf*a*** or **mfa.corp.contoso.com**. All secondary servers use the name **mfa*n*** or **mfa*n*.corp.contoso.com**, where *n* is the number of the deployed MFA server. - -The primary MFA server is also responsible for synchronizing from Active Directory. Therefore, the primary MFA server should be domain joined and fully patched. - -#### Enroll for Server Authentication - -The communication between the primary MFA server, secondary MFA servers, User Portal servers, and the client is protected using TLS, which needs a server authentication certificate. - -Sign-in the primary MFA server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (mfa.corp.contoso.com). Click **Add**. Click **OK** when finished. -9. Click **Enroll**. - -A server authentication certificate should appear in the computer’s Personal certificate store. - -#### Install the Web Server Role - -The Azure MFA server does not require the Web Server role, however, User Portal and the optional Mobile Application server communicate with the MFA server database using the MFA Web Services SDK. The MFA Web Services SDK uses the Web Server role. - -To install the Web Server (IIS) role, please follow [Installing IIS 7 on Windows Server 2008 or Windows Server 2008 R2](https://docs.microsoft.com/iis/install/installing-iis-7/installing-iis-7-and-above-on-windows-server-2008-or-windows-server-2008-r2) or [Installing IIS 8.5 on Windows Server 2012 R2](https://docs.microsoft.com/iis/install/installing-iis-85/installing-iis-85-on-windows-server-2012-r2) depending on the host Operating System you're going to use. - -The following services are required: -* Common Parameters > Default Document. -* Common Parameters > Directory Browsing. -* Common Parameters > HTTP Errors. -* Common Parameters > Static Content. -* Health and Diagnostics > HTTP Logging. -* Performance > Static Content Compression. -* Security > Request Filtering. -* Security > Basic Authentication. -* Management Tools > IIS Management Console. -* Management Tools > IIS 6 Management Compatibility. -* Application Development > ASP.NET 4.5. - -#### Update the Server - -Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. - -#### Configure the IIS Server’s Certificate - -The TLS protocol protects all the communication to and from the MFA server. To enable this protection, you must configure the default web site to use the previously enrolled server authentication certificate. - -Sign in the primary MFA server with _administrator_ equivalent credentials. -1. From **Administrators**, Start the **Internet Information Services (IIS) Manager** console -2. In the navigation pane, expand the node with the same name as the local computer. Expand **Settings** and select **Default Web Site**. -3. In the **Actions** pane, click **Bindings**. -4. In the **Site Bindings** dialog, Click **Add**. -5. In the **Add Site Binding** dialog, select **https** from the **Type** list. In the **SSL certificate** list, select the certificate with the name that matches the FQDN of the computer. -6. Click **OK**. Click **Close**. From the **Action** pane, click **Restart**. - -#### Configure the Web Service’s Security - -The Azure MFA Server service runs in the security context of the Local System. The MFA User Portal gets its user and configuration information from the Azure MFA server using the MFA Web Services. Access control to the information is gated by membership to the Phonefactor Admins security group. You need to configure the Web Service’s security to ensure the User Portal and the Mobile Application servers can securely communicate to the Azure MFA Server. Also, all User Portal server administrators must be included in the Phonefactor Admins security group. - -Sign in the domain controller with _domain administrator_ equivalent credentials. - -##### Create Phonefactor Admin group - -1. Open **Active Directory Users and Computers** -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **Group**. -3. In the **New Object – Group** dialog box, type **Phonefactor Admins** in Group name. -4. Click **OK**. - -##### Add accounts to the Phonefactor Admins group - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select Users. In the content pane. Right-click the **Phonefactor Admins** security group and select **Properties**. -3. Click the **Members** tab. -4. Click **Add**. Click **Object Types..** In the **Object Types** dialog box, select **Computers** and click **OK**. Enter the following user and/or computers accounts in the **Enter the object names to select** box and then click **OK**. - * The computer account for the primary MFA Server - * Group or user account that will manage the User Portal server. - - -#### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: - -* Confirm the hosts of the MFA service has enrolled a server authentication certificate with the proper names. - * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: - * Certificate serial number - * Certificate thumbprint - * Common name of the certificate - * Subject alternate name of the certificate - * Name of the physical host server - * The issued date - * The expiration date - * Issuing CA Vendor (if a third-party certificate) - -* Confirm the Web Services Role was installed with the correct configuration (including Basic Authentication, ASP.NET 4.5, etc). -* Confirm the host has all the available updates from Windows Update. -* Confirm you bound the server authentication certificate to the IIS web site. -* Confirm you created the Phonefactor Admins group. -* Confirm you added the computer account hosting the MFA service to the Phonefactor Admins group and any user account who are responsible for administrating the MFA server or User Portal. - -### User Portal Server - -The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. User Portal Administrators may be set up and granted permission to add new users and update existing users. - -The User Portal web site uses the user database that is synchronized across the MFA Servers, which enables a design to support multiple web servers for the User Portal and those servers can support internal and external customers. While the user portal web site can be installed directly on the MFA server, it is recommended to install the User Portal on a server separate from the MFA Server to protect the MFA user database, as a layered, defense-in-depth security design. - -#### Enroll for Server Authentication - -Internal and external users use the User Portal to manage their multifactor authentication settings. To protect this communication, you need to enroll all User Portal servers with a server authentication certificate. You can use an enterprise certificate to protect communication to internal User Portal servers. - -For external User Portal servers, it is typical to request a server authentication certificate from a public certificate authority. Contact a public certificate authority for more information on requesting a certificate for public use. Follow the procedures below to enroll an enterprise certificate on your User Portal server. - -Sign-in the User Portal server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (app1.corp.contoso.com). -9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your User Portal service (mfaweb.corp.contoso.com). -10. Click **Add**. Click **OK** when finished. -11. Click **Enroll**. - -A server authentication certificate should appear in the computer’s Personal certificate store. - -#### Install the Web Server Role - -To do this, please follow the instructions mentioned in the previous [Install the Web Server Role](#install-the-web-server-role) section. However, do **not** install Security > Basic Authentication. The user portal server does not require this. - -#### Update the Server - -Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. - -#### Configure the IIS Server’s Certificate - -To do this, please follow the instructions mentioned in the previous [Configure the IIS Server’s Certificate](#configure-the-iis-servers-certificate) section. - -#### Create WebServices SDK user account - -The User Portal and Mobile Application web services need to communicate with the configuration database hosted on the primary MFA server. These services use a user account to communicate to authenticate to the primary MFA server. You can think of the WebServices SDK account as a service account used by other servers to access the WebServices SDK on the primary MFA server. - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **User**. -3. In the **New Object – User** dialog box, type **PFWSDK_\** in the **First name** and **User logon name** boxes, where *\* is the name of the primary MFA server running the Web Services SDK. Click **Next**. -4. Type a strong password and confirm it in the respective boxes. Clear **User must change password at next logon**. Click **Next**. Click **Finish** to create the user account. - -#### Add the MFA SDK user account to the Phonefactor Admins group - -Adding the WebServices SDK user account to the Phonefactor Admins group provides the user account with the proper authorization needed to access the configuration data on the primary MFA server using the WebServices SDK. - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select **Users**. In the content pane. Right-click the **Phonefactors Admin** security group and select Properties. -3. Click the Members tab. -4. Click **Add**. Click **Object Types..** Type the PFWSDK_\ user name in the **Enter the object names to select** box and then click **OK**. - * The computer account for the primary MFA Server - * The Webservices SDK user account - * Group or user account that will manage the User Portal server. - - -#### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: - -* Confirm the hosts of the user portal are properly configure for load balancing and high-availability. -* Confirm the hosts of the user portal have enrolled a server authentication certificate with the proper names. - * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: - * Certificate serial number - * Certificate thumbprint - * Common name of the certificate - * Subject alternate name of the certificate - * Name of the physical host server - * The issued date - * The expiration date - * Issuing CA Vendor (if a third-party certificate) - -* Confirm the Web Server Role was properly configured on all servers. -* Confirm all the hosts have the latest updates from Windows Update. -* Confirm you created the web service SDK domain account and the account is a member of the Phonefactor Admins group. - -## Installing Primary Azure MFA Server - -When you install Azure Multi-Factor Authentication Server, you have the following options: -1. Install Azure Multi-Factor Authentication Server locally on the same server as AD FS -2. Install the Azure Multi-Factor Authentication adapter locally on the AD FS server, and then install Multi-Factor Authentication Server on a different computer (preferred deployment for production environments) - -See [Configure Azure Multi-Factor Authentication Server to work with AD FS in Windows Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12) to view detailed installation and configuration options. - -Sign-in the federation server with _Domain Admin_ equivalent credentials and follow [To install and configure the Azure Multi-Factor Authentication server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#to-install-and-configure-the-azure-multi-factor-authentication-server) for an express setup with the configuration wizard. You can re-run the authentication wizard by selecting it from the Tools menu on the server. - ->[!IMPORTANT] ->Only follow the above mention article to install Azure MFA Server. Once it is installed, continue configuration using this article. - -### Configuring Company Settings - -You need to configure the MFA server with the default settings it applies to each user account when it is imported or synchronized from Active Directory. - -Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. -1. Start the **Multi-Factor Server** application -2. Click **Company Settings**. -3. On the **General** Tab, select **Fail Authentication** from the **When internet is not accessible** list. -4. In **User defaults**, select **Phone Call** or **Text Message** - **Note:** You can use mobile application; however, the configuration is beyond the scope of this document. Read [Getting started the MFA Server Mobile App Web Service](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice) to configure and use mobile application multi-factor authentication or the Install User Portal topic in the Multi-Factor Server help. -5. Select **Enable Global Services** if you want to allow Multi-Factor Authentications to be made to telephone numbers in rate zones that have an associated charge. -6. Clear the **User can change phone** check box to prevent users from changing their phone during the Multi-Factor Authentication call or in the User Portal. A consistent configuration is for users to change their phone numbers in Active Directory and let those changes synchronize to the multi-factor server using the Synchronization features in Directory Integration. -7. Select **Fail Authentication** from the **When user is disabled** list. Users should provision their account through the user portal. -8. Select the appropriate language from the **Phone call language**, **Text message language**, **Mobile app language**, and **OATH token language** lists. -9. Under default PIN rules, Select the User can change PIN check box to enable users to change their PIN during multi-factor authentication and through the user portal. -10. Configure the minimum length for the PIN. -11. Select the **Prevent weak PINs** check box to reject weak PINs. A weak PIN is any PIN that could be easily guessed by a hacker: 3 sequential digits, 3 repeating digits, or any 4 digit subset of user phone number are not allowed. If you clear this box, then there are no restrictions on PIN format. For example: User tries to reset PIN to 1235 and is rejected because it's a weak PIN. User will be prompted to enter a valid PIN. -12. Select the **Expiration days** check box if you want to expire PINs. If enabled, provide a numeric value representing the number of days the PIN is valid. -13. Select the **PIN history** check box if you want to remember previously used PINs for the user. PIN History stores old PINs for each user. Users are not allowed to reset their PIN to any value stored in their PIN History. When cleared, no PIN History is stored. The default value is 5 and range is 1 to 10. - -![Azure MFA Server Company settings configured](images/hello-mfa-company-settings.png) - -### Configuring Email Settings and Content - -If you are deploying in a lab or proof-of-concept, then you have the option of skipping this step. In a production environment, ideally, you’ll want to setup the Azure Multifactor Authentication Server and its user portal web interface prior to sending the email. The email gives your users time to visit the user portal and configure the multi-factor settings. - -Now that you have imported or synchronized with your Azure Multi-Factor Authentication server, it is advised that you send your users an email that informs them that they have been enrolled in multi-factor authentication. - -With the Azure Multi-Factor Authentication Server there are various ways to configure your users for using multi-factor authentication. For instance, if you know the users’ phone numbers or were able to import the phone numbers into the Azure Multi-Factor Authentication Server from their company’s directory, the email will let users know that they have been configured to use Azure Multi-Factor Authentication, provide some instructions on using Azure Multi-Factor Authentication and inform the user of the phone number they will receive their authentications on. - -The content of the email will vary depending on the method of authentication that has been set for the user (e.g. phone call, SMS, mobile application). For example, if the user is required to use a PIN when they authenticate, the email will tell them what their initial PIN has been set to. Users are usually required to change their PIN during their first authentication. - -If users’ phone numbers have not been configured or imported into the Azure Multi-Factor Authentication Server, or users are pre-configured to use the mobile application for authentication, you can send them an email that lets them know that they have been configured to use Azure Multi-Factor Authentication and it will direct them to complete their account enrollment through the Azure Multi-Factor Authentication User Portal. A hyperlink will be included that the user clicks on to access the User Portal. When the user clicks on the hyperlink, their web browser will open and take them to their company’s Azure Multi-Factor Authentication User Portal. - -#### Settings - -By clicking the email icon on the left you can setup the settings for sending these emails. This is where you can enter the SMTP information of your mail server and it allows you to send a blanket wide email by adding a check to the Send mails to users check box. - -#### Content - -On the Email Content tab, you will see all of the various email templates that are available to choose from. So, depending on how you have configured your users to use multi-factor authentication, you can choose the template that best suits you. - -##### Edit the Content Settings - -The Azure MFA server does not send emails, even when configured to do so, until you configured the sender information for each email template listed in the Content tab. - -Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. Click **Email** from the list of icons and click the **Email Content** tab. -3. Select an email template from the list of templates. Click **Edit**. -4. In the **Edit Email** dialog, in the **From** text box, type the email address of the person or group that should appear to have sent the email. - ![Edit email dialog within content settings](images/hello-mfa-content-edit-email.png) - -5. Optionally, customize other options in the email template. -6. When finished editing the template, Click **Apply**. -7. Click **Next** to move to the next email in the list. Repeat steps 4 and 6 to edit the changes. -8. Click **Close** when you are done editing the email templates. - -### Configuring Directory Integration Settings and Synchronization - -Synchronization keeps the Multi-Factor Authentication user database synchronized with the users in Active Directory or another LDAP Lightweight Directory Access Protocol directory. The process is similar to Importing Users from Active Directory, but periodically polls for Active Directory user and security group changes to process. It also provides for disabling or removing users removed from a container or security group and removing users deleted from Active Directory. - -It is important to use a different group memberships for synchronizing users from Active Directory and for enabling Windows Hello for Business. Keeping the group memberships separated enables you to synchronize users and configure MFA options without immediately deploying Windows Hello for Business to that user. This deployment approach provides the maximum flexibility, which gives users the ability to configure their settings before they provision Windows Hello for Business. To start provisioning, simply add the group used for synchronization to the Windows Hello for Business Users group (or equivalent if you use custom names). - -#### MultiFactorAuthAdSync Service - -The MultiFactorAuthAdSync service is a Windows service that performs the periodic polling of Active Directory. It is installed in a Stopped state and is started by the MultiFactorAuth service when configured to run. If you have a multi-server Multi-Factor Authentication configuration, the MultiFactorAuthAdSync may only be run on a single server. - -The MultiFactorAuthAdSync service uses the DirSync LDAP server extension provided by Microsoft to efficiently poll for changes. This DirSync control caller must have the "directory get changes" right and DS-Replication-Get-Changes extended control access right. By default, these rights are assigned to the Administrator and LocalSystem accounts on domain controllers. The MultiFactorAuthAdSync service is configured to run as LocalSystem by default. Therefore, it is simplest to run the service on a domain controller. The service can run as an account with lesser permissions if you configure it to always perform a full synchronization. This is less efficient, but requires less account privileges. - -#### Settings - -Configuring the directory synchronization between Active Directory and the Azure MFA server is easy. - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. -3. Click the **Synchronization** tab. -4. Select **Use Active Directory**. -5. Select **Include trusted domains** to have the Multi-Factor Authentication Server attempt to connect to domains trusted by the current domain, another domain in the forest, or domains involved in a forest trust. When not importing or synchronizing users from any of the trusted domains, clear the check box to improve performance. - -#### Synchronization - -The MFA server uses synchronization items to synchronize users from Active Directory to the MFA server database. Synchronization items enables you to synchronize a collection of users based security groups or Active Directory containers. - -You can configure synchronization items based on different criteria and filters. For the purpose of configuring Windows Hello for Business, you need to create a synchronization item based membership of the Windows Hello for Business user group. This ensures the same users who receive Windows Hello for Business policy settings are the same users synchronized to the MFA server (and are the same users with permission to enroll in the certificate). This significantly simplifies deployment and troubleshooting. - -See [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint) for more details. - -##### To add a synchronization item - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. -3. Select the **Synchronization** tab. -4. On the **Synchronization** tab, click **Add**. - ![Azure MFA Server - add synchronization item screen](images/hello-mfa-sync-item.png) - -5. In the **Add Synchronization Item** dialog, select **Security Groups** from the **View** list. -6. Select the group you are using for replication from the list of groups -7. Select **Selected Security Groups – Recursive** or, select **Security Group** from the **Import** list if you do not plan to nest groups. -8. Select **Add new users and Update existing users**. -9. Select **Disable/Remove users no longer a member** and select **Disable** from the list. -10. Select the attributes appropriate for your environment for **Import phone** and **Backup**. -11. Select **Enabled** and select **Only New Users with Phone Number** from the list. -12. Select **Send email** and select **New and Updated Users**. - -##### Configure synchronization item defaults - -1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Method Defaults** tab. -2. Select the default second factor authentication method. For example, if the second factor of authentication is a text message, select **Text message**. Select if the direction of text message authentication and if the authentication should use a one-time password or one-time password and PIN (Ensure users are configured to create a PIN if the default second factor of communication requires a PIN). - -##### Configure synchronization language defaults - -1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Language Defaults** tab. -2. Select the appropriate default language for these groups of users synchronized by these synchronization item. -3. If creating a new synchronization item, click **Add** to save the item. If editing an existing synchronization item, click **Apply** and then click **Close**. - ->[!TIP] ->For more information on these settings and the behaviors they control, see [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint). - -### Installing the MFA Web Services SDK - -The Web Service SDK section allows the administrator to install the Multi-Factor Authentication Web Service SDK. The Web Service SDK is an IIS (Internet Information Server) web service that provides an interface for integrating the full features of the Multi-Factor Authentication Server into most any application. The Web Service SDK uses the Multi-Factor Authentication Server as the data store. - -Remember the Web Services SDK is only need on the primary Multi-Factor to easily enable other servers access to the configuration information. The prerequisites section guided you through installing and configuring the items needed for the Web Services SDK, however the installer will validate the prerequisites and make suggest any corrective action needed. - -Please follow the instructions under [Install the web service SDK](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice#install-the-web-service-sdk) to install the MFA Web Services SDK. - -## Install Secondary MFA Servers - -Additional MFA servers provided redundancy of the MFA configuration. The MFA server models uses one primary MFA server with multiple secondary servers. Servers within the same group establish communication with the primary server for that group. The primary server replicates to each of the secondary servers. You can use groups to partition the data stored on different servers, for example you can create a group for each domain, forest, or organizational unit. - -Follow the same procedures for installing the primary MFA server software for each additional server. Remember that each server must be activated. - -Sign in the secondary MFA server with _domain administrator_ equivalent credentials. -1. Once the Multi-Factor Authentication Server console starts, you must configure the current server’s replication group membership. You have the option to join an existing group or create a new group. When joining an existing group, the server becomes a secondary server in the existing replication group. When creating a new group, the server becomes the primary server of that replication group. Click **OK**. - **Note:** Group membership cannot be changed after activation. If a server was joined to the wrong group, it must be activated again to join a different group. Please contact support for assistance with deactivating and reactivating a server. -2. The console asks you if you want to enable replication by running the **Multi-Server Configuration Wizard**. Click **Yes**. -3. In the **Multi-Server Configuration Wizard**, leave **Active Directory** selected and clear **Certificates**. Click **Next**. -4. On the **Active Directory** page, the wizard determines what configuration is needed to enable replication. Typically, the wizard recommends adding the computer account for the current server to the **PhoneFactor Admin** group. Click **Next** to add the computer account to the group. -5. On the **Multi-Server Configuration Complete** page, click **Finish** to reboot the computer to update its group membership. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm you downloaded the latest Azure MFA Server from the Azure Portal. -* Confirm the server has Internet connectivity. -* Confirm you installed and activated the Azure MFA Server. -* Confirm your Azure MFA Server configuration meets your organization’s needs (Company Settings, Email Settings, etc). -* Confirm you created Directory Synchronization items based on your deployment to synchronize users from Active Directory to the Azure MFA server. - * For example, you have security groups representing each collection of users that represent a phase of your deployment and a corresponding synchronization item for each of those groups. - -* Confirm the Azure MFA server properly communicates with the Azure MFA cloud service by testing multifactor authentication with a newly synchronized user account. -* Confirm you installed the Web Service SDK on the primary MFA server. -* Confirm your MFA servers have adequate redundancy, should you need to promote a secondary server to the primary server. - - -## Installing the User Portal Server - -You previously configured the User Portal settings on the primary MFA server. The User Portal web application communicates to the primary MFA server using the Web Services SDK to retrieve these settings. This configuration is ideal to ensure you can scale up the User Portal application to meet the needs of your internal users. - -### Copying the User Portal Installation file - -Sign in the primary MFA server with _local administrator_ equivalent credentials. -1. Open Windows Explorer. -2. Browse to the C:\Program Files\MultiFactor Authentication Server folder. -3. Copy the **MultiFactorAuthenticationUserPortalSetup64.msi** file to a folder on the User Portal server. - -### Configure Virtual Directory name - -Sign in the User Portal server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to the folder to which you saved the installation file from the previous step. -2. Run the **MultiFactorAuthenticationUserPortalSetup64.msi**. The installation package asks if you want to download **Visual Studio C++ Redistributable for Visual Studio 2015**. Click **Yes**. When prompted, select **Save As**. The downloaded file is missing its file extension. **Save the file with a .exe extension and install the runtime**. -3. Run the installation package again. The installer package asks about the C++ runtime again; however, this is for the X64 version (the previous prompt was for x86). Click **Yes** to download the installation package and select **Save As** so you can save the downloaded file with a .exe extension. **Install** the run time. -4. Run the User Portal installation package. On the **Select Installation Address** page, use the default settings for **Site** and **Application Pool** settings. You can modify the Virtual directory to use a name that is more fitting for the environment, such as **mfa** (This virtual directory must match the virtual directory specified in the User Portal settings). Click **Next**. -5. Click **Close**. - -### Edit MFA User Portal config file - -Sign in the User Portal server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to C:\inetpub\wwwroot\MultiFactorAuth (or appropriate directory based on the virtual directory name) and edit the **web.config** file. -2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. -3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. -4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. -5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from **“** to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. ). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the Internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **web.config** file after changes have been made. - -### Create a DNS entry for the User Portal web site - -Sign-in the domain controller or administrative workstation with _Domain Admin_ equivalent credentials. -1. Open the **DNS Management** console. -2. In the navigation pane, expand the domain controller name node and **Forward Lookup Zones**. -3. In the navigation pane, select the node that has the name of your internal Active Directory domain name. -4. In the navigation pane, right-click the domain name node and click **New Host (A or AAAA)**. -5. In the **name** box, type the host name of the User Portal, such as *mfaweb* (this name must match the name of the certificate used to secure communication to the User Portal). In the IP address box, type the load balanced **IP address** of the User Portal. Click **Add Host**. -6. Close the **DNS Management** console. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the user portal application is properly installed on all user portal hosts -* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. -* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME -* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. -* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. -* Confirm you saved the changes to the web.config file. - -### Validating your work - -Windows Hello for Business is a distributed system, which on the surface appears complex and difficult. The key to a successful Windows Hello for Business deployment is to validate phases of work prior to moving to the next phase. - -Using a web browser, navigate to the URL provided in the *pf_up_pfwssdk_PfWsSdk* named value in the web.config file of any one of the user portal servers. The URL should be protected by a server authentication certificate and should prompt you for authentication. Authenticate to the web site using the username and password provided in the web.config file. Successful authentication and page view confirms the Web SDK configured on the primary MFA server is correctly configured and ready to work with the user portal. - -### Configuring the User Portal - -The User Portal section allows the administrator to install and configure the Multi-Factor Authentication User Portal. The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. -User Portal Administrators may be set up and granted permission to add new users and update existing users. - -#### Settings - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the Multi-Factor Authentication Server console. -2. From the Multi-Factor Authentication Server window, click the User Portal icon. - ![Azure MFA Server - User Portal settings](images/hello-mfa-user-portal-settings.png) - -3. On the Settings tab, type the URL your users use to access the User Portal. The URL should begin with https, such as `https://mfaportal.corp.contoso.com/mfa`. -The Multi-Factor Authentication Server uses this information when sending emails to users. -4. Select Allow users to log in and Allow user enrollment check boxes. -5. Select Allow users to select method. Select Phone call and select Text message (you can select Mobile application later once you have deployed the Mobile application web service). Select Automatically trigger user’s default method. -6. Select Allow users to select language. -7. Select Use security questions for fallback and select 4 from the Questions to answer list. - ->[!TIP] ->For more information on these settings and the behaviors they control, see [Deploy the user portal for the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal). - -#### Administrators - -The User Portal Settings tab allows the administrator to install and configure the User Portal. -1. Open the Multi-Factor Authentication Server console. -2. From the Multi-Factor Authentication Server window, click the User Portal icon. -3. On the Administrators tab, Click Add -4. In the Add Administrator dialog, Click Select User… to pick a user to install and manage the User Portal. Use the default permissions. -5. Click Add. - ->[!TIP] ->For more information on these settings and the behaviors they control, read the **Multi-Factor Authentication Server Help content**. - -#### Security Questions - -[Security questions](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#security-questions) for the User Portal may be customized to meet your requirements. The questions defined here will be offered as options for each of the four security questions a user is prompted to configure during their first log on to User Portal. The order of the questions is important since the first four items in the list will be used as defaults for the four security questions. - -#### Trusted IPs - -The [Trusted IPs](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#trusted-ips) tab allows you to skip Multi-Factor Authentication for User Portal log ins originating from specific IPs. For example, if users use the User Portal from the office and from home, you may decide you don't want their phones ringing for Multi-Factor Authentication while at the office. For this, you would specify the office subnet as a trusted IP entry. - -## Configure the AD FS Server to use the MFA for multifactor authentication - -You need to configure the AD FS server to use the MFA server. You do this by Installing the MFA Adapter on the primary AD FS Server. - -### Install the MFA AD FS Adapter - -Follow [Install a standalone instance of the AD FS adapter by using the Web Service SDK](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12#install-a-standalone-instance-of-the-ad-fs-adapter-by-using-the-web-service-sdk). You should follow this instructions on all AD FS servers. You can find the files needed on the MFA server. - -### Edit the MFA AD FS Adapter config file on all ADFS Servers - -Sign in the primary AD FS server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to **C:\inetpub\wwwroot\MultiFactorAuth** (or appropriate directory based on the virtual directory name) and edit the **MultiFactorAuthenticationAdfsAdapter.config** file. -2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. -3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. -4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. -5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from “ to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. ). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the Internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **MultiFactorAuthenticationAdfsAdapter.config** file after changes have been made. - -### Edit the AD FS Adapter Windows PowerShell cmdlet - -Sign in the primary AD FS server with _local administrator_ equivalent credentials. - -Edit the **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script adding `-ConfigurationFilePath ` to the end of the `Register-AdfsAuthenticationProvider` command where **\** is the full path to the **MultiFactorAuthenticationAdfsAdapter.config** file. - -### Run the AD FS Adapter PowerShell cmdlet - -Sign in the primary AD FS server with local administrator equivalent credentials. - -Run **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script in PowerShell to register the adapter. The adapter is registered as **WindowsAzureMultiFactorAuthentication**. - ->[!NOTE] ->You must restart the AD FS service for the registration to take effect. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the user portal application is properly installed on all user portal hosts -* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. -* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME -* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. -* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. -* Confirm you saved the changes to the web.config file. -* Confirm you restarted the AD FS Service after completing the configuration. - -## Test AD FS with the Multifactor Authentication connector - -Now, you should test your Azure Multi-Factor Authentication server configuration before proceeding any further in the deployment. The AD FS and Azure Multi-Factor Authentication server configurations are complete. - -1. In the **Multi-Factor Authentication** server, on the left, click **Users**. -2. In the list of users, select a user that is enabled and has a valid phone number to which you have access. -3. Click **Test**. -4. In the **Test User** dialog, provide the user’s password to authenticate the user to Active Directory. - -The Multi-Factor Authentication server communicates with the Azure MFA cloud service to perform a second factor authentication for the user. The Azure MFA cloud service contacts the phone number provided and asks for the user to perform the second factor authentication configured for the user. Successfully providing the second factor should result in the Multi-factor authentication server showing a success dialog. - - -## Follow the Windows Hello for Business on premises certificate trust deployment guide -1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) -2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) -3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) -4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md index 73e64d3e70..b7c09bf09e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -24,7 +24,7 @@ ms.reviewer: - Key trust -You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. @@ -33,9 +33,9 @@ On-premises certificate-based deployments of Windows Hello for Business needs on ## Enable Windows Hello for Business Group Policy -The Enable Windows Hello for Business Group Policy setting is the configuration needed for Windows to determine if a user should be attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to enabled. +The Group Policy setting determines whether users are allowed, and prompted, to enroll for Windows Hello for Business. It can be configured for computers or users. -You can configure the Enable Windows Hello for Business Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users that sign-in that computer to attempt a Windows Hello for Business enrollment. Deploying this policy setting to a user results in only that user attempting a Windows Hello for Business enrollment. Additionally, you can deploy the policy setting to a group of users so only those users attempt a Windows Hello for Business enrollment. If both user and computer policy settings are deployed, the user policy setting has precedence. +If you configure the Group Policy for computers, all users that sign-in to those computers will be allowed and prompted to enroll for Windows Hello for Business. If you configure the Group Policy for users, only those users will be allowed and prompted to enroll for Windows Hello for Business. For these settings to be configured using GPO, you need to download and install the latest Administrative Templates (.admx) for Windows 10. ## Create the Windows Hello for Business Group Policy object diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md index 19a03daf36..f4e3ef2457 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -16,36 +16,22 @@ localizationpriority: medium ms.date: 08/19/2018 ms.reviewer: --- -# Validate and Deploy Multifactor Authentication Services (MFA) +# Validate and Deploy Multi-factor Authentication (MFA) + +> [!IMPORTANT] +> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who would like to require multi-factor authentication from their users should use cloud-based Azure Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1 will be able to download the latest version, future updates and generate activation credentials as usual. **Applies to** -- Windows 10, version 1703 or later -- On-premises deployment -- Key trust +- Windows 10, version 1703 or later +- On-premises deployment +- Key trust -Windows Hello for Business requires all users perform an additional factor of authentication prior to creating and registering a Windows Hello for Business credential. Windows Hello for Business deployments use Azure Multi-Factor Authentication (Azure MFA) services for the secondary authentication. On-Premises deployments use Azure MFA server, an on-premises implementation that do not require synchronizing Active Directory credentials to Azure Active Directory. +Windows Hello for Business requires all users perform multi-factor authentication prior to creating and registering a Windows Hello for Business credential. On-premises deployments can use certificates, third-party authentication providers for AD FS, or a custom authentication provider for AD FS as an on-premises MFA option. -Azure Multi-Factor Authentication is an easy to use, scalable, and reliable solution that provides a second method of authentication so your users are always protected. -* **Easy to Use** - Azure Multi-Factor Authentication is simple to set up and use. The extra protection that comes with Azure Multi-Factor Authentication allows users to manage their own devices. Best of all, in many instances it can be set up with just a few simple clicks. -* **Scalable** - Azure Multi-Factor Authentication uses the power of the cloud and integrates with your on-premises AD and custom applications. This protection is even extended to your high-volume, mission-critical scenarios. -* **Always Protected** - Azure Multi-Factor Authentication provides strong authentication using the highest industry standards. -* **Reliable** - We guarantee 99.9% availability of Azure Multi-Factor Authentication. The service is considered unavailable when it is unable to receive or process verification requests for the two-step verification. +For information on available third-party authentication methods see [Configure Additional Authentication Methods for AD FS](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs). For creating a custom authentication method see [Build a Custom Authentication Method for AD FS in Windows Server](https://docs.microsoft.com/windows-server/identity/ad-fs/development/ad-fs-build-custom-auth-method) -## On-Premises Azure MFA Server - -On-premises deployments, both key and certificate trust, use the Azure MFA server where the credentials are not synchronized to Azure Active Directory. - -### Infrastructure - -A lab or proof-of-concept environment does not need high-availability or scalability. However, a production environment needs both of these. Ensure your environment considers and incorporates these factors, as necessary. All production environments should have a minimum of two MFA servers—one primary and one secondary server. The environment should have a minimum of two User Portal Servers that are load balanced using hardware or Windows Network Load Balancing. - -Please follow [Download the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#download-the-azure-multi-factor-authentication-server) to download Azure MFA server. - ->[!IMPORTANT] ->Make sure to validate the requirements for Azure MFA server, as outlined in [Install and Configure the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#install-and-configure-the-azure-multi-factor-authentication-server) before proceeding. Do not use installation instructions provided in the article. - -Once you have validated all the requirements, please proceed to [Configure or Deploy Multifactor Authentication Services](hello-key-trust-deploy-mfa.md). +Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multi-factor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-authentication-policies). ## Follow the Windows Hello for Business on premises certificate trust deployment guide 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 07989c7579..e5194ab324 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -105,7 +105,7 @@ Windows Hello for Business with a key does not support RDP. RDP does not support ## Learn more -[Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/en-us/itshowcase/implementing-windows-hello-for-business-at-microsoft) +[Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/itshowcase/implementing-windows-hello-for-business-at-microsoft) [Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index 68ee7e67cf..2ff12340f3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -47,7 +47,7 @@ There are six major categories you need to consider for a Windows Hello for Busi ### Baseline Prerequisites -Windows Hello for Business has a few baseline prerequisites with which you can begin. These baseline prerequisites are provided in the worksheet. +Windows Hello for Business has a few baseline prerequisites with which you can begin. These baseline prerequisites are provided in the worksheet. ### Deployment Options @@ -166,11 +166,13 @@ If your organization does not have cloud resources, write **On-Premises** in box ### Trust type +Hybrid Azure AD joined devices managed by Group Policy need the Windows Server 2016 AD FS role to issue certificates. Hybrid Azure AD joined devices and Azure AD joined devices managed by Intune or a compatible MDM need the Windows Server NDES server role to issue certificates. + Choose a trust type that is best suited for your organizations. Remember, the trust type determines two things. Whether you issue authentication certificates to your users and if your deployment needs Windows Server 2016 domain controllers. One trust model is not more secure than the other. The major difference is based on the organization comfort with deploying Windows Server 2016 domain controllers and not enrolling users with end entity certificates (key-trust) against using existing domain controllers (Windows Server 2008R2 or later) and needing to enroll certificates for all their users (certificate trust). -Because the certificate trust types issues certificates, there is more configuration and infrastructure needed to accommodate user certificate enrollment, which could also be a factor to consider in your decision. Additional infrastructure needed for certificate-trust deployments includes a certificate registration authority. Hybrid Azure AD joined devices managed by Group Policy need the Windows Server 2016 AD FS role to issue certificates. Hybrid Azure AD joined devices and Azure AD joined devices managed by Intune or a compatible MDM need the Windows Server NDES server role to issue certificates. +Because the certificate trust types issues certificates, there is more configuration and infrastructure needed to accommodate user certificate enrollment, which could also be a factor to consider in your decision. Additional infrastructure needed for certificate-trust deployments includes a certificate registration authority. In a federated environment, you need to activate the Device Writeback option in Azure AD Connect. If your organization wants to use the key trust type, write **key trust** in box **1b** on your planning worksheet. Write **Windows Server 2016** in box **4d**. Write **N/A** in box **5b**. diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png b/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png index bc2fdb105b..44bbc4a572 100644 Binary files a/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png and b/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png differ diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 062ad20bc7..57238c3214 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -1,5 +1,5 @@ --- -title: Password-less Strategy +title: Passwordless Strategy description: Reducing Password Usage Surface keywords: identity, PIN, biometric, Hello, passport, video, watch, passwordless ms.prod: w10 @@ -14,195 +14,195 @@ ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/20/2018 -ms.reviewer: +ms.reviewer: --- -# Password-less Strategy +# Passwordless Strategy -## Four steps to Password-less +## Four steps to password freedom -Over the past few years, Microsoft has continued their commitment to enabling a world without passwords. At Microsoft Ignite 2017, we shared our four-step approach to password-less. -![Password-less approach](images/four-steps-passwordless.png) +Over the past few years, Microsoft has continued their commitment to enabling a world without passwords. At Microsoft Ignite 2017, we shared our four-step approach to password freedom. +![Passwordless approach](images/four-steps-passwordless.png) ### 1. Develop a password replacement offering -Before you move away from passwords, you need something to replace them. With Windows 10, Microsoft introduced Windows Hello for Business, a strong, hardware protected two-factor credential that enables single-sign on to Azure Active Directory and Active Directory. +Before you move away from passwords, you need something to replace them. With Windows 10, Microsoft introduced Windows Hello for Business, a strong, hardware protected two-factor credential that enables single sign-on to Azure Active Directory and Active Directory. -Deploying Windows Hello for Business is the first step towards password-less. With Windows Hello for Business deployed, it coexists with password nicely. Users are likely to use Windows Hello for Business because of its convenience, especially when combined with biometrics. However, some workflows and applications may still need passwords. This early stage is about implementing an alternative and getting users used to it. +Deploying Windows Hello for Business is the first step towards a passwordless environment. Windows Hello for Business coexists nicely with existing password-based security. Users are likely to use Windows Hello for Business because of its convenience, especially when combined with biometrics. However, some workflows and applications may still need passwords. This early stage is about implementing an alternative and getting users used to it. ### 2. Reduce user-visible password surface area -With Windows Hello for Business and passwords coexisting in your environment, the next step towards password-less is to reduce the password surface. The environment and workflows need to stop asking for passwords. The goal of this step is to achieve a state where the user knows they have a password, but they never use it. This state helps decondition users from providing a password any time a password prompt shows on their computer. This is how passwords are phished. Users who rarely, if at all, use their password are unlikely to provide it. Password prompts are no longer the norm. +With Windows Hello for Business and passwords coexisting in your environment, the next step is to reduce the password surface. The environment and workflows need to stop asking for passwords. The goal of this step is to achieve a state where the users know they have a password, but they never use it. This state helps decondition users from providing a password any time a password prompt shows on their computer. This is how passwords are phished. Users who rarely, if at all, use their password are unlikely to provide it. Password prompts are no longer the norm. -### 3. Transition into a password-less deployment -Once the user-visible password surface has been eliminated, your organization can begin to transition those users into a password-less world. A world where: - - the user never types their password - - the user never changes their password - - the user does not know their password +### 3. Transition into a passwordless deployment +Once the user-visible password surface has been eliminated, your organization can begin to transition those users into a passwordless world. A world where: +- the users never type their password +- the users never change their password +- the users do not know their password -In this world, the user signs in to Windows 10 using Windows Hello for Business and enjoys single sign-on to Azure and Active Directory resources. If the user is forced to authenticate, their authentication uses Windows Hello for Business. +In this world, the user signs in to Windows 10 using Windows Hello for Business and enjoys single sign-on to Azure and Active Directory resources. If the user is forced to authenticate, their authentication uses Windows Hello for Business. ### 4. Eliminate passwords from the identity directory -The final step of the password-less story is where passwords simply do not exist. At this step, identity directories no longer persist any form of the password. This is where Microsoft achieves the long-term security promise of a truly password-less environment. +The final step of the passwordless story is where passwords simply do not exist. At this step, identity directories no longer persist any form of the password. This is where Microsoft achieves the long-term security promise of a truly passwordless environment. ## Methodology -The four steps to password-less provides a overall view of how Microsoft envisions the road to password-less. But the road to password-less is frequently traveled and derailed by many. The scope of work is vast and filled with many challenges and frustrations. Nearly everyone wants the instant gratification of password-less, but can easily become overwhelmed in any of the steps. You are not alone and Microsoft understands. While there are many ways to accomplish password-less, here is one recommendation based on several years of research, investigation, and customer conversations. +Four steps to password freedom provides an overall view of how Microsoft envisions the road to eliminating passwords. But this road is frequently traveled and derailed by many. The scope of work is vast and filled with many challenges and frustrations. Nearly everyone wants the instant gratification of achieving a passwordless environment, but can easily become overwhelmed by any of the steps. You are not alone and Microsoft understands. While there are many ways to accomplish freedom from passwords, here is one recommendation based on several years of research, investigation, and customer conversations. -### Prepare for the Journey -The road to password-less is a journey. The duration of that journey varies from each organization. It is important for IT decision makers to understand the criteria that influences the length of the journey. +### Prepare for the Journey +The road to being passwordless is a journey. The duration of that journey varies for each organization. It is important for IT decision-makers to understand the criteria influencing the length of that journey. -The most intuitive answer is the size of the organization, and that would be correct. However, what exactly determines size. One way to break down the size of the organization is: +The most intuitive answer is the size of the organization, and that would be correct. However, what exactly determines size? One way to break down the size of the organization is by creating a summary of the: - Number of departments -- Organization or department hierarchy +- Organization or department hierarchy - Number and type of applications and services - Number of work personas - Organization's IT structure -#### Number of departments -The number of departments within an organization varies. Most organizations have a common set of departments such as executive leadership, human resources, accounting, sales, and marketing. Other organizations will have those departments and additional ones such research and development or support. Small organizations may not segment their departments this explicitly while larger ones may. Additionally, there may be sub-departments, and sub-departments of those sub-departments as well. +#### Number of departments +The number of departments within an organization varies. Most organizations have a common set of departments such as executive leadership, human resources, accounting, sales, and marketing. Other organizations will have those departments and additional ones such research and development or support. Small organizations may not segment their departments this explicitly, while larger ones may. Additionally, there may be sub-departments, and sub-departments of those sub-departments as well. -You need to know all the departments within your organization and you need to know which departments use computers and which do not. It is fine if a department does not use computer (probably rare, but acceptable). This is one less department with which you need to concern yourself. Nevertheless, ensure this department is in your list and you have assessed it is not applicable for password-less. +You need to know all the departments within your organization and you need to know which departments use computers and which ones do not. It is fine if a department does not use computers (probably rare, but acceptable). This is one less department with which you need to concern yourself. Nevertheless, ensure this department is in your list and you have assessed that it is not applicable. -Your count of the departments must be thorough and accurate, as well as knowing the stakeholders for those departments that will you and your staff on the road to password-less. Realistically, many of us lose sight of our organization chart and how it grows or shrinks over time. This is why you need to inventory all of them. Also, do not forget to include external departments such as vendors or federated partners. If your organizations goes password-less, but partners continue to use passwords and then access your corporate resources, you should know about it and include them in your password-less strategy. +Your count of the departments must be thorough and accurate, as well as knowing the stakeholders for those departments that will put you and your staff on the road to password freedom. Realistically, many of us lose sight of our organizational chart and how it grows or shrinks over time. This is why you need to inventory all of them. Also, do not forget to include external departments such as vendors or federated partners. If your organization goes password-free, but your partners continue to use passwords and then access your corporate resources, you should know about it and include them in your passwordless strategy. #### Organization or department hierarchy -Organization and department hierarchy is the management layers within the departments or the organization as a whole. How the device is used, what applications and how they are used most likely differ between each department, but also within the structure of the department. To determine the correct password-less strategy, you need to know these differences across your organization. An executive leader is likely to use their device differently than a member of middle management in the sales department. Both of those use cases are likely different than how an individual contributor in the customer service department uses their device. +Organization and department hierarchy is the management layers within the departments or the organization as a whole. How the device is used, what applications and how they are used, most likely differs between each department, but also within the structure of the department. To determine the correct passwordless strategy, you need to know these differences across your organization. An executive leader is likely to use their device differently compared to a member of middle management in the sales department. Both of those user cases are probably different to how an individual contributor in the customer service department uses their device. #### Number and type of applications and services -The number of applications within an organization is simply astonishing and rarely is there one centralized list that is accurate. Applications and services are the most critical item in your password-less assessment. Applications and services take considerable effort to move to a different type of authentication. That is not to say changing policies and procedures is not a daunting task, but there is something to be said of updating a company's set of standard operating procedure and security policies compared to changing 100 lines (or more) of authentication code in the critical path of your internally developed CRM application. +The number of applications within an organization is simply astonishing and rarely is there one centralized list that is accurate. Applications and services are the most critical items in your passwordless assessment. Applications and services take considerable effort to move to a different type of authentication. That is not to say changing policies and procedures is not a daunting task, but there is something to be said of updating a company's set of standard operating procedures and security policies compared to changing 100 lines (or more) of authentication code in the critical path of your internally developed CRM application. -Capturing the number of applications used is easier once you have the departments, their hierarchy, and their stakeholders. In this approach, you should have an organized list of departments and the hierarchy in each. You can now associate the applications that are used by all levels within each department. You'll also want to document whether the application is internally developed or commercially available off-the-shelf (COTS). If the later, document the manufacture and the version. Also, do not forget web-based applications or services when inventorying applications. +Capturing the number of applications used is easier once you have the departments, their hierarchy, and their stakeholders. In this approach, you should have an organized list of departments and the hierarchy in each. You can now associate the applications that are used by all levels within each department. You'll also want to document whether the application is internally developed or commercially available off-the-shelf (COTS). If the latter, document the manufacturer and the version. Also, do not forget web-based applications or services when inventorying applications. #### Number of work personas -Work personas is where the three previous efforts converge. You know the departments, the organizational levels within each department, the numbers of applications used by each, respectively, and the type of application. From this you want to create a work persona. +Work personas is where the three previous efforts converge. You know the departments, the organizational levels within each department, the numbers of applications used by each, respectively, and the type of application. From this you want to create a work persona. -A work persona classifies a category of user, title or role (individual contributor, manager, middle manager, etc), within a specific department to a collection of applications used. There is a high possibility and probability that you will have many work personas. These work personas will become units of work an you will refer to them in documentation and in meetings. You need to give them a name. +A work persona classifies a category of user, title or role (individual contributor, manager, middle manager, etc.), within a specific department to a collection of applications used. There is a high probability that you will have many work personas. These work personas will become units of work, and you will refer to them in documentation and in meetings. You need to give them a name. -Give your personas easy and intuitive name like Abby Accounting, Mark Marketing, or Sue Sales. If the organization levels are common across departments then decide on a first name that represents the common levels in a department. For example, Abby could be the first name of an individual contributor in any given department, while the first name Sue could represent someone from middle management in any given department. Additionally, you can use suffixes such as (I, II, Senior, etc.) to further define departmental structure for a given persona. +Give your personas easy and intuitive names like Abby Accounting, Mark Marketing, or Sue Sales. If the organization levels are common across departments, then decide on a first name that represents the common levels in a department. For example, Abby could be the first name of an individual contributor in any given department, while the first name Sue could represent someone from middle management in any given department. Additionally, you can use suffixes such as (I, II, Senior, etc.) to further define departmental structure for a given persona. -Ultimately, create a naming convention that does not require your stakeholders and partners to read through a long list of tables or that needs a secret decoder ring. Also, if possible, try to keep the references as names of people. After all, you are talking about a person, who is in that department, who uses that specific software. +Ultimately, create a naming convention that does not require your stakeholders and partners to read through a long list of tables or a secret decoder ring. Also, if possible, try to keep the references as names of people. After all, you are talking about a person who is in that department and who uses that specific software. #### Organization's IT structure -IT department structures can vary more than the organization. Some IT departments are centralized while others are decentralized. Also, the road to password-less will likely have you interacting with the client authentication team, the deployment team, the security team, the PKI team, the Active Directory team, the cloud team, and the list continues. Most of these teams will be your partner on your journey to password-less. Ensure there is a password-less stakeholder on each of these teams and that the effort is understood and funded. +IT department structures can vary more than the organization. Some IT departments are centralized while others are decentralized. Also, the road to password freedom will probably have you interacting with the client authentication team, the deployment team, the security team, the PKI team, the Active Directory team, the cloud team, and the list continues. Most of these teams will be your partner on your journey to password freedom. Ensure there is a passwordless stakeholder on each of these teams, and that the effort is understood and funded. #### Assess your Organization -You have a ton of information. You have created your work personas, you identified your stakeholders throughout the different IT groups. Now what? +You have a ton of information. You have created your work personas, you have identified your stakeholders throughout the different IT groups. Now what? -By now you can see why its a journey and not a weekend project. You need to investigate user-visible password surfaces for each of your work personas. Once you identified the password surfaces, you need to mitigate them. Resolving some password surfaces are simple-- meaning a solution already exists in the environment and its a matter of moving users to it. Resolution to some passwords surfaces may exist, but are not deployed in your environment. That resolution results in a project that must be planned, tested, and then deployed. That is likely to span multiple IT departments with multiple people, and potentially one or more distributed systems. Those types of projects take time and need dedicated cycles. This same sentiment is true with in-house software development. Even with agile development methodologies, changing the way someone authenticates to an application is critical. Without the proper planning and testing, it has the potential to severely impact productivity. +By now you can see why it is a journey and not a weekend project. You need to investigate user-visible password surfaces for each of your work personas. Once you have identified the password surfaces, you need to mitigate them. Resolving some password surfaces are simple - meaning a solution already exists in the environment and it is only a matter of moving users to it. Resolution to some passwords surfaces may exist, but are not deployed in your environment. That resolution results in a project which must be planned, tested, and then deployed. That is likely to span multiple IT departments with multiple people, and potentially one or more distributed systems. Those types of projects take time and need dedicated cycles. This same sentiment is true with in-house software development. Even with agile development methodologies, changing the way someone authenticates to an application is critical. Without the proper planning and testing, it has the potential to severely impact productivity. -How long does it take to reach password-less? The answer is "it depends". It depends on the organizational alignment of a password-less strategy. Top-down agreement that password-less is the organization's goal makes conversations much easier. Easier conversations means less time spent convincing people and more time spent moving forward toward the goal. Top-down agreement on password-less as a priority within the ranks of other on-going IT projects helps everyone understand how to prioritize existing projects. Agreeing on priorities should reduce and minimize manager and executive level escalations. After these organizational discussions, modern project management techniques are used to continue the password-less effort. The organization allocates resources based on the priority (after they agreed on the strategy). Those resources will: +How long does it take to become passwordless? The answer is "it depends". It depends on the organizational alignment of a passwordless strategy. Top-down agreement that a passwordless environment is the organization's goal makes conversations much easier. Easier conversations means less time spent convincing people and more time spent moving forward toward the goal. Top-down agreement, as a priority within the ranks of other on-going IT projects, helps everyone understand how to prioritize existing projects. Agreeing on priorities should reduce and minimize manager and executive level escalations. After these organizational discussions, modern project management techniques are used to continue the passwordless effort. The organization allocates resources based on the priority (after they have agreed on the strategy). Those resources will: - work through the work personas - organize and deploy user acceptance testing - evaluate user acceptance testing results for user-visible password surfaces - work with stakeholders to create solutions that mitigate user-visible password surfaces - add the solution to the project backlog and prioritize against other projects -- deploy solution -- User acceptance testing to confirm the solution mitigates the user-visible password surface -- Repeat as needed +- deploy the solution +- perform user acceptance testing to confirm that the solution mitigates the user-visible password surface +- repeat the testing as needed -Your organization's journey to password-less may take some time to get there. Counting the number of work personas and the number of applications is probably a good indicator of the investment. Hopefully, your organization is growing, which means that the list of personas and the list of applications is unlikely to shrink. If the work to go password-less today is *n*, then it is likely that to go password-less tomorrow is *n x 2* or perhaps more, *n x n*. Do not let the size or duration of the project be a distraction. As you progress through each work persona, the actions and tasks will become more familiar for you and your stakeholders. Scope the project to sizable, realistic phases, pick the correct work personas, and soon you will see parts of your organization transition to password-less. +Your organization's journey to password freedom may take some time. Counting the number of work personas and the number of applications is probably a good indicator of the investment. Hopefully, your organization is growing, which means that the list of personas and the list of applications is unlikely to shrink. If the work to go passwordless today is *n*, then it is likely that to go passwordless tomorrow is *n x 2* or perhaps more, *n x n*. Do not let the size or duration of the project be a distraction. As you progress through each work persona, the actions and tasks will become more familiar for you and your stakeholders. Scope the project to sizable, realistic phases, pick the correct work personas, and soon you will see parts of your organization transition to a passwordless state. ### Where to start? -What is the best guidance for kicking off the journey to password-less? You will want to show you management a proof of concept as soon as possible. Ideally, you want to show this at each step of your password-less journey. Keeping password-less top of mind and showing consistent progress keeps everyone focused. +What is the best guidance for kicking off the journey to password freedom? You will want to show your management a proof of concept as soon as possible. Ideally, you want to show this at each step of your passwordless journey. Keeping your passwordless strategy top of mind and showing consistent progress keeps everyone focused. -#### Work persona -You begin with your work personas. These were part of your preparation process. They have a persona name, such as Abby Accounting II, or any other naming convention your organization defined. That work persona includes a list of all the applications that Abby uses to perform her assigned duties in the accounting department. To start, you need to pick a work persona. This is the targeted work persona you will enable to climb the password-less steps. +#### Work persona +You begin with your work personas. These were part of your preparation process. They have a persona name, such as Abby Accounting II, or any other naming convention your organization defined. That work persona includes a list of all the applications Abby uses to perform her assigned duties in the accounting department. To start, you need to pick a work persona. This is the targeted work persona you will enable to climb the steps to password freedom. > [!IMPORTANT] -> Avoid using any work personas from your IT department. This is probably the worst way to start the password-less journey. IT roles are very difficult and time consuming. IT workers typically have multiple credentials, run a multitude of scripts and custom applications, and are the worst offenders of password usage. It is better to save these work personas for the middle or end of your journey. +> Avoid using any work personas from your IT department. This is probably the worst way to start the passwordless journey. IT roles are very difficult and time consuming. IT workers typically have multiple credentials, run a multitude of scripts and custom applications, and are the worst offenders of password usage. It is better to save these work personas for the middle or end of your journey. -Review your collection of work personas. Early in your password-less journey, identify personas that have the fewest applications. These work personas could represent an entire department or two. These are the perfect work personas for your proof-of-concept or pilot. +Review your collection of work personas. Early in your passwordless journey, identify personas with the fewest applications. These work personas could represent an entire department or two. These are the perfect work personas for your proof-of-concept or pilot. -Most organizations host their proof of concept in a test lab or environment. To do that with password-less may be more challenging and take more time. To test in a lab, you must first duplicate the environment of the targeted persona. This could be a few days or several weeks depending on the complexity of targeted work persona. +Most organizations host their proof of concept in a test lab or environment. To do that with a password-free strategy may be more challenging and take more time. To test in a lab, you must first duplicate the environment of the targeted persona. This could take a few days or several weeks, depending on the complexity of the targeted work persona. -You will want to balance testing in a lab with providing results to management quickly. Continuing to show forward progress on your password-less journey is always good thing. If there are ways you can test in production with low or now risk, that may be advantageous to your time line. +You will want to balance lab testing with providing results to management quickly. Continuing to show forward progress on your journey to password freedom is always a good thing. If there are ways you can test in production with low or no risk, it may be advantageous to your timeline. ## The Process -The journey to password-less is to take each work persona through each password-less step. In the beginning, we encourage working with one persona at a time to ensure team members and stakeholders are familiar with the process. Once comfortable with the process, you can cover as many work personas in parallel as resources allow. The process looks something like +The journey to password freedom is to take each work persona through each step of the process. In the beginning, we encourage working with one persona at a time to ensure team members and stakeholders are familiar with the process. Once comfortable with the process, you can cover as many work personas in parallel as resources allow. The process looks something like this: -1. Password-less replacement offering (Step 1) - 1. Identify test users that represent the targeted work persona. +1. Passwordless replacement offering (Step 1) + 1. Identify test users representing the targeted work persona. 2. Deploy Windows Hello for Business to test users. - 3. Validate password and Windows Hello for Business work. + 3. Validate that passwords and Windows Hello for Business work. 2. Reduce User-visible Password Surface (Step 2) 1. Survey test user workflow for password usage. 2. Identify password usage and plan, develop, and deploy password mitigations. 3. Repeat until all user password usage is mitigated. - 4. Remove password capabilities from the Windows. - 5. Validate **all** workflows do not need passwords. -3. Transition into a password-less (Step 3) - 1. Awareness campaign and user education. - 2. Including remaining users that fit the work persona. - 3. Validate **all** users of the work personas do not need passwords. - 4. Configure user accounts to disallow password authentication. + 4. Remove password capabilities from Windows. + 5. Validate that **none of the workflows** need passwords. +3. Transition into a passwordless scenario (Step 3) + 1. Awareness campaign and user education. + 2. Include remaining users who fit the work persona. + 3. Validate that **none of the users** of the work personas need passwords. + 4. Configure user accounts to disallow password authentication. -After successfully moving a work persona to password-less, you can prioritize the remaining work personas, and repeat the process. +After successfully moving a work persona to password freedom, you can prioritize the remaining work personas and repeat the process. -### Password-less replacement offering (Step 1) -THe first step to password-less is providing an alternative to passwords. Windows 10 provides an affordable and easy in-box alternative to passwords, Windows Hello for Business, a strong, two-factor authentication to Azure Active Directory and Active Directory. +### Passwordless replacement offering (Step 1) +The first step to password freedom is providing an alternative to passwords. Windows 10 provides an affordable and easy in-box alternative to passwords, Windows Hello for Business, a strong, two-factor authentication to Azure Active Directory and Active Directory. #### Identify test users that represent the targeted work persona -A successful transition to password-less heavily relies on user acceptance testing. It is impossible for you to know how every work persona goes about their day-to-day activities, or to accurately validate them. You need to enlist the help of users that fit the targeted work persona. You only need a few users from the targeted work persona. As you cycle through step 2, you may want to change a few of the users (or add a few) as part of your validation process. +A successful transition relies on user acceptance testing. It is impossible for you to know how every work persona goes about their day-to-day activities, or how to accurately validate them. You need to enlist the help of users who fit the targeted work persona. You only need a few users from the targeted work persona. As you cycle through step 2, you may want to change a few of the users (or add a few) as part of your validation process. #### Deploy Windows Hello for Business to test users -Next, you will want to plan your Windows Hello for Business deployment. Your test users will need an alternative way to sign-in during step 2 of the password-less journey. Use the [Windows Hello for Business Planning Guide](hello-planning-guide.md) to help learn which deployment is best for your environment. Next, use the [Windows Hello for Business deployment guides](hello-deployment-guide.md) to deploy Windows Hello for Business. +Next, you will want to plan your Windows Hello for Business deployment. Your test users will need an alternative way to sign-in during step 2 of the journey to becoming passwordless. Use the [Windows Hello for Business Planning Guide](hello-planning-guide.md) to help learning which deployment is best suited for your environment. Next, use the [Windows Hello for Business deployment guides](hello-deployment-guide.md) to deploy Windows Hello for Business. -With the Windows Hello for Business infrastructure in place, you can limit Windows Hello for Business enrollments to the targeted work personas. The great news is you will only need to deploy the infrastructure once. When other targeted work personas need to provision Windows Hello for Business, you can simply add them to a group. You will use the first work persona to validate your Windows Hello for Business deployment. +With the Windows Hello for Business infrastructure in place, you can limit Windows Hello for Business enrollments to the targeted work personas. The great news is that you will only need to deploy the infrastructure once. When other targeted work personas need to provision Windows Hello for Business, you can simply add them to a group. You will use the first work persona to validate your Windows Hello for Business deployment. > [!NOTE] -> There are many different ways to connect a device to Azure. Deployments may vary based on how the device is joined to Azure Active Directory. Review your planning guide and deployment guide to ensure additional infrastructure is not needed for an additional Azure joined devices. +> There are many different ways to connect a device to Azure. Deployments may vary based on how the device is joined to Azure Active Directory. Review your planning guide and deployment guide to ensure additional infrastructure is not needed for an additional Azure joined devices. -#### Validate password and Windows Hello for Business work -In this first step, passwords and Windows Hello for Business must coexist. You want to validate that while your targeted work personas can sign in and unlock using Windows Hello for Business, but they can also sign-in, unlock, and use passwords as needed. Reducing the user-visible password surface too soon can create frustration and confusion with your targeted user personas. +#### Validate that passwords and Windows Hello for Business work +In this first step, passwords and Windows Hello for Business must coexist. You want to validate that while your targeted work personas can sign in and unlock using Windows Hello for Business, but they can also sign-in, unlock, and use passwords as needed. Reducing the user-visible password surface too soon can create frustration and confusion with your targeted user personas. ### Reduce User-visible Password Surface (Step 2) Before you move to step 2, ensure you have: -- selected your targeted work persona. -- identified your test users that represented the targeted work persona. +- selected your targeted work persona. +- identified your test users who represent the targeted work persona. - deployed Windows Hello for Business to test users. - validated passwords and Windows Hello for Business both work for the test users. #### Survey test user workflow for password usage -Now is the time to learn more about the targeted work persona. You have a list of applications they use, but you do not know what, why, when, and how frequently. This information is important as your further your progress through step 2. +Now is the time to learn more about the targeted work persona. You have a list of applications they use, but you do not know what, why, when, and how frequently. This information is important as you further your progress through step 2. -Test users create the workflows associated with the targeted work persona. Their initial goal is to do one simply task. Document password usage. This list is not a comprehensive one, but it gives you an idea of the type of information you want. The general idea is to learn about all the scenarios in which that work persona encounters a password. A good approach is: +Test users create the workflows associated with the targeted work persona. Their initial goal is to do one simple task: Document password usage. This list is not a comprehensive one, but it gives you an idea of the type of information you want. The general idea is to learn about all the scenarios in which that work persona encounters a password. A good approach is to ask yourself the following set of questions: - What is the name of the application that asked for a password?. - Why do they use the application that asked for a password? (Example: is there more than one application that can do the same thing?). - What part of their workflow makes them use the application? Try to be as specific as possible (I use application x to issue credit card refunds for amounts over y.). - How frequently do you use this application in a given day? week? -- Is the password you type into the application the same as the password you use to sign-in to Windows? +- Is the password you type into the application the same as the password you use to sign-in to Windows? -Some organizations will empower their users to write this information while some may insist on having a member of the IT department shadow them. An objective viewer may notice a password prompt that the user overlooks simply because of muscle memory. As previously mentioned, this information is critical. You could miss one password prompt which could delay the transition to password-less. +Some organizations will empower their users to write this information while some may insist on having a member of the IT department shadow them. An objective viewer may notice a password prompt that the user overlooks simply because of muscle memory. As previously mentioned, this information is critical. You could miss one password prompt that could delay the transition to being passwordless. #### Identify password usage and plan, develop, and deploy password mitigations -Your test users have provided you valuable information that describes the how, what, why and when they use a password. It is now time for your team to identify each of these password use cases and understand why the user must use a password. +Your test users have provided you valuable information that describes the how, what, why and when they use a password. It is now time for your team to identify each of these password use cases and understand why the user must use a password. -Create a master list of the scenarios. Each scenario should have a clear problem statement. Name the scenario with a one-sentence summary of the problem statement. Include in the scenario the results of your team's investigation as to why the user is prompted by a password. Include relevant, but accurate details. If its policy or procedure driven, then include the name and section of the policy that dictates why the workflow uses a password. +Create a master list of the scenarios. Each scenario should have a clear problem statement. Name the scenario with a one-sentence summary of the problem statement. Include in the scenario the results of your team's investigation as to why the user is prompted by a password. Include relevant, but accurate details. If it is policy or procedure driven, then include the name and section of the policy that dictates why the workflow uses a password. -Keep in mind your test users will not uncover all scenarios. Some scenarios you will need to force on your users because they low percentage scenarios. Remember to include scenarios like: +Keep in mind your test users will not uncover all scenarios. Some scenarios you will need to force on your users because they are low percentage scenarios. Remember to include scenarios like: - Provisioning a new brand new user without a password. - Users who forget the PIN or other remediation flows when the strong credential is unusable. -Next, review your master list of scenarios. You can start with the workflows that are dictated by process or policy or, you can begin with workflows that need technical solutions-- whichever of the two is easier or quicker. This will certainly vary by organization. +Next, review your master list of scenarios. You can start with the workflows that are dictated by process or policy, or you can begin with workflows that need technical solutions - whichever of the two is easier or quicker. This will certainly vary by organization. -Start mitigating password usages based on the workflows of your targeted personas. Document the mitigation as a solution to your scenario. Don't worry about the implementation details for the solution. A overview of the changes needed to reduce the password usages is all you need. If there are technical changes needed either infrastructure or code changes-- the exact details will likely be included in the project documentation. However your organization tracks projects, create a new project in that system. Associate your scenario to that project and start the processes needed to get that project funded. +Start mitigating password usages based on the workflows of your targeted personas. Document the mitigation as a solution to your scenario. Don't worry about the implementation details for the solution. An overview of the changes needed to reduce the password usages is all you need. If there are technical changes needed, either infrastructure or code changes, the exact details will likely be included in the project documentation. However your organization tracks projects, create a new project in that system. Associate your scenario to that project and start the processes needed to get that project funded. -Mitigating password usage with applications is one or the more challenging obstacle in the journey to password-less. If your organization develops the application, then you are in better shape the common-off-the-shelf software (COTS). +Mitigating password usage with applications is one of the more challenging obstacles in the passwordless journey. If your organization develops the application, then you are in better shape the common-off-the-shelf software (COTS). -The ideal mitigation for applications that prompt the user for a password is to enable those enable those applications to use an existing authenticated identity, such as Azure Active Directory or Active Directory. Work with the applications vendors to have them add support for Azure identities. For on-premises applications, have the application use Windows integrated authentication. The goal for your users should be a seamless single sign-on experience where each user authenticates once-- when they sign-in to Windows. Use this same strategy for applications that store their own identities in their own databases. +The ideal mitigation for applications that prompt the user for a password is to enable those applications to use an existing authenticated identity, such as Azure Active Directory or Active Directory. Work with the applications vendors to have them add support for Azure identities. For on-premises applications, have the application use Windows integrated authentication. The goal for your users should be a seamless single sign-on experience where each user authenticates once when they sign-in to Windows. Use this same strategy for applications that store their own identities in their own databases. -Each scenario on your master list should now have a problem statement, an investigation as to why the password was used, and a mitigation plan on how to make the password usage go away. Armed with this data, one-by-one, close the gaps on user-visible passwords. Change policies and procedures as needed, make infrastructure changes where possible. Convert in-house applications to use federated identities or Windows integrated authentication. Work with third-party software vendors to update their software to support federated identities or Windows integrated authenticate. +Each scenario on your master list should now have a problem statement, an investigation as to why the password was used, and a mitigation plan on how to make the password usage go away. Armed with this data, one-by-one, close the gaps on user-visible passwords. Change policies and procedures as needed, make infrastructure changes where possible. Convert in-house applications to use federated identities or Windows integrated authentication. Work with third-party software vendors to update their software to support federated identities or Windows integrated authentication. #### Repeat until all user password usage is mitigated -Some or all of your mitigations are in place. You need to validate your solutions have solved their problem statements. This is where you rely on your test users. You want to keep a good portion of your first test users, but this is a good opportunity to replace a few or add a few. Survey test users workflow for password usage. If all goes well, you have closed most or all the gaps. A few are likely to remain. Evaluate your solutions and what went wrong, change your solution as needed until you reach a solution that removes your user's need to type a password. If your stuck, others might be too. Use the forums from various sources or your network of IT colleague to describe your problem and see how others are solving it. If your out of options, contact Microsoft for assistance. +Some or all of your mitigations are in place. You need to validate that your solutions have solved their problem statements. This is where you rely on your test users. You want to keep a good portion of your first test users, but this is a good opportunity to replace a few or add a few. Survey test users workflow for password usage. If all goes well, you have closed most or all of the gaps. A few are likely to remain. Evaluate your solutions and what went wrong, change your solution as needed until you reach a solution that removes your user's need to type a password. If you are stuck, others might be too. Use the forums from various sources or your network of IT colleagues to describe your problem and see how others are solving it. If you are out of options, contact Microsoft for assistance. -#### Remove password capabilities from the Windows -You believe you have mitigates all the password usage for the targeted work persona. Now comes the true test-- configure Windows so the user cannot use a password. +#### Remove password capabilities from Windows +You believe you have mitigated all the password usage for the targeted work persona. Now comes the true test - configure Windows so the user cannot use a password. -Windows provides two ways to prevent your users from using passwords. You can use an interactive logon security policy to only allow Windows Hello for Business sign-in and unlocks, or you can exclude the password credential provider. +Windows provides two ways to prevent your users from using passwords. You can use an interactive logon security policy to only allow Windows Hello for Business sign-in and unlocks, or you can exclude the password credential provider. -##### Security Policy -You can use Group Policy to deploy an interactive logon security policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Windows Settings > Local Policy > Security Options**. The name of the policy setting depends on the version of the operating systems you use to configure Group Policy. +##### Security Policy +You can use Group Policy to deploy an interactive logon security policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Windows Settings > Local Policy > Security Options**. The name of the policy setting depends on the version of the operating systems you use to configure Group Policy. ![securityPolicyLocation](images/passwordless/00-securityPolicy.png) **Windows Server 2016 and earlier** @@ -213,33 +213,33 @@ The policy name for these operating systems is **Interactive logon: Require smar The policy name for these operating systems is **Interactive logon: Require Windows Hello for Business or smart card**. ![securityPolicyRSAT](images/passwordless/00-updatedsecuritypolicytext.png) -When you enables this security policy setting, Windows prevents users from signing in or unlocking with a password. The password credential provider remains visible to the user. If a user tries to use a password, Windows informs the user they must use Windows Hello for Business or a smart card. +When you enable this security policy setting, Windows prevents users from signing in or unlocking with a password. The password credential provider remains visible to the user. If a user tries to use a password, Windows informs the user they must use Windows Hello for Business or a smart card. #### Excluding the password credential provider -You can use Group Policy to deploy an administrative template policy settings to the computer. This policy settings is found under **Computer Configuration > Policies > Administrative Templates > Logon** +You can use Group Policy to deploy an administrative template policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Administrative Templates > Logon** ![HideCredProvPolicy](images/passwordless/00-hidecredprov.png) -The name of the policy setting is **Exclude credential providers**. The value to enter in the policy to hide the password credential provider is **60b78e88-ead8-445c-9cfd-0b87f74ea6cd**. +The name of the policy setting is **Exclude credential providers**. The value to enter in the policy to hide the password credential provider is **60b78e88-ead8-445c-9cfd-0b87f74ea6cd**. ![HideCredProvPolicy2](images/passwordless/01-hidecredprov.png) -Excluding the password credential provider hides the password credential provider from Windows and any application that attempts to load it. This prevents the user from entering a password using the credential provider. However, this does not prevent applications from creating their own password collection dialogs and prompting the user for a password using custom dialogs. +Excluding the password credential provider hides the password credential provider from Windows and any application that attempts to load it. This prevents the user from entering a password using the credential provider. However, this does not prevent applications from creating their own password collection dialogs and prompting the user for a password using custom dialogs. -#### Validate all workflows do not need passwords -This is the big moment. You have identified password usage, developed solutions to mitigate password usage, and have removed or disabled password usage from Windows. In this configuration, your users will not be able to use a passwords. Users will be blocked is any of their workflows ask them for a password. Ideally, your test users should be able to complete all the work flows of the targeted work persona without any password usage. Do not forget those low percentage work flows, such as provisioning a new user or a user that forgot their PIN or cannot use their strong credential. Ensure those scenarios are validated as well. +#### Validate that none of the workflows needs passwords +This is the big moment. You have identified password usage, developed solutions to mitigate password usage, and have removed or disabled password usage from Windows. In this configuration, your users will not be able to use a password. Users will be blocked if any of their workflows ask them for a password. Ideally, your test users should be able to complete all the work flows of the targeted work persona without any password usage. Do not forget those low percentage work flows, such as provisioning a new user or a user that forgot their PIN or cannot use their strong credential. Ensure those scenarios are validated as well. -### Transition into a password-less deployment (Step 3) -Congratulations! You are ready to transition one or more portions of your organization to a password-less deployment. You have validated the targeted work-persona is ready to go where the user no longer needs to know or use their password. You are just few steps away from declaring success. +### Transition into a passwordless deployment (Step 3) +Congratulations! You are ready to transition one or more portions of your organization to a passwordless deployment. You have validated that the targeted work persona is ready to go where the user no longer needs to know or use their password. You are just a few steps away from declaring success. #### Awareness and user education -In this last step, you are going to include the remaining users that fit the targeted work persona to the wonderful world of password-less. Before you do this, you want to invest in an awareness campaign. +In this last step, you are going to include the remaining users that fit the targeted work persona to the wonderful world of password freedom. Before you do this, you want to invest in an awareness campaign. -An awareness campaign is introduces the users to the new way of authenticating to their device, such as using Windows Hello for Business. The idea of the campaign is to positively promote the change to the users in advance. Explain the value and why your company is changing. The campaign should provide dates and encourage questions and feedback. This campaign can coincide user education, where you can show the users the changes and, if your environment allows, enable the users to try the experience out. +An awareness campaign introduces the users to the new way of authenticating to their device, such as using Windows Hello for Business. The idea of the campaign is to positively promote the change to the users in advance. Explain the value and why your company is changing. The campaign should provide dates and encourage questions and feedback. This campaign can coincide with user education, where you can show the users the changes and, if your environment allows, enable the users to try out the experience. #### Including remaining users that fit the work persona -You have implemented the awareness campaign for the targeted users. These users are informed and ready to transition to password-less. Add the remaining users that match the targeted work persona to your deployment. +You have implemented the awareness campaign for the targeted users. These users are informed and ready to transition to being passwordless. Add the remaining users that match the targeted work persona to your deployment. -#### Validate **all** users of the work personas do not need passwords. -You have successfully transitioned all users for the targeted work persona to password-less. Monitor the users within the work persona to ensure they do not encounter any issues while working in a password-less environment. +#### Validate that none of the users of the work personas needs passwords +You have successfully transitioned all users for the targeted work persona to being passwordless. Monitor the users within the work persona to ensure they do not encounter any issues while working in a passwordless environment. Track all reported issues. Set priority and severity to each reported issue and have your team triage the issues appropriately. As you triage issues, some things to consider are: - Is the reporting user performing a task outside the work persona? @@ -247,24 +247,24 @@ Track all reported issues. Set priority and severity to each reported issue and - Is the outage a result of a misconfiguration? - Is the outage a overlooked gap from step 2? -Each organization's priority and severity will differ however most organizations consider work stoppages fairly significant. Your team should pre-define levels of priority and severity. With each of these levels, create service level agreements (SLAs) for each combination of severity and priority and hold everyone accountable to those agreements. Reactive planning enables people to spend more time on the issue and resolving it and less time on process. +Each organization's priority and severity will differ. However, most organizations consider work stoppages to be fairly significant. Your team should predefine levels of priority and severity. With each of these levels, create service level agreements (SLAs) for each combination of severity and priority, and hold everyone accountable to those agreements. Reactive planning enables people to spend more time on the issue and resolving it, and less time on the process. -Resolve the issues per your service level agreements. Higher severity items may require returning some or all of the user's password surface. Clearly this is not the end goal but, do not let this slow your password-less momentum. Refer to how you reduced the user's password surface in step 2 and progress forward to a solution, deploying that solution and validating. +Resolve the issues per your service level agreements. Higher severity items may require returning some or all of the user's password surface. Clearly this is not the end goal, but do not let this slow down your momentum towards becoming passwordless. Refer to how you reduced the user's password surface in step 2 and progress forward to a solution, deploying that solution and validating it. #### Configure user accounts to disallow password authentication. -You transitioned all the users for the targeted work persona to a password-less environment and you have successfully validated all their workflows. The last step to complete the password-less transition is to remove the user's knowledge of the password and prevent the authenticating authority from accepting passwords. +You transitioned all the users for the targeted work persona to a passwordless environment and you have successfully validated all their workflows. The last step to complete the passwordless transition is to remove the user's knowledge of the password and prevent the authenticating authority from accepting passwords. You can change the user's password to random data and prevent domain controllers from allowing users to use passwords for interactive sign-ins using an account configuration on the user object. The account options on a user account includes an option -- **Smart card is required for interactive logon**, also known as (SCRIL). > [!NOTE] -> Do not confuse the Interactive Logon security policy for SCRIL. Security policies are enforced on the client (locally). A user account configured for SCRIL is enforced at the domain controller. +> Do not confuse the Interactive Logon security policy for SCRIL. Security policies are enforced on the client (locally). A user account configured for SCRIL is enforced at the domain controller. ![SCRIL setting on AD Users and Computers](images/passwordless/00-scril-dsa.png) **SCRIL setting for a user on Active Directory Users and Computers.** -When you configure an user account for SCRIL, Active Directory changes the affected user's password to a random 128 bits of data. Additionally, domain controllers hosting the user account do not allow the user to sign-in interactively with a password. Also, users will no longer be troubled with needing to change their password when it expires, because passwords for SCRIL users in domains with a Windows Server 2012 R2 or early domain functional level do not expire. The users is effectively password-less because: +When you configure a user account for SCRIL, Active Directory changes the affected user's password to a random 128 bits of data. Additionally, domain controllers hosting the user account do not allow the user to sign-in interactively with a password. Also, users will no longer be troubled with needing to change their password when it expires, because passwords for SCRIL users in domains with a Windows Server 2012 R2 or early domain functional level do not expire. The users are effectively passwordless because: - the do not know their password. - their password is 128 random bits of data and is likely to include non-typable characters. - the user is not asked to change their password @@ -274,7 +274,7 @@ When you configure an user account for SCRIL, Active Directory changes the affec **SCRIL setting for a user in Active Directory Administrative Center on Windows Server 2012.** > [!NOTE] -> Although a SCRIL user's password never expires in early domains, you can toggle the SCRIL configuration on a user account (clear the check box, save the settings, select the check box and save the settings) to generate a new random 128 bit password. However, you should consider upgrading the domain to Windows Server 2016 domain forest functional level and allow the domain controller to do this for you automatically. +> Although a SCRIL user's password never expires in early domains, you can toggle the SCRIL configuration on a user account (clear the check box, save the settings, select the check box and save the settings) to generate a new random 128 bit password. However, you should consider upgrading the domain to Windows Server 2016 domain forest functional level and allow the domain controller to do this for you automatically. ![SCRIL setting from ADAC on Windows Server 2016](images/passwordless/01-scril-adac-2016.png) **SCRIL setting for a user in Active Directory Administrative Center on Windows Server 2016.** @@ -283,14 +283,14 @@ When you configure an user account for SCRIL, Active Directory changes the affec > Windows Hello for Business was formerly known as Microsoft Passport. ##### Automatic password change for SCRIL configured users -Domains configured for Windows Server 2016 domain functional level can further secure the unknown password for a SCRIL enabled users by configuring the domain to automatically change the password for SCRIL users. +Domains configured for Windows Server 2016 domain functional level can further secure the unknown password for SCRIL-enabled users by configuring the domain to automatically change the password for SCRIL users. -In this configuration, passwords for SCRIL configured users expired based on Active Directory password policy settings. When the SCRIL user authentication from a domain controller, the domain controller recognizes the password has expired, and automatically generates a new random 128 bit password for the user as part of the authentication. What is great about this feature is your users do not experience any change password notifications or experience any authentication outages. +In this configuration, passwords for SCRIL-configured users expire based on Active Directory password policy settings. When the SCRIL user authenticates from a domain controller, the domain controller recognizes the password has expired, and automatically generates a new random 128 bit password for the user as part of the authentication. What is great about this feature is your users do not experience any change password notifications or any authentication outages. ![Rotate Password 2016](images/passwordless/02-rotate-scril-2016.png) > [!NOTE] -> Some components within Windows 10, such as Data Protection APIs and NTLM authentication, still need artifacts of a user possessing a password. This configuration provides interoperability with while reducing the usage surface while Microsoft continues to close the gaps to remove the password completely. +> Some components within Windows 10, such as Data Protection APIs and NTLM authentication, still need artifacts of a user possessing a password. This configuration provides interoperability by reducing the usage surface while Microsoft continues to close the gaps to remove the password completely. ## The Road Ahead -The information presented here is just the beginning. We will update this guide with improved tool and methods and scenarios, like Azure AD joined and MDM managed environments, As we continue to invest in password-less, we would love to hear from you. Your feedback is important. Send us an email at [pwdless@microsoft.com](mailto:pwdless@microsoft.com?subject=Passwordless%20Feedback). +The information presented here is just the beginning. We will update this guide with improved tools, methods, and scenarios, like Azure AD joined and MDM managed environments. As we continue to invest in a passwordless future, we would love to hear from you. Your feedback is important. Send us an email at [pwdless@microsoft.com](mailto:pwdless@microsoft.com?subject=Passwordless%20Feedback). diff --git a/windows/security/identity-protection/hello-for-business/toc.md b/windows/security/identity-protection/hello-for-business/toc.md index c286b36226..3fe33458fc 100644 --- a/windows/security/identity-protection/hello-for-business/toc.md +++ b/windows/security/identity-protection/hello-for-business/toc.md @@ -1,13 +1,18 @@ # [Windows Hello for Business](hello-identity-verification.md) -##[Password-less Strategy](passwordless-strategy.md) +## [Password-less Strategy](passwordless-strategy.md) ## [Windows Hello for Business Overview](hello-overview.md) ## [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) ## [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) ## [Windows Hello for Business Features](hello-features.md) +### [Conditional Access](hello-feature-conditional-access.md) +### [Dual Enrollment](hello-feature-dual-enrollment.md) +### [Dynamic Lock](hello-feature-dynamic-lock.md) ### [Multifactor Unlock](feature-multifactor-unlock.md) +### [PIN Reset](hello-feature-pin-reset.md) +### [Remote Desktop](hello-feature-remote-desktop.md) ## [How Windows Hello for Business works](hello-how-it-works.md) ### [Technical Deep Dive](hello-how-it-works.md#technical-deep-dive) @@ -53,7 +58,6 @@ #### [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) #### [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) #### [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) -##### [Configure or Deploy Multifactor Authentication Services](hello-cert-trust-deploy-mfa.md) #### [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) ## [Windows Hello and password changes](hello-and-password-changes.md) @@ -63,4 +67,4 @@ ### [Windows Hello for Business Videos](hello-videos.md) ## [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) -## [Event ID 300 - Windows Hello successfully created](hello-event-300.md) \ No newline at end of file +## [Event ID 300 - Windows Hello successfully created](hello-event-300.md) diff --git a/windows/security/identity-protection/index.md b/windows/security/identity-protection/index.md index b6001998ed..d55a5400cc 100644 --- a/windows/security/identity-protection/index.md +++ b/windows/security/identity-protection/index.md @@ -17,7 +17,7 @@ ms.date: 02/05/2018 # Identity and access management -Learn more about identity annd access management technologies in Windows 10 and Windows 10 Mobile. +Learn more about identity and access management technologies in Windows 10 and Windows 10 Mobile. | Section | Description | |-|-| diff --git a/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md b/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md index a181ec72c9..65e353cb81 100644 --- a/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md +++ b/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index df25b0e70c..a4029266dd 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -15,7 +15,7 @@ ms.localizationpriority: medium ms.date: 01/12/2018 ms.reviewer: --- -# Protect Remote Desktop credentials with Windows Defender Remote Credential Guard +# Protect Remote Desktop credentials with Windows Defender Remote Credential Guard **Applies to** - Windows 10 @@ -79,7 +79,7 @@ For helpdesk support scenarios in which personnel require administrative access Therefore, we recommend instead that you use the Restricted Admin mode option. For helpdesk support scenarios, RDP connections should only be initiated using the /RestrictedAdmin switch. This helps ensure that credentials and other user resources are not exposed to compromised remote hosts. For more information, see [Mitigating Pass-the-Hash and Other Credential Theft v2](https://download.microsoft.com/download/7/7/A/77ABC5BD-8320-41AF-863C-6ECFB10CB4B9/Mitigating-Pass-the-Hash-Attacks-and-Other-Credential-Theft-Version-2.pdf). -To further harden security, we also recommend that you implement Local Administrator Password Solution (LAPS), a Group Policy client-side extension (CSE) introduced in Windows 8.1 that automates local administrator password management. LAPS mitigates the risk of lateral escalation and other cyberattacks facilitated when customers use the same administrative local account and password combination on all their computers. You can download and install LAPS [here](https://www.microsoft.com/en-us/download/details.aspx?id=46899). +To further harden security, we also recommend that you implement Local Administrator Password Solution (LAPS), a Group Policy client-side extension (CSE) introduced in Windows 8.1 that automates local administrator password management. LAPS mitigates the risk of lateral escalation and other cyberattacks facilitated when customers use the same administrative local account and password combination on all their computers. You can download and install LAPS [here](https://www.microsoft.com/download/details.aspx?id=46899). For further information on LAPS, see [Microsoft Security Advisory 3062591](https://technet.microsoft.com/library/security/3062591.aspx). diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index 695c7d15b9..5e5003aa9f 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 33bbc7b730..89ddb7fa8a 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index 2bf4650d4b..997384b9e0 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index cd06dda9a5..a408a47cf2 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index 9013c10df6..9ee26abcab 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-events.md b/windows/security/identity-protection/smart-cards/smart-card-events.md index cb5e74736a..830bfcfcfc 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-events.md +++ b/windows/security/identity-protection/smart-cards/smart-card-events.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index dd70a1c7c6..992e66a6c7 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md index 08f350db77..56228dff85 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md +++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index 6f0f59e3d1..dd8812970c 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md index da07ec19a4..a913f4c769 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md index 63d129266c..794b8e096c 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md index 747e68618a..03d90751c8 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md +++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index 32d9213cda..4a92507705 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md index 35ae0d0d3d..e8d50dc97f 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/user-account-control/user-account-control-overview.md b/windows/security/identity-protection/user-account-control/user-account-control-overview.md index ad92df7445..15ea04101f 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-overview.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-overview.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.localizationpriority: medium audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md index a6bec76e99..e6ee5742aa 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md index 34667eb1f8..5e643f7d75 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md index d7653b982e..f0b0220678 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index fd93a5fd19..34daf7a11e 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md index b81fc4b4cd..8d19264cfa 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: conceptual @@ -26,6 +26,9 @@ This topic for IT professional provides an overview of the virtual smart card te - [Smart Cards](../smart-cards/smart-card-windows-smart-card-technical-reference.md) +> [!NOTE] +> [Windows Hello for Business](../hello-for-business/hello-identity-verification.md) is the modern, two-factor authentication for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date has been set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. We recommend that new Windows 10 deployments use Windows Hello for Business. Virtual smart cards remain supported for Windows 7 and Windows 8. + ## Feature description Virtual smart card technology from Microsoft offers comparable security benefits to physical smart cards by using two-factor authentication. Virtual smart cards emulate the functionality of physical smart cards, but they use the Trusted Platform Module (TPM) chip that is available on computers in many organizations, rather than requiring the use of a separate physical smart card and reader. Virtual smart cards are created in the TPM, where the keys that are used for authentication are stored in cryptographically secured hardware. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md index f2ce999ee5..cb25136eb0 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md index 42f77aef08..aab4745ee9 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index bdf8fb184c..db7f20bb3e 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md index 73746dfff2..22355b9383 100644 --- a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md +++ b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp ms.localizationpriority: medium ms.date: 02/08/2018 ms.reviewer: diff --git a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md index 7b32119ae3..a162e20e45 100644 --- a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md +++ b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md @@ -9,7 +9,7 @@ author: dulcemontemayor ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # How to use single sign on (SSO) over VPN and Wi-Fi connections diff --git a/windows/security/identity-protection/vpn/vpn-authentication.md b/windows/security/identity-protection/vpn/vpn-authentication.md index 7bb106781a..9f6f6fa2a5 100644 --- a/windows/security/identity-protection/vpn/vpn-authentication.md +++ b/windows/security/identity-protection/vpn/vpn-authentication.md @@ -10,7 +10,7 @@ ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # VPN authentication options diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md index 178333b713..09ca26d20e 100644 --- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md +++ b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md @@ -10,7 +10,7 @@ ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # VPN auto-triggered profile options @@ -59,7 +59,7 @@ Always On is a feature in Windows 10 which enables the active VPN profile to con When the trigger occurs, VPN tries to connect. If an error occurs or any user input is needed, the user is shown a toast notification for additional interaction. -When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**. +When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**. Devices with multiple users have the same restriction: only one profile and therefore only one user will be able to use the Always On triggers. Preserving user Always On preference diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md index 4e6d182cfc..674df551a5 100644 --- a/windows/security/identity-protection/vpn/vpn-conditional-access.md +++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md @@ -1,12 +1,12 @@ --- title: VPN and conditional access (Windows 10) -description: The VPN client is now able to integrate with the cloud-based Conditional Access Platform to provide a device compliance option for remote clients. Conditional Access is a policy-based evaluation engine that lets you create access rules for any Azure Active Directory (Azure AD) connected application. +description: The VPN client is now able to integrate with the cloud-based Conditional Access Platform to provide a device compliance option for remote clients. Conditional Access is a policy-based evaluation engine that lets you create access rules for any Azure Active Directory (Azure AD) connected application. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.reviewer: ms.localizationpriority: medium diff --git a/windows/security/identity-protection/vpn/vpn-connection-type.md b/windows/security/identity-protection/vpn/vpn-connection-type.md index cb033205df..b6fab222d1 100644 --- a/windows/security/identity-protection/vpn/vpn-connection-type.md +++ b/windows/security/identity-protection/vpn/vpn-connection-type.md @@ -10,7 +10,7 @@ ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # VPN connection types diff --git a/windows/security/identity-protection/vpn/vpn-guide.md b/windows/security/identity-protection/vpn/vpn-guide.md index d5c7cfca83..c72139b6db 100644 --- a/windows/security/identity-protection/vpn/vpn-guide.md +++ b/windows/security/identity-protection/vpn/vpn-guide.md @@ -9,7 +9,7 @@ ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # Windows 10 VPN technical guide diff --git a/windows/security/identity-protection/vpn/vpn-name-resolution.md b/windows/security/identity-protection/vpn/vpn-name-resolution.md index e4f509397e..5c277ef964 100644 --- a/windows/security/identity-protection/vpn/vpn-name-resolution.md +++ b/windows/security/identity-protection/vpn/vpn-name-resolution.md @@ -10,7 +10,7 @@ ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # VPN name resolution diff --git a/windows/security/identity-protection/vpn/vpn-profile-options.md b/windows/security/identity-protection/vpn/vpn-profile-options.md index a234d017d0..6931c47d7b 100644 --- a/windows/security/identity-protection/vpn/vpn-profile-options.md +++ b/windows/security/identity-protection/vpn/vpn-profile-options.md @@ -9,7 +9,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp ms.localizationpriority: medium ms.date: 05/17/2018 --- @@ -300,7 +300,7 @@ The following is a sample plug-in VPN profile. This blob would fall under the Pr After you configure the settings that you want using ProfileXML, you can apply it using Intune and a **Custom Configuration (Windows 10 Desktop and Mobile and later)** policy. 1. Sign into the [Azure portal](https://portal.azure.com). -2. Go to **Intune** > **Device Configuration** > **Properties**. +2. Go to **Intune** > **Device Configuration** > **Profiles**. 3. Click **Create Profile**. 4. Enter a name and (optionally) a description. 5. Choose **Windows 10 and later** as the platform. diff --git a/windows/security/identity-protection/vpn/vpn-routing.md b/windows/security/identity-protection/vpn/vpn-routing.md index e9652fe89a..c8ce525e53 100644 --- a/windows/security/identity-protection/vpn/vpn-routing.md +++ b/windows/security/identity-protection/vpn/vpn-routing.md @@ -10,7 +10,7 @@ ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # VPN routing decisions diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md index 250ee154a5..18e7b41ec9 100644 --- a/windows/security/identity-protection/vpn/vpn-security-features.md +++ b/windows/security/identity-protection/vpn/vpn-security-features.md @@ -10,7 +10,7 @@ ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # VPN security features diff --git a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md index 701083c55c..26db02bc64 100644 --- a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md +++ b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md index d08c6e889a..c1b6366ec7 100644 --- a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md index 144180cd40..7bb74bdb71 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md index 8029b9b1b9..10924772a5 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md +++ b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -206,7 +206,7 @@ This command returns the volumes on the target, current encryption status and vo For example, suppose that you want to enable BitLocker on a computer without a TPM chip. To properly enable BitLocker for the operating system volume, you will need to use a USB flash drive as a startup key to boot (in this example, the drive letter E). You would first create the startup key needed for BitLocker using the –protectors option and save it to the USB drive on E: and then begin the encryption process. You will need to reboot the computer when prompted to complete the encryption process. -``` syntax +```powershell manage-bde –protectors -add C: -startupkey E: manage-bde -on C: ``` @@ -237,7 +237,7 @@ Data volumes use the same syntax for encryption as operating system volumes but A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on. -``` syntax +```powershell manage-bde -protectors -add -pw C: manage-bde -on C: ``` @@ -382,13 +382,13 @@ Occasionally, all protectors may not be shown when using Get-BitLockerVo If you wanted to remove the existing protectors prior to provisioning BitLocker on the volume, you can utilize the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this requires the GUID associated with the protector to be removed. A simple script can pipe the values of each **Get-BitLockerVolume** return out to another variable as seen below: -``` syntax +```powershell $vol = Get-BitLockerVolume $keyprotectors = $vol.KeyProtector ``` Using this, we can display the information in the **$keyprotectors** variable to determine the GUID for each protector. Using this information, we can then remove the key protector for a specific volume using the command: -``` syntax +```powershell Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" ``` > **Note:**  The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command. @@ -398,19 +398,19 @@ Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" Using the BitLocker Windows PowerShell cmdlets is similar to working with the manage-bde tool for encrypting operating system volumes. Windows PowerShell offers users a lot of flexibility. For example, users can add the desired protector as part command for encrypting the volume. Below are examples of common user scenarios and steps to accomplish them using the BitLocker cmdlets for Windows PowerShell. To enable BitLocker with just the TPM protector. This can be done using the command: -``` syntax +```powershell Enable-BitLocker C: ``` The example below adds one additional protector, the StartupKey protectors, and chooses to skip the BitLocker hardware test. In this example, encryption starts immediately without the need for a reboot. -``` syntax +```powershell Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTest ``` ### Data volume Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user defined password. Last, encryption begins. -``` syntax +```powershell $pw = Read-Host -AsSecureString Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw @@ -423,12 +423,12 @@ The ADAccountOrGroup protector is an Active Directory SID-based protector. This To add an ADAccountOrGroup protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. -``` syntax +```powershell Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator ``` For users who wish to use the SID for the account or group, the first step is to determine the SID associated with the account. To get the specific SID for a user account in Windows PowerShell, use the following command: -``` syntax +```powershell get-aduser -filter {samaccountname -eq "administrator"} ``` > **Note:**  Use of this command requires the RSAT-AD-PowerShell feature. @@ -437,7 +437,7 @@ get-aduser -filter {samaccountname -eq "administrator"} In the example below, the user wishes to add a domain SID based protector to the previously encrypted operating system volume. The user knows the SID for the user account or group they wish to add and uses the following command: -``` syntax +```powershell Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup "" ``` > **Note:**  Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes. @@ -469,7 +469,7 @@ Administrators who prefer a command line interface can utilize manage-bde to che To check the status of a volume using manage-bde, use the following command: -``` syntax +```powershell manage-bde -status ``` > **Note:**  If no volume letter is associated with the -status command, all volumes on the computer display their status. @@ -480,7 +480,7 @@ Windows PowerShell commands offer another way to query BitLocker status for volu Using the Get-BitLockerVolume cmdlet, each volume on the system will display its current BitLocker status. To get information that is more detailed on a specific volume, use the following command: -``` syntax +```powershell Get-BitLockerVolume -Verbose | fl ``` This command will display information about the encryption method, volume type, key protectors, etc. @@ -506,12 +506,12 @@ Once decryption is complete, the drive will update its status in the control pan Decrypting volumes using manage-bde is very straightforward. Decryption with manage-bde offers the advantage of not requiring user confirmation to start the process. Manage-bde uses the -off command to start the decryption process. A sample command for decryption is: -``` syntax +```powershell manage-bde -off C: ``` This command disables protectors while it decrypts the volume and removes all protectors when decryption is complete. If a user wishes to check the status of the decryption, they can use the following command: -``` syntax +```powershell manage-bde -status C: ``` ### Decrypting volumes using the BitLocker Windows PowerShell cmdlets @@ -520,12 +520,12 @@ Decryption with Windows PowerShell cmdlets is straightforward, similar to manage Using the Disable-BitLocker command, they can remove all protectors and encryption at the same time without the need for additional commands. An example of this command is: -``` syntax +```powershell Disable-BitLocker ``` If a user did not want to input each mount point individually, using the `-MountPoint` parameter in an array can sequence the same command into one line without requiring additional user input. An example command is: -``` syntax +```powershell Disable-BitLocker -MountPoint E:,F:,G: ``` ## See also diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index 2a85725c2c..0177ea0901 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md index 5431485c7f..78092912cd 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md index 8c9c724383..b9b8646bf0 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md +++ b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index 26bf69d169..fce071badf 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index e3226ec136..38e7cefb70 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md index 70ba14d6a6..3a17290bcd 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -52,14 +52,14 @@ The `servermanager` Windows PowerShell module can use either the `Install-Window By default, installation of features in Windows PowerShell does not include optional sub-features or management tools as part of the install process. This can be seen using the `-WhatIf` option in Windows PowerShell. -``` syntax +```powershell Install-WindowsFeature BitLocker -WhatIf ``` The results of this command show that only the BitLocker Drive Encryption feature installs using this command. To see what would be installed with the BitLocker feature including all available management tools and sub-features, use the following command: -``` syntax +```powershell Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -WhatIf | fl ``` @@ -75,7 +75,7 @@ The result of this command displays the following list of all the administration The command to complete a full installation of the BitLocker feature with all available features and then rebooting the server at completion is: -``` syntax +```powershell Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -Restart ``` @@ -85,7 +85,7 @@ Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools - The `dism` Windows PowerShell module uses the `Enable-WindowsOptionalFeature` cmdlet to install features. The BitLocker feature name for BitLocker is `BitLocker`. The `dism` module does not support wildcards when searching for feature names. To list feature names for the `dism` module, use the `Get-WindowsOptionalFeatures` cmdlet. The following command will list all of the optional features in an online (running) operating system. -``` syntax +```powershell Get-WindowsOptionalFeature -Online | ft ``` @@ -93,13 +93,13 @@ From this output, we can see that there are three BitLocker related optional fea To install BitLocker using the `dism` module, use the following command: -``` syntax +```powershell Enable-WindowsOptionalFeature -Online -FeatureName BitLocker -All ``` This command will prompt the user for a reboot. The Enable-WindowsOptionalFeature cmdlet does not offer support for forcing a reboot of the computer. This command does not include installation of the management tools for BitLocker. For a complete installation of BitLocker and all available management tools, use the following command: -``` syntax +```powershell Enable-WindowsOptionalFeature -Online -FeatureName BitLocker, BitLocker-Utilities -All ``` ## More information diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index 6545ca0992..23276f3144 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -313,7 +313,7 @@ Troubleshooting Network Unlock issues begins by verifying the environment. Many - Verify the clients were rebooted after applying the policy. - Verify the **Network (Certificate Based)** protector is listed on the client. This can be done using either manage-bde or Windows PowerShell cmdlets. For example the following command will list the key protectors currently configured on the C: drive of the lcoal computer: - ``` syntax + ```powershell manage-bde –protectors –get C: ``` >**Note:** Use the output of manage-bde along with the WDS debug log to determine if the proper certificate thumbprint is being used for Network Unlock diff --git a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md index fa1f49ee5d..6aa957697c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md index b89ced627d..caee851596 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md +++ b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md @@ -7,12 +7,12 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 02/28/2019 ms.reviewer: --- @@ -48,7 +48,7 @@ This is applicable to Azure Hybrid AD as well. For Windows PCs and Windows Phones that enroll using **Connect to work or school account**, BitLocker Device Encryption is managed over MDM, the same as devices joined to Azure AD. -## Managing servers +## Managing servers Servers are often installed, configured, and deployed using PowerShell, so the recommendation is to also use [PowerShell to enable BitLocker on a server](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md#bitlocker-cmdlets-for-windows-powershell), ideally as part of the initial setup. BitLocker is an Optional Component (OC) in Windows Server, so follow the directions in [BitLocker: How to deploy on Windows Server 2012 and later](bitlocker-how-to-deploy-on-windows-server.md) to add the BitLocker OC. diff --git a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md index 0405362524..79f29f59ec 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md index a6622c810c..000e35587d 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index d15b81c76a..0707268a3a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -3,7 +3,7 @@ title: BitLocker (Windows 10) description: This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features. ms.assetid: 40526fcc-3e0d-4d75-90e0-c7d0615f33b2 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md index f21beec5e9..16272b6213 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -278,26 +278,25 @@ You can reset the recovery password in two ways: 1. Remove the previous recovery password - ``` syntax + ```powershell Manage-bde –protectors –delete C: –type RecoveryPassword ``` 2. Add the new recovery password - ``` syntax + ```powershell Manage-bde –protectors –add C: -RecoveryPassword - ``` 3. Get the ID of the new recovery password. From the screen copy the ID of the recovery password. - ``` syntax + ```powershell Manage-bde –protectors –get C: -Type RecoveryPassword - ``` + 4. Backup the new recovery password to AD DS - ``` syntax + ```powershell Manage-bde –protectors –adbackup C: -id {EXAMPLE6-5507-4924-AA9E-AFB2EB003692} ``` >**Warning:**  You must include the braces in the ID string. @@ -315,7 +314,7 @@ You can reset the recovery password in two ways: You can use the following sample script to create a VBScript file to reset the recovery passwords. -``` syntax +```vb ' Target drive letter strDriveLetter = "c:" ' Target computer name @@ -404,7 +403,7 @@ The following sample script exports all previously-saved key packages from AD D You can use the following sample script to create a VBScript file to retrieve the BitLocker key package from AD DS. -``` syntax +```vb ' -------------------------------------------------------------------------------- ' Usage ' -------------------------------------------------------------------------------- @@ -551,7 +550,7 @@ The following sample script exports a new key package from an unlocked, encrypte **cscript GetBitLockerKeyPackage.vbs -?** -``` syntax +```vb ' -------------------------------------------------------------------------------- ' Usage ' -------------------------------------------------------------------------------- diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md index a12e4c3b02..6bb6a48e28 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md @@ -9,12 +9,12 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 02/28/2019 --- # BitLocker Security FAQ diff --git a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md index 347a0003b8..f5de0c1816 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md @@ -3,7 +3,7 @@ title: BitLocker To Go FAQ (Windows 10) description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md index de4112e3d5..3ec8b9d7db 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index 30fea18843..bb6cc83966 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -9,12 +9,12 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 02/28/2019 --- # BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker @@ -46,7 +46,7 @@ Listed below are examples of basic valid commands for operating system volumes. A good practice when using manage-bde is to determine the volume status on the target system. Use the following command to determine volume status: -``` syntax +```powershell manage-bde -status ``` This command returns the volumes on the target, current encryption status, encryption method, and volume type (operating system or data) for each volume: @@ -55,7 +55,7 @@ This command returns the volumes on the target, current encryption status, encry The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process. -``` syntax +```powershell manage-bde –protectors -add C: -startupkey E: manage-bde -on C: ``` @@ -64,7 +64,7 @@ manage-bde -on C: An alternative to the startup key protector on non-TPM hardware is to use a password and an **ADaccountorgroup** protector to protect the operating system volume. In this scenario, you would add the protectors first. This is done with the command: -``` syntax +```powershell manage-bde -protectors -add C: -pw -sid ``` @@ -72,13 +72,13 @@ This command will require you to enter and then confirm the password protector b On computers with a TPM it is possible to encrypt the operating system volume without any defined protectors using manage-bde. The command to do this is: -``` syntax +```powershell manage-bde -on C: ``` This will encrypt the drive using the TPM as the default protector. If you are not sure if a TPM protector is available, to list the protectors available for a volume, run the following command: -``` syntax +```powershell manage-bde -protectors -get ``` ### Using manage-bde with data volumes @@ -87,7 +87,7 @@ Data volumes use the same syntax for encryption as operating system volumes but A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on. -``` syntax +```powershell manage-bde -protectors -add -pw C: manage-bde -on C: ``` @@ -257,7 +257,7 @@ If you want to remove the existing protectors prior to provisioning BitLocker on A simple script can pipe the values of each Get-BitLockerVolume return out to another variable as seen below: -``` syntax +```powershell $vol = Get-BitLockerVolume $keyprotectors = $vol.KeyProtector ``` @@ -266,7 +266,7 @@ Using this, you can display the information in the $keyprotectors variable to de Using this information, you can then remove the key protector for a specific volume using the command: -``` syntax +```powershell Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" ``` @@ -278,13 +278,13 @@ Using the BitLocker Windows PowerShell cmdlets is similar to working with the ma The following example shows how to enable BitLocker on an operating system drive using only the TPM protector: -``` syntax +```powershell Enable-BitLocker C: - ``` + In the example below, adds one additional protector, the StartupKey protector and chooses to skip the BitLocker hardware test. In this example, encryption starts immediately without the need for a reboot. -``` syntax +```powershell Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTest ``` @@ -293,7 +293,7 @@ Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTes Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user defined password. -``` syntax +```powershell $pw = Read-Host -AsSecureString Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw @@ -306,7 +306,7 @@ The **ADAccountOrGroup** protector, introduced in Windows 8 and Windows Server 2 To add an **ADAccountOrGroup** protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. -``` syntax +```powershell Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator ``` @@ -314,7 +314,7 @@ For users who wish to use the SID for the account or group, the first step is to >**Note:**  Use of this command requires the RSAT-AD-PowerShell feature. -``` syntax +```powershell get-aduser -filter {samaccountname -eq "administrator"} ``` @@ -322,7 +322,7 @@ get-aduser -filter {samaccountname -eq "administrator"} The following example adds an **ADAccountOrGroup** protector to the previously encrypted operating system volume using the SID of the account: -``` syntax +```powershell Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup S-1-5-21-3651336348-8937238915-291003330-500 ``` diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md index 0e544985b8..56534228b9 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md @@ -9,12 +9,12 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 02/28/2019 --- # BitLocker: Use BitLocker Recovery Password Viewer diff --git a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md index 8c25c57e76..a093ef4773 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md index 2f53662c16..1105a1bf99 100644 --- a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md index e19f192e4c..c0e83393a2 100644 --- a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md +++ b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -66,13 +66,13 @@ BitLocker encryption is available for disks before or after addition to a cluste 2. Ensure the disk is formatted NTFS and has a drive letter assigned to it. 3. Identify the name of the cluster with Windows PowerShell. - ``` syntax + ```powershell Get-Cluster - ``` + 4. Enable BitLocker on the volume of your choice with an **ADAccountOrGroup** protector, using the cluster name. For example, use a command such as: - ``` syntax + ```powershell Enable-BitLocker E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$ ``` @@ -88,32 +88,32 @@ When the cluster service owns a disk resource already, it needs to be set into m 1. Install the BitLocker Drive Encryption feature if it is not already installed. 2. Check the status of the cluster disk using Windows PowerShell. - ``` syntax + ```powershell Get-ClusterResource "Cluster Disk 1" ``` 3. Put the physical disk resource into maintenance mode using Windows PowerShell. - ``` syntax + ```powershell Get-ClusterResource "Cluster Disk 1" | Suspend-ClusterResource ``` 4. Identify the name of the cluster with Windows PowerShell. - ``` syntax + ```powershell Get-Cluster ``` 5. Enable BitLocker on the volume of your choice with an **ADAccountOrGroup** protector, using the cluster name. For example, use a command such as: - ``` syntax + ```powershell Enable-BitLocker E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$ ``` >**Warning:**  You must configure an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to fail over properly in a traditional failover cluster. 6. Use **Resume-ClusterResource** to take the physical disk resource back out of maintenance mode: - ``` syntax + ```powershell Get-ClusterResource "Cluster Disk 1" | Resume-ClusterResource ``` @@ -146,7 +146,7 @@ You can also use manage-bde to enable BitLocker on clustered volumes. The steps 6. Once the disk is online in the storage pool, it can be added to a CSV by right clicking on the disk resource and choosing "**Add to cluster shared volumes**". CSVs can include both encrypted and unencrypted volumes. To check the status of a particular volume for BitLocker encryption, administrators can utilize the manage-bde -status command with a path to the volume inside the CSV namespace as seen in the example command line below. -``` syntax +```powershell manage-bde -status "C:\ClusterStorage\volume1" ``` diff --git a/windows/security/information-protection/encrypted-hard-drive.md b/windows/security/information-protection/encrypted-hard-drive.md index cf637532f1..d9b80efe97 100644 --- a/windows/security/information-protection/encrypted-hard-drive.md +++ b/windows/security/information-protection/encrypted-hard-drive.md @@ -4,7 +4,7 @@ description: Encrypted Hard Drive uses the rapid encryption that is provided by ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index 53bf9b0641..527daea7c6 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -100,7 +100,7 @@ In-market systems, released with Windows 10 version 1709 or earlier, will not su No, Kernel DMA Protection only protects against drive-by DMA attacks after the OS is loaded. It is the responsibility of the system firmware/BIOS to protect against attacks via the Thunderbolt™ 3 ports during boot. ### How can I check if a certain driver supports DMA-remapping? -DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping. +DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping. If the property is not available, then the policy is not set by the device driver (i.e. the device driver does not support DMA-remapping). Please check the driver instance for the device you are testing. Some drivers may have varying values depending on the location of the device (internal vs. external). *For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the following image. diff --git a/windows/security/information-protection/secure-the-windows-10-boot-process.md b/windows/security/information-protection/secure-the-windows-10-boot-process.md index 2090fe9ea8..73692e6065 100644 --- a/windows/security/information-protection/secure-the-windows-10-boot-process.md +++ b/windows/security/information-protection/secure-the-windows-10-boot-process.md @@ -14,7 +14,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 11/16/2018 ms.reviewer: -ms.author: dolmont +ms.author: dansimp --- # Secure the Windows 10 boot process @@ -96,7 +96,7 @@ Because Secure Boot has protected the bootloader and Trusted Boot has protected Early Launch Anti-Malware (ELAM) can load a Microsoft or non-Microsoft anti-malware driver before all non-Microsoft boot drivers and applications, thus continuing the chain of trust established by Secure Boot and Trusted Boot. Because the operating system hasn’t started yet, and because Windows needs to boot as quickly as possible, ELAM has a simple task: examine every boot driver and determine whether it is on the list of trusted drivers. If it’s not trusted, Windows won’t load it. -An ELAM driver isn’t a full-featured anti-malware solution; that loads later in the boot process. Windows Defender (included with Windows 10) supports ELAM, as does [Microsoft System Center 2012 Endpoint Protection](https://www.microsoft.com/en-us/server-cloud/system-center/endpoint-protection-2012.aspx) and several non-Microsoft anti-malware apps. +An ELAM driver isn’t a full-featured anti-malware solution; that loads later in the boot process. Windows Defender (included with Windows 10) supports ELAM, as does [Microsoft System Center 2012 Endpoint Protection](https://www.microsoft.com/server-cloud/system-center/endpoint-protection-2012.aspx) and several non-Microsoft anti-malware apps. ## Measured Boot If a PC in your organization does become infected with a rootkit, you need to know about it. Enterprise anti-malware apps can report malware infections to the IT department, but that doesn’t work with rootkits that hide their presence. In other words, you can’t trust the client to tell you whether it’s healthy. diff --git a/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md b/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md index 090906ffce..3e3fdfd9b5 100644 --- a/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md +++ b/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md index 39e3573cd8..1cb7f1c281 100644 --- a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md +++ b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md index a0d1ffbf6e..c802bfae51 100644 --- a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md +++ b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -24,11 +24,11 @@ The Windows 10 operating system improves most existing security features in the **See also:** - - [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications) +- [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications) - - [TPM Fundamentals](tpm-fundamentals.md) +- [TPM Fundamentals](tpm-fundamentals.md) - - [TPM Recommendations](tpm-recommendations.md)  +- [TPM Recommendations](tpm-recommendations.md)  ## TPM Overview diff --git a/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md b/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md index 8e25014ef9..cf6d045df3 100644 --- a/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/manage-tpm-commands.md b/windows/security/information-protection/tpm/manage-tpm-commands.md index 5a388b1fc3..bd30e9b8f2 100644 --- a/windows/security/information-protection/tpm/manage-tpm-commands.md +++ b/windows/security/information-protection/tpm/manage-tpm-commands.md @@ -3,7 +3,7 @@ title: Manage TPM commands (Windows 10) description: This topic for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users. ms.assetid: a78e751a-2806-43ae-9c20-2e7ca466b765 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/security/information-protection/tpm/manage-tpm-lockout.md b/windows/security/information-protection/tpm/manage-tpm-lockout.md index 05dbc34f16..37f9839c3e 100644 --- a/windows/security/information-protection/tpm/manage-tpm-lockout.md +++ b/windows/security/information-protection/tpm/manage-tpm-lockout.md @@ -3,7 +3,7 @@ title: Manage TPM lockout (Windows 10) description: This topic for the IT professional describes how to manage the lockout feature for the Trusted Platform Module (TPM) in Windows. ms.assetid: bf27adbe-404c-4691-a644-29ec722a3f7b ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library diff --git a/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md index 7f618aa9ba..d9e1befbcd 100644 --- a/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md @@ -1,6 +1,6 @@ --- title: Understanding PCR banks on TPM 2.0 devices (Windows 10) -description: This topic for the IT professional provides background about what happens when you switch PCR banks on TPM 2.0 devices. +description: This topic for the IT professional provides background about what happens when you switch PCR banks on TPM 2.0 devices. ms.assetid: 743FCCCB-99A9-4636-8F48-9ECB3A3D10DE ms.reviewer: ms.prod: w10 @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/tpm-fundamentals.md b/windows/security/information-protection/tpm/tpm-fundamentals.md index 3d930a2334..8f99d1e45e 100644 --- a/windows/security/information-protection/tpm/tpm-fundamentals.md +++ b/windows/security/information-protection/tpm/tpm-fundamentals.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/tpm-recommendations.md b/windows/security/information-protection/tpm/tpm-recommendations.md index a1a64bebe4..bd96309c30 100644 --- a/windows/security/information-protection/tpm/tpm-recommendations.md +++ b/windows/security/information-protection/tpm/tpm-recommendations.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -20,8 +20,9 @@ ms.date: 11/29/2018 # TPM recommendations **Applies to** -- Windows 10 -- Windows Server 2016 + +- Windows 10 +- Windows Server 2016 This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows 10. @@ -47,27 +48,27 @@ From an industry standard, Microsoft has been an industry leader in moving and s TPM 2.0 products and systems have important security advantages over TPM 1.2, including: -- The TPM 1.2 spec only allows for the use of RSA and the SHA-1 hashing algorithm. +- The TPM 1.2 spec only allows for the use of RSA and the SHA-1 hashing algorithm. -- For security reasons, some entities are moving away from SHA-1. Notably, NIST has required many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have announced they will remove support for SHA-1 based signing or certificates in 2017. +- For security reasons, some entities are moving away from SHA-1. Notably, NIST has required many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have announced they will remove support for SHA-1 based signing or certificates in 2017. -- TPM 2.0 **enables greater crypto agility** by being more flexible with respect to cryptographic algorithms. +- TPM 2.0 **enables greater crypto agility** by being more flexible with respect to cryptographic algorithms. - - TPM 2.0 supports newer algorithms, which can improve drive signing and key generation performance. For the full list of supported algorithms, see the [TCG Algorithm Registry](http://www.trustedcomputinggroup.org/tcg-algorithm-registry/). Some TPMs do not support all algorithms. + - TPM 2.0 supports newer algorithms, which can improve drive signing and key generation performance. For the full list of supported algorithms, see the [TCG Algorithm Registry](http://www.trustedcomputinggroup.org/tcg-algorithm-registry/). Some TPMs do not support all algorithms. - - For the list of algorithms that Windows supports in the platform cryptographic storage provider, see [CNG Cryptographic Algorithm Providers](https://msdn.microsoft.com/library/windows/desktop/bb931354(v=vs.85).aspx). + - For the list of algorithms that Windows supports in the platform cryptographic storage provider, see [CNG Cryptographic Algorithm Providers](https://msdn.microsoft.com/library/windows/desktop/bb931354(v=vs.85).aspx). - - TPM 2.0 achieved ISO standardization ([ISO/IEC 11889:2015](https://blogs.microsoft.com/cybertrust/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption/)). + - TPM 2.0 achieved ISO standardization ([ISO/IEC 11889:2015](https://blogs.microsoft.com/cybertrust/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption/)). - - Use of TPM 2.0 may help eliminate the need for OEMs to make exception to standard configurations for certain countries and regions. + - Use of TPM 2.0 may help eliminate the need for OEMs to make exception to standard configurations for certain countries and regions. -- TPM 2.0 offers a more **consistent experience** across different implementations. +- TPM 2.0 offers a more **consistent experience** across different implementations. - - TPM 1.2 implementations vary in policy settings. This may result in support issues as lockout policies vary. + - TPM 1.2 implementations vary in policy settings. This may result in support issues as lockout policies vary. - - TPM 2.0 lockout policy is configured by Windows, ensuring a consistent dictionary attack protection guarantee. + - TPM 2.0 lockout policy is configured by Windows, ensuring a consistent dictionary attack protection guarantee. -- While TPM 1.2 parts are discrete silicon components which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a single semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s) - and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC. +- While TPM 1.2 parts are discrete silicon components which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a single semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s) - and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC. > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. @@ -78,11 +79,11 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in There are three implementation options for TPMs: -- Discrete TPM chip as a separate component in its own semiconductor package +- Discrete TPM chip as a separate component in its own semiconductor package -- Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components +- Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components -- Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit +- Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit Windows uses any compatible TPM in the same way. Microsoft does not take a position on which way a TPM should be implemented and there is a wide ecosystem of available TPM solutions which should suit all needs. @@ -94,39 +95,37 @@ For end consumers, TPM is behind the scenes but is still very relevant. TPM is u ### Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) -- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7 of the [Minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview) page). The requirement to enable TPM 2.0 only applies to the manufacturing of new devices. For TPM recommendations for specific Windows features, see [TPM and Windows Features](#tpm-and-windows-features). +- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7 of the [Minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview) page). The requirement to enable TPM 2.0 only applies to the manufacturing of new devices. For TPM recommendations for specific Windows features, see [TPM and Windows Features](#tpm-and-windows-features). ### IoT Core -- TPM is optional on IoT Core. +- TPM is optional on IoT Core. ### Windows Server 2016 -- TPM is optional for Windows Server SKUs unless the SKU meets the additional qualification (AQ) criteria for the Host Guardian Services scenario in which case TPM 2.0 is required. +- TPM is optional for Windows Server SKUs unless the SKU meets the additional qualification (AQ) criteria for the Host Guardian Services scenario in which case TPM 2.0 is required. ## TPM and Windows Features The following table defines which Windows features require TPM support. -| Windows Features | TPM Required | Supports TPM 1.2 | Supports TPM 2.0 | Details | -|-------------------------|--------------|--------------------|--------------------|----------| -| Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot | -| BitLocker | Yes | Yes | Yes | TPM 1.2 or 2.0 is required, but [Automatic Device Encryption requires Modern Standby](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#bitlocker-device-encryption) including TPM 2.0 support | -| Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. | -| Windows Defender Application Control (Device Guard) | No | Yes | Yes | | -| Windows Defender Exploit Guard | No | N/A | N/A | | -| Windows Defender System Guard | Yes | No | Yes | | -| Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. | -| Device Health Attestation| Yes | Yes | Yes | | -| Windows Hello/Windows Hello for Business| No | Yes | Yes | Azure AD join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. | -| UEFI Secure Boot | No | Yes | Yes | | -| TPM Platform Crypto Provider Key Storage Provider| Yes | Yes| Yes | | -| Virtual Smart Card | Yes | Yes | Yes | | -| Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. | -| Autopilot | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | -| SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | -| DRTM | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | - + Windows Features | TPM Required | Supports TPM 1.2 | Supports TPM 2.0 | Details | +-|-|-|-|- + Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot + BitLocker | Yes | Yes | Yes | TPM 1.2 or 2.0 is required, but [Automatic Device Encryption requires Modern Standby](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#bitlocker-device-encryption) including TPM 2.0 support + Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. + Windows Defender Application Control (Device Guard) | No | Yes | Yes + Windows Defender System Guard | Yes | No | Yes + Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. + Device Health Attestation| Yes | Yes | Yes + Windows Hello/Windows Hello for Business| No | Yes | Yes | Azure AD join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. + UEFI Secure Boot | No | Yes | Yes + TPM Platform Crypto Provider Key Storage Provider| Yes | Yes | Yes + Virtual Smart Card | Yes | Yes | Yes + Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. + Autopilot | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. + SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. + DRTM | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. ## OEM Status on TPM 2.0 system availability and certified parts diff --git a/windows/security/information-protection/tpm/trusted-platform-module-overview.md b/windows/security/information-protection/tpm/trusted-platform-module-overview.md index c3f0286d24..a6c748fa89 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-overview.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-overview.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -88,7 +88,7 @@ Some things that you can check on the device are: ## Related topics - [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) -- [Details on the TPM standard](https://www.microsoft.com/en-us/research/project/the-trusted-platform-module-tpm/) (has links to features using TPM) +- [Details on the TPM standard](https://www.microsoft.com/research/project/the-trusted-platform-module-tpm/) (has links to features using TPM) - [TPM Base Services Portal](https://docs.microsoft.com/windows/desktop/TBS/tpm-base-services-portal) - [TPM Base Services API](https://docs.microsoft.com/windows/desktop/api/_tbs/) - [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/trustedplatformmodule) diff --git a/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md b/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md index 1fc294342f..f8b477aa62 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/trusted-platform-module-top-node.md b/windows/security/information-protection/tpm/trusted-platform-module-top-node.md index 3558bdf368..45c32cd7da 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-top-node.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-top-node.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md b/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md index f8bb770494..cbb074f9fa 100644 --- a/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md b/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md index f38a7aa7c0..0d7d91e071 100644 --- a/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md +++ b/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index 704773750d..f6d1a67328 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md index aeca37426f..8c73819a8e 100644 --- a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 85c7bfae87..d6f39a9895 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -6,7 +6,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md index bd212a95e3..61ce1a5f3b 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md index cb68d68e93..42caa212cd 100644 --- a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md index 441e6d2b75..93a5d00470 100644 --- a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md +++ b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -43,6 +43,8 @@ Apps can be enlightened or unenlightened: ## List of enlightened Microsoft apps Microsoft has made a concerted effort to enlighten several of our more popular apps, including the following: +- Microsoft 3D Viewer + - Microsoft Edge - Internet Explorer 11 @@ -80,11 +82,16 @@ Microsoft still has apps that are unenlightened, but which have been tested and - Skype for Business ## Adding enlightened Microsoft apps to the allowed apps list + +> [!NOTE] +> As of January 2019 it is no longer necessary to add Intune Company Portal as an exempt app since it is now included in the default list of protected apps. + You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and System Center Configuration Manager. | Product name | App info | |------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Microsoft 3D Viewer | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                        **Product Name:** Microsoft.Microsoft3DViewer
                        **App Type:** Universal app | | Microsoft Edge | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                        **Product Name:** Microsoft.MicrosoftEdge
                        **App Type:** Universal app | | Microsoft People | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                        **Product Name:** Microsoft.People
                        **App Type:** Universal app | | Word Mobile | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                        **Product Name:** Microsoft.Office.Word
                        **App Type:** Universal app | diff --git a/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md b/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md index 78620f0447..f9e51d4cb9 100644 --- a/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md +++ b/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md index 8205436cc7..5b2d65942a 100644 --- a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md +++ b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/limitations-with-wip.md b/windows/security/information-protection/windows-information-protection/limitations-with-wip.md index e9ee801003..a01fabb5ce 100644 --- a/windows/security/information-protection/windows-information-protection/limitations-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/limitations-with-wip.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md b/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md index 36a6fbf255..6b736fd281 100644 --- a/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md index 9fe48f688d..40ab9e148d 100644 --- a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md +++ b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md index 29087982ee..8905cdb7b4 100644 --- a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md +++ b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md index 246227f7c4..62403b8b81 100644 --- a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md +++ b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -35,7 +35,7 @@ Windows Information Protection (WIP), previously known as enterprise data protec ## Video: Protect enterprise data from being accidentally copied to the wrong place -> [!Video https://www.microsoft.com/en-us/videoplayer/embed/RE2IGhh] +> [!Video https://www.microsoft.com/videoplayer/embed/RE2IGhh] ## Prerequisites You’ll need this software to run WIP in your enterprise: diff --git a/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md b/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md index 0852a6c1be..46f40cb732 100644 --- a/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -35,6 +35,7 @@ This table includes the recommended URLs to add to your Enterprise Cloud Resourc |-----------------------------|---------------------------------------------------------------------| |Office 365 for Business |
                        • contoso.sharepoint.com
                        • contoso-my.sharepoint.com
                        • contoso-files.sharepoint.com
                        • tasks.office.com
                        • protection.office.com
                        • meet.lync.com
                        • teams.microsoft.com
                        | |Yammer |
                        • www.yammer.com
                        • yammer.com
                        • persona.yammer.com
                        | +|Outlook Web Access (OWA) |attachments.office.net | |Microsoft Dynamics |contoso.crm.dynamics.com | |Visual Studio Online |contoso.visualstudio.com | |Power BI |contoso.powerbi.com | diff --git a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md index 08af5d2456..d056e573c8 100644 --- a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -172,6 +172,17 @@ You can try any of the processes included in these scenarios, but you should foc                         + + + +
                        MessageDate
                        Plan for change: End of service reminders for Windows 10, versions 1703 and 1803
                        The Enterprise and Education editions of Windows 10, version 1703 (the Creators Update) will reach end of service on October 8, 2019. The Home, Pro, Pro for Workstations, and IoT Core editions of Windows 10, version 1803 (the April 2018 Update) will reach end of service on November 12, 2019. We recommend that you update devices running these versions and editions to the latest version of Windows 10—Windows 10, version 1903—as soon as possible to help keep them protected and your environments secure.
                        		September 13, 2019
                        03:23 PM PT
                        September 2019 security update available for all supported versions of Windows
                        The September 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1903 and all supported versions of Windows. We recommend that you install these updates promptly. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
                        		September 10, 2019
                        09:34 AM PT
                        Status update: Windows 10, version 1903 \"D\" optional release available August 30th
                        The August optional monthly “D” release for Windows 10, version 1903 is now available. Follow @WindowsUpdate for the latest on the availability of this release.
                        		August 30, 2019
                        08:00 AM PT
                        Feature update install notification on Windows 10, version 1809 (the October 2018 Update)
                        We've had reports on August 29th that some customers running Windows 10, version 1809 (the October 2018 Update) have received notification to install the latest feature update (version 1903) early. Updating remains in your control. To install the update, you must select one of the following options: \"Pick a Time\", \"Restart Tonight,\" or \"Restart Now\". If you are not ready to update at this time, simply dismiss the notification by clicking the arrow in the top right corner. If you have updated to Windows 10, version 1903 and would like to go back to your previous version, see the instructions here.
                        		August 29, 2019
                        04:39 PM PT
                        Take Action: Internet Explorer 11 now available on Windows Update/WSUS for Windows Server 2012 and Windows Embedded 8 Standard
                        Internet Explorer 11 (KB 4492872) is now available via Windows Update (WU) and Windows Server Update Services (WSUS) for commercial customers running Windows Server 2012 and Windows Embedded 8 Standard. For details about these changes and end of support for IE10, please refer to the IT Pro blog. 
                        		August 29, 2019
                        08:00 AM PT
                        Take action: SHA-2 code signing support guidance for Windows 7 SP1 and Windows Server 2008 RS2 SP1
                        Windows 7 SP1 and Windows Server 2008 R2 SP1 update signatures are now SHA-2 based signatures and requires that SHA-2 support to be installed. For important customer guidance on installation and troubleshooting tips, please read the knowledge base article 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.
                        		August 23, 2019
                        03:35 PM PT
                        Take action: Windows 10, version 1703 (the Windows 10 Creators Update) reaches end of life on October 9, 2019
                        The Enterprise and Education editions of Windows 10, version 1703 (the Windows 10 Creators Update) will reach end of life on October 9, 2019. The Home, Pro, Pro for Workstations, and IoT Core editions reached end of service on October 8, 2018.

                        There is no extended support available for any edition of Windows 10, version 1703. Therefore, it will no longer be supported after October 9, 2019 and will not receive monthly security and quality updates containing protections from the latest security threats.

                        To continue receiving security and quality updates, Microsoft recommends that you update your devices to the latest version of Windows 10. For more information on end of service dates and currently supported versions of Windows 10, see the Windows lifecycle fact sheet.
                        		August 23, 2019
                        02:17 PM PT
                        Resolved: Delays starting Internet Explorer 11
                        On August 16, 2019 at 7:16 AM a server required for downloading the Internet Explorer 11 (IE11) startup page, went down. As a result of the server outage, IE 11 became unresponsive for some customers who had not yet installed the August 2019 security updates. Customers who had the August 2019 security update installed were not affected. In order to ensure your devices remain in a serviced and secure state, we recommend you install the latest monthly update.

                        This issue was resolved on the server side at 1:00 pm PST. 
                        		August 16, 2019
                        04:00 PM PT
                        August 2019 security update now available for Windows 10, version 1903 and all supported versions of Windows
                        The August 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1903 and all supported versions of Windows. A “B” release is the primary, regular update event for each month and is the only regular release that contains security fixes. As a result, we recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
                        		August 13, 2019
                        10:00 AM PT
                        Advisory: Bluetooth encryption key size vulnerability disclosed (CVE-2019-9506)
                        On August 13, 2019, Microsoft released security updates to address a Bluetooth key length encryption vulnerability. To exploit this vulnerability, an attacker would need specialized hardware and would be limited by the signal range of the Bluetooth devices in use. For more information about this industry-wide issue, see CVE-2019-9506 | Bluetooth Encryption Key Size Vulnerability in the Microsoft Security Update Guide and important guidance for IT pros in KB4514157. (Note: we are documenting this vulnerability together with guidance for IT admins as part of a coordinated industry disclosure effort.)
                        		August 13, 2019
                        10:00 AM PT
                        Advisory: Windows Advanced Local Procedure Call Elevation of Privilege vulnerability disclosed (CVE-2019-1162)
                        On August 13, 2019, Google Project Zero (GPZ) disclosed an Elevation of Privilege (EoP) vulnerability in how Windows handles calls to Advanced Local Procedure Call (ALPC) that affects Windows operating systems, versions 8.1 and higher. An attacker must already have code execution on the target system to leverage these vulnerabilities. Microsoft released security updates on August 13, 2019 that partially address this issue. Other items disclosed by GPZ require more time to address and we are working to release a resolution in mid-September. For more information, see CVE-2019-1162 | Windows ALPC Elevation of Privilege Vulnerability
                        		August 13, 2019
                        10:00 AM PT
                        Take action: Windows 10, version 1803 (the April 2018 Update) reaches end of service on November 12, 2019
                        Windows 10, version 1803 (the April 2018 Update) will reach end of service on November 12, 2019 for Home and Pro editions. We will begin updating devices running Windows 10, version 1803 to Windows 10, version 1903 (the May 2019 Update) starting July 16, 2019 to help ensure that these devices remain in a serviced and secure state. For more information, see the Windows 10, version 1903 section of the Windows release health dashboard.
                        		August 13, 2019
                        10:00 AM PT
                        Advisory: Windows Kernel Information Disclosure Vulnerability (CVE-2019-1125)
                        On July 9, 2019, Microsoft released a security update for a Windows kernel information disclosure vulnerability (CVE-2019-1125). Customers who have Windows Update enabled and have applied the security updates released on July 9, 2019 are protected automatically; no further configuration is necessary. For more information, see CVE-2019-1125 | Windows Kernel Information Disclosure Vulnerability in the Microsoft Security Update Guide. (Note: we are documenting this mitigation publicly today, instead of back in July, as part of a coordinated industry disclosure effort.)
                        		August 06, 2019
                        10:00 AM PT
                        Resolved August 1, 2019 16:00 PT: Microsoft Store users may encounter blank screens when clicking on certain buttons
                        Some customers running the version of the Microsoft Store app released on July 29, 2019 encountered a blank screen when selecting “Switch out of S mode,” “Get Genuine,” or some “Upgrade to [version]” OS upgrade options. This issue has now been resolved and a new version of the Microsoft Store app has been released. Users who encountered this issue will need to update the Microsoft Store app on their device. If you are still encountering an issue, please see Fix problems with apps from Microsoft Store.
                        		August 01, 2019
                        02:00 PM PT
                        Status update: Windows 10, version 1903 “D” release now available
                        The optional monthly “D” release for Windows 10, version 1903 is now available. Follow @WindowsUpdate for the latest on the availability of this release.
                        		July 26, 2019
                        02:00 PM PT
                        Reminder: Windows 10 update servicing cadence
                        This month we received questions about the cadence of updates we released in April and May 2019. Here's a quick recap of our releases and servicing cadence:
                        • April 9, 2019 was the regular Update Tuesday release for all versions of Windows.
                          • -
                        • May 1, 2019 was an \"optional,\" out of band non-security update (OOB) for Windows 10, version 1809. It was released to Microsoft Catalog and WSUS, providing a critical fix for our OEM partners.
                          • -
                        • May 3, 2019 was the \"optional\" Windows 10, version 1809 \"C\" release for April. This update contained important Japanese era packages for commercial customers to preview. It was released later than expected and mistakenly targeted as \"required\" (instead of \"optional\") for consumers, which pushed the update out to customers and required a reboot. Within 24 hours of receiving customer reports, we corrected the targeting logic and mitigated the issue.
                          • +
                        • May 1, 2019 was an \\\"optional,\\\" out of band non-security update (OOB) for Windows 10, version 1809. It was released to Microsoft Catalog and WSUS, providing a critical fix for our OEM partners.
                          • +
                        • May 3, 2019 was the \\\"optional\\\" Windows 10, version 1809 \\\"C\\\" release for April. This update contained important Japanese era packages for commercial customers to preview. It was released later than expected and mistakenly targeted as \\\"required\\\" (instead of \\\"optional\\\") for consumers, which pushed the update out to customers and required a reboot. Within 24 hours of receiving customer reports, we corrected the targeting logic and mitigated the issue.
                        For more information about the Windows 10 update servicing cadence, please see the Window IT Pro blog.
                        		May 10, 2019
                        10:00 AM PT
                        The AIK certificate is no longer valid Sign out and then sign in again.
                        ​0x801C044D
                        0x801C03F2Windows Hello key registration failed.ERROR_BAD_DIRECTORY_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue refer to Duplicate Attributes Prevent Dirsync.
                        0x801C044D Unable to obtain user token Sign out and then sign in again. Check network and credentials.
                        0x801C044E Failed to receive user creds input Sign out and then sign in again.
                        Stop Google Drive from syncing WIP protected files and folders. +
                          +
                        • In silent configuration, add Google Drive to Protected Apps and set it to Deny. This way, Google Drive will not sync WIP protected files and folders.
                          • +
                        • Google Drive details
                          • + Publisher=O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US + File=GOOGLEDRIVESYNC.EXE +
                        +
                        >[!NOTE] diff --git a/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md b/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md index 7a321fae6b..958ab7847d 100644 --- a/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md index dc97c95d0d..5a8333cab2 100644 --- a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md +++ b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 08a7fe11e3..76ea17db0e 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -17,6 +17,7 @@ ### [Attack surface reduction]() +#### [Overview of attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md) #### [Hardware-based isolation]() ##### [Hardware-based isolation in Windows 10](microsoft-defender-atp/overview-hardware-based-isolation.md) @@ -27,10 +28,10 @@ ##### [System integrity](windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) #### [Application control](windows-defender-application-control/windows-defender-application-control.md) -#### [Exploit protection](windows-defender-exploit-guard/exploit-protection-exploit-guard.md) -#### [Network protection](windows-defender-exploit-guard/network-protection-exploit-guard.md) -#### [Controlled folder access](windows-defender-exploit-guard/controlled-folders-exploit-guard.md) -#### [Attack surface reduction](windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) +#### [Exploit protection](microsoft-defender-atp/exploit-protection.md) +#### [Network protection](microsoft-defender-atp/network-protection.md) +#### [Controlled folder access](microsoft-defender-atp/controlled-folders.md) +#### [Attack surface reduction](microsoft-defender-atp/attack-surface-reduction.md) #### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) ### [Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) @@ -58,46 +59,43 @@ #### [Machines list]() ##### [View and organize the Machines list](microsoft-defender-atp/machines-view-overview.md) ##### [Manage machine group and tags](microsoft-defender-atp/machine-tags.md) -##### [Alerts related to this machine](microsoft-defender-atp/investigate-machines.md#alerts-related-to-this-machine) -##### [Machine timeline]() -###### [View machine profile](microsoft-defender-atp/investigate-machines.md#machine-timeline) -###### [Search for specific events](microsoft-defender-atp/investigate-machines.md#search-for-specific-events) -###### [Filter events from a specific date](microsoft-defender-atp/investigate-machines.md#filter-events-from-a-specific-date) -###### [Export machine timeline events](microsoft-defender-atp/investigate-machines.md#export-machine-timeline-events) -###### [Navigate between pages](microsoft-defender-atp/investigate-machines.md#navigate-between-pages) #### [Take response actions]() ##### [Take response actions on a machine]() ###### [Response actions on machines](microsoft-defender-atp/respond-machine-alerts.md) +###### [Manage tags](microsoft-defender-atp/respond-machine-alerts.md#manage-tags) +###### [Initiate Automated investigation](microsoft-defender-atp/respond-machine-alerts.md#initiate-automated-investigation) +###### [Initiate Live Response session](microsoft-defender-atp/respond-machine-alerts.md#initiate-live-response-session) ###### [Collect investigation package](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-machines) ###### [Run antivirus scan](microsoft-defender-atp/respond-machine-alerts.md#run-windows-defender-antivirus-scan-on-machines) ###### [Restrict app execution](microsoft-defender-atp/respond-machine-alerts.md#restrict-app-execution) -###### [Remove app restriction](microsoft-defender-atp/respond-machine-alerts.md#remove-app-restriction) ###### [Isolate machines from the network](microsoft-defender-atp/respond-machine-alerts.md#isolate-machines-from-the-network) -###### [Release machine from isolation](microsoft-defender-atp/respond-machine-alerts.md#release-machine-from-isolation) -####### [Check activity details in Action center](microsoft-defender-atp/respond-machine-alerts.md#check-activity-details-in-action-center) +###### [Consult a threat expert](microsoft-defender-atp/respond-machine-alerts.md#consult-a-threat-expert) +###### [Check activity details in Action center](microsoft-defender-atp/respond-machine-alerts.md#check-activity-details-in-action-center) ##### [Take response actions on a file]() ###### [Response actions on files](microsoft-defender-atp/respond-file-alerts.md) ###### [Stop and quarantine files in your network](microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network) -###### [Remove file from quarantine](microsoft-defender-atp/respond-file-alerts.md#remove-file-from-quarantine) -###### [Block files in your network](microsoft-defender-atp/respond-file-alerts.md#block-files-in-your-network) -###### [Remove file from blocked list](microsoft-defender-atp/respond-file-alerts.md#remove-file-from-blocked-list) +###### [Restore file from quarantine](microsoft-defender-atp/respond-file-alerts.md#restore-file-from-quarantine) +###### [Add indicators to block or allow a file](microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) +###### [Consult a threat expert](microsoft-defender-atp/respond-file-alerts.md#consult-a-threat-expert) ###### [Check activity details in Action center](microsoft-defender-atp/respond-file-alerts.md#check-activity-details-in-action-center) +###### [Download or collect file](microsoft-defender-atp/respond-file-alerts.md#download-or-collect-file) ###### [Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis) ###### [Submit files for analysis](microsoft-defender-atp/respond-file-alerts.md#submit-files-for-analysis) ###### [View deep analysis reports](microsoft-defender-atp/respond-file-alerts.md#view-deep-analysis-reports) -####### [Troubleshoot deep analysis](microsoft-defender-atp/respond-file-alerts.md#troubleshoot-deep-analysis) +###### [Troubleshoot deep analysis](microsoft-defender-atp/respond-file-alerts.md#troubleshoot-deep-analysis) + ##### [Investigate entities using Live response]() ###### [Investigate entities on machines](microsoft-defender-atp/live-response.md) -######[Live response command examples](microsoft-defender-atp/live-response-command-examples.md) +###### [Live response command examples](microsoft-defender-atp/live-response-command-examples.md) ### [Automated investigation and remediation]() #### [Automated investigation and remediation overview](microsoft-defender-atp/automated-investigations.md) #### [Learn about the automated investigation and remediation dashboard](microsoft-defender-atp/manage-auto-investigation.md) -#####[Manage actions related to automated investigation and remediation](microsoft-defender-atp/auto-investigation-action-center.md) +##### [Manage actions related to automated investigation and remediation](microsoft-defender-atp/auto-investigation-action-center.md) ### [Secure score](microsoft-defender-atp/overview-secure-score.md) ### [Threat analytics](microsoft-defender-atp/threat-analytics.md) @@ -105,40 +103,39 @@ ### [Advanced hunting]() #### [Advanced hunting overview](microsoft-defender-atp/overview-hunting.md) #### [Query data using Advanced hunting](microsoft-defender-atp/advanced-hunting.md) +#### [Stream Advanced hunting events to Azure Event Hubs](microsoft-defender-atp/raw-data-export-event-hub.md) +#### [Advanced hunting schema reference]() +##### [All tables in the Advanced hunting schema](microsoft-defender-atp/advanced-hunting-reference.md) +##### [AlertEvents table](microsoft-defender-atp/advanced-hunting-alertevents-table.md) +##### [FileCreationEvents table](microsoft-defender-atp/advanced-hunting-filecreationevents-table.md) +##### [ImageLoadEvents table](microsoft-defender-atp/advanced-hunting-imageloadevents-table.md) +##### [LogonEvents table](microsoft-defender-atp/advanced-hunting-logonevents-table.md) +##### [MachineInfo table](microsoft-defender-atp/advanced-hunting-machineinfo-table.md) +##### [MachineNetworkInfo table](microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md) +##### [MiscEvents table](microsoft-defender-atp/advanced-hunting-miscevents-table.md) +##### [NetworkCommunicationEvents table](microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md) +##### [ProcessCreationEvents table](microsoft-defender-atp/advanced-hunting-processcreationevents-table.md) +##### [RegistryEvents table](microsoft-defender-atp/advanced-hunting-registryevents-table.md) +#### [Advanced hunting query language best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) -##### [Advanced hunting schema reference]() -###### [All tables in the Advanced hunting schema](microsoft-defender-atp/advanced-hunting-reference.md) -###### [AlertEvents table](microsoft-defender-atp/advanced-hunting-alertevents-table.md) -###### [FileCreationEvents table](microsoft-defender-atp/advanced-hunting-filecreationevents-table.md) -###### [ImageLoadEvents table](microsoft-defender-atp/advanced-hunting-imageloadevents-table.md) -###### [LogonEvents table](microsoft-defender-atp/advanced-hunting-logonevents-table.md) -###### [MachineInfo table](microsoft-defender-atp/advanced-hunting-machineinfo-table.md) -###### [MachineNetworkInfo table](microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md) -###### [MiscEvents table](microsoft-defender-atp/advanced-hunting-miscevents-table.md) -###### [NetworkCommunicationEvents table](microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md) -###### [ProcessCreationEvents table](microsoft-defender-atp/advanced-hunting-processcreationevents-table.md) -###### [RegistryEvents table](microsoft-defender-atp/advanced-hunting-registryevents-table.md) - -##### [Advanced hunting query language best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) #### [Custom detections]() ##### [Understand custom detection rules](microsoft-defender-atp/overview-custom-detections.md) ##### [Create custom detections rules](microsoft-defender-atp/custom-detection-rules.md) -#### [Management and APIs]() -##### [Overview of management and APIs](microsoft-defender-atp/management-apis.md) -##### [Understand threat intelligence concepts](microsoft-defender-atp/threat-indicator-concepts.md) -##### [Microsoft Defender ATP APIs](microsoft-defender-atp/apis-intro.md) -##### [Managed security service provider support](microsoft-defender-atp/mssp-support.md) +### [Management and APIs]() +#### [Overview of management and APIs](microsoft-defender-atp/management-apis.md) +#### [Understand threat intelligence concepts](microsoft-defender-atp/threat-indicator-concepts.md) +#### [Managed security service provider support](microsoft-defender-atp/mssp-support.md) -#### [Integrations]() -##### [Microsoft Defender ATP integrations](microsoft-defender-atp/threat-protection-integration.md) -##### [Protect users, data, and devices with conditional access](microsoft-defender-atp/conditional-access.md) -##### [Microsoft Cloud App Security integration overview](microsoft-defender-atp/microsoft-cloud-app-security-integration.md) +### [Integrations]() +#### [Microsoft Defender ATP integrations](microsoft-defender-atp/threat-protection-integration.md) +#### [Protect users, data, and devices with conditional access](microsoft-defender-atp/conditional-access.md) +#### [Microsoft Cloud App Security integration overview](microsoft-defender-atp/microsoft-cloud-app-security-integration.md) -#### [Information protection in Windows overview]() -##### [Windows integration](microsoft-defender-atp/information-protection-in-windows-overview.md) -##### [Use sensitivity labels to prioritize incident response](microsoft-defender-atp/information-protection-investigation.md) +### [Information protection in Windows overview]() +#### [Windows integration](microsoft-defender-atp/information-protection-in-windows-overview.md) +#### [Use sensitivity labels to prioritize incident response](microsoft-defender-atp/information-protection-investigation.md) ### [Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md) @@ -162,37 +159,27 @@ ##### [Attack surface reduction and nex-generation evaluation overview](microsoft-defender-atp/evaluate-atp.md) ##### [Hardware-based isolation](windows-defender-application-guard/test-scenarios-wd-app-guard.md) ##### [Application control](windows-defender-application-control/audit-windows-defender-application-control-policies.md) -##### [Exploit protection](windows-defender-exploit-guard/evaluate-exploit-protection.md) -##### [Network Protection](windows-defender-exploit-guard/evaluate-network-protection.md) -##### [Controlled folder access](windows-defender-exploit-guard/evaluate-controlled-folder-access.md) -##### [Attack surface reduction](windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) +##### [Exploit protection](microsoft-defender-atp/evaluate-exploit-protection.md) +##### [Network Protection](microsoft-defender-atp/evaluate-network-protection.md) +##### [Controlled folder access](microsoft-defender-atp/evaluate-controlled-folder-access.md) +##### [Attack surface reduction](microsoft-defender-atp/evaluate-attack-surface-reduction.md) ##### [Network firewall](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) ##### [Evaluate next generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md) ### [Access the Windows Defender Security Center Community Center](microsoft-defender-atp/community.md) ## [Configure and manage capabilities]() + ### [Configure attack surface reduction]() #### [Attack surface reduction configuration settings](microsoft-defender-atp/configure-attack-surface-reduction.md) -### [Configure and manage capabilities](microsoft-defender-atp/onboard.md) -#### [Microsoft Defender Advanced Threat Protection for Mac](windows-defender-antivirus/microsoft-defender-atp-mac.md) -##### [Deploy Microsoft Defender Advanced Threat Protection for Mac]() -###### [Microsoft Intune-based deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md) -###### [JAMF-based deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md) -###### [Deployment with a different Mobile Device Management (MDM) system](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md) -###### [Manual deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md) -##### [Update Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-updates.md) -##### [Set preferences for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md) -##### [Privacy for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md) -##### [Resources for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-resources.md) -#### [Hardware-based isolation]() -##### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) +### [Hardware-based isolation]() +#### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) -##### [Application isolation]() -###### [Install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) -###### [Application control](windows-defender-application-control/windows-defender-application-control.md) +#### [Application isolation]() +##### [Install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) +##### [Application control](windows-defender-application-control/windows-defender-application-control.md) #### [Device control]() ##### [Control USB devices](device-control/control-usb-devices-using-intune.md) @@ -201,24 +188,29 @@ ###### [Code integrity](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) ###### [Memory integrity]() -####### [Understand memory integrity](windows-defender-exploit-guard/memory-integrity.md) -####### [Hardware qualifications](windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) -####### [Enable HVCI](windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md) +####### [Understand memory integrity](device-guard/memory-integrity.md) +####### [Hardware qualifications](device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) +####### [Enable HVCI](device-guard/enable-virtualization-based-protection-of-code-integrity.md) #### [Exploit protection]() -##### [Enable exploit protection](windows-defender-exploit-guard/enable-exploit-protection.md) -##### [Import/export configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) +##### [Enable exploit protection](microsoft-defender-atp/enable-exploit-protection.md) +##### [Import/export configurations](microsoft-defender-atp/import-export-exploit-protection-emet-xml.md) -#### [Network protection](windows-defender-exploit-guard/enable-network-protection.md) -#### [Controlled folder access](windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md) +#### [Network protection](microsoft-defender-atp/enable-network-protection.md) +#### [Controlled folder access](microsoft-defender-atp/enable-controlled-folders.md) #### [Attack surface reduction controls]() -##### [Enable attack surface reduction rules](windows-defender-exploit-guard/enable-attack-surface-reduction.md) -##### [Customize attack surface reduction](windows-defender-exploit-guard/customize-attack-surface-reduction.md) +##### [Enable attack surface reduction rules](microsoft-defender-atp/enable-attack-surface-reduction.md) +##### [Customize attack surface reduction](microsoft-defender-atp/customize-attack-surface-reduction.md) + #### [Network firewall](windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md) + + + ### [Configure next generation protection]() #### [Configure Windows Defender Antivirus features](windows-defender-antivirus/configure-windows-defender-antivirus-features.md) + #### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) ##### [Enable cloud-delivered protection](windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) ##### [Specify the cloud-delivered protection level](windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md) @@ -309,6 +301,21 @@ ##### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) ##### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) + +### [Microsoft Defender Advanced Threat Protection for Mac](windows-defender-antivirus/microsoft-defender-atp-mac.md) +#### [Deploy Microsoft Defender Advanced Threat Protection for Mac]() +##### [Microsoft Intune-based deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md) +##### [JAMF-based deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md) +##### [Deployment with a different Mobile Device Management (MDM) system](windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md) +##### [Manual deployment](windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md) +#### [Update Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-updates.md) +#### [Set preferences for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md) +#### [Privacy for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md) +#### [Resources for Microsoft Defender ATP for Mac](windows-defender-antivirus/microsoft-defender-atp-mac-resources.md) + + + + ### [Configure Secure score dashboard security controls](microsoft-defender-atp/secure-score-dashboard.md) ### [Configure and manage Microsoft Threat Experts capabilities](microsoft-defender-atp/configure-microsoft-threat-experts.md) @@ -331,6 +338,8 @@ ##### [Run a detection test on a newly onboarded machine](microsoft-defender-atp/run-detection-test.md) ##### [Run simulated attacks on machines](microsoft-defender-atp/attack-simulations.md) ##### [Configure proxy and Internet connectivity settings](microsoft-defender-atp/configure-proxy-internet.md) +##### [Create an onboarding or offboarding notification rule](microsoft-defender-atp/onboarding-notification.md) + ##### [Troubleshoot onboarding issues]() ###### [Troubleshoot issues during onboarding](microsoft-defender-atp/troubleshoot-onboarding.md) @@ -394,7 +403,6 @@ ####### [Get domain related alerts](microsoft-defender-atp/get-domain-related-alerts.md) ####### [Get domain related machines](microsoft-defender-atp/get-domain-related-machines.md) ####### [Get domain statistics](microsoft-defender-atp/get-domain-statistics.md) -####### [Is domain seen in organization](microsoft-defender-atp/is-domain-seen-in-org.md) ###### [File]() ####### [File methods and properties](microsoft-defender-atp/files.md) @@ -405,9 +413,7 @@ ###### [IP]() ####### [Get IP related alerts](microsoft-defender-atp/get-ip-related-alerts.md) -####### [Get IP related machines](microsoft-defender-atp/get-ip-related-machines.md) ####### [Get IP statistics](microsoft-defender-atp/get-ip-statistics.md) -####### [Is IP seen in organization](microsoft-defender-atp/is-ip-seen-org.md) ###### [User]() ####### [User methods](microsoft-defender-atp/user.md) @@ -415,15 +421,10 @@ ####### [Get user related machines](microsoft-defender-atp/get-user-related-machines.md) ##### [How to use APIs - Samples]() -###### [Advanced Hunting API]() -####### [Schedule advanced Hunting using Microsoft Flow](microsoft-defender-atp/run-advanced-query-sample-ms-flow.md) -####### [Advanced Hunting using PowerShell](microsoft-defender-atp/run-advanced-query-sample-powershell.md) -####### [Advanced Hunting using Python](microsoft-defender-atp/run-advanced-query-sample-python.md) -####### [Create custom Power BI reports](microsoft-defender-atp/run-advanced-query-sample-power-bi-app-token.md) - -###### [Multiple APIs]() -####### [PowerShell](microsoft-defender-atp/exposed-apis-full-sample-powershell.md) - +###### [Microsoft Flow](microsoft-defender-atp/api-microsoft-flow.md) +###### [Power BI](microsoft-defender-atp/api-power-bi.md) +###### [Advanced Hunting using Python](microsoft-defender-atp/run-advanced-query-sample-python.md) +###### [Advanced Hunting using PowerShell](microsoft-defender-atp/run-advanced-query-sample-powershell.md) ###### [Using OData Queries](microsoft-defender-atp/exposed-apis-odata-samples.md) #### [Windows updates (KB) info]() @@ -433,7 +434,6 @@ ##### [Get CVE-KB map](microsoft-defender-atp/get-cvekbmap-collection.md) #### [API for custom alerts (Deprecated)]() -##### [Enable the custom threat intelligence application (Deprecated)](microsoft-defender-atp/enable-custom-ti.md) ##### [Use the threat intelligence API to create custom alerts (Deprecated)](microsoft-defender-atp/use-custom-ti.md) ##### [Create custom threat intelligence alerts (Deprecated)](microsoft-defender-atp/custom-ti-api.md) ##### [PowerShell code examples (Deprecated)](microsoft-defender-atp/powershell-example-code.md) @@ -441,13 +441,13 @@ ##### [Experiment with custom threat intelligence alerts (Deprecated)](microsoft-defender-atp/experiment-custom-ti.md) ##### [Troubleshoot custom threat intelligence issues (Deprecated)](microsoft-defender-atp/troubleshoot-custom-ti.md) -#### [Pull alerts to your SIEM tools]() -##### [Learn about different ways to pull alerts](microsoft-defender-atp/configure-siem.md) +#### [Pull detections to your SIEM tools]() +##### [Learn about different ways to pull detections](microsoft-defender-atp/configure-siem.md) ##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md) -##### [Configure Splunk to pull alerts](microsoft-defender-atp/configure-splunk.md) -##### [Configure HP ArcSight to pull alerts](microsoft-defender-atp/configure-arcsight.md) -##### [Microsoft Defender ATP SIEM alert API fields](microsoft-defender-atp/api-portal-mapping.md) -##### [Pull alerts using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md) +##### [Configure Splunk to pull detections](microsoft-defender-atp/configure-splunk.md) +##### [Configure HP ArcSight to pull detections](microsoft-defender-atp/configure-arcsight.md) +##### [Microsoft Defender ATP detection fields](microsoft-defender-atp/api-portal-mapping.md) +##### [Pull detections using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md) ##### [Troubleshoot SIEM tool integration issues](microsoft-defender-atp/troubleshoot-siem.md) #### [Reporting]() @@ -481,6 +481,7 @@ #### [Configure information protection in Windows](microsoft-defender-atp/information-protection-in-windows-config.md) ### [Configure portal settings]() +#### [Set up preferences](microsoft-defender-atp/preferences-setup.md) #### [General]() ##### [Update data retention settings](microsoft-defender-atp/data-retention-settings.md) ##### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md) @@ -501,7 +502,6 @@ #### [Rules]() ##### [Manage suppression rules](microsoft-defender-atp/manage-suppression-rules.md) -##### [Manage automation allowed/blocked lists](microsoft-defender-atp/manage-automation-allowed-blocked-list.md) ##### [Manage indicators](microsoft-defender-atp/manage-indicators.md) ##### [Manage automation file uploads](microsoft-defender-atp/manage-automation-file-uploads.md) ##### [Manage automation folder exclusions](microsoft-defender-atp/manage-automation-folder-exclusions.md) @@ -510,7 +510,7 @@ ##### [Onboarding machines](microsoft-defender-atp/onboard-configure.md) ##### [Offboarding machines](microsoft-defender-atp/offboard-machines.md) -#### [Configure Windows Defender Security Center time zone settings](microsoft-defender-atp/time-settings.md) +#### [Configure Microsoft Defender Security Center time zone settings](microsoft-defender-atp/time-settings.md) ## [Troubleshoot Microsoft Defender ATP]() @@ -529,8 +529,8 @@ #### [Troubleshoot issues related to live response](microsoft-defender-atp/troubleshoot-live-response.md) ### [Troubleshoot attack surface reduction]() -#### [Network protection](windows-defender-exploit-guard/troubleshoot-np.md) -#### [Attack surface reduction rules](windows-defender-exploit-guard/troubleshoot-asr.md) +#### [Network protection](microsoft-defender-atp/troubleshoot-np.md) +#### [Attack surface reduction rules](microsoft-defender-atp/troubleshoot-asr.md) ### [Troubleshoot next generation protection](windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md) @@ -1049,7 +1049,7 @@ ###### [Network access: Remotely accessible registry paths](security-policy-settings/network-access-remotely-accessible-registry-paths.md) ###### [Network access: Remotely accessible registry paths and subpaths](security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md) ###### [Network access: Restrict anonymous access to Named Pipes and Shares](security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md) -###### [Network access: Restrict clients allowed to make remote calls to SAM](security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md) +###### [Network access: Restrict clients allowed to make remote calls to SAM](security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md) ###### [Network access: Shares that can be accessed anonymously](security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md) ###### [Network access: Sharing and security model for local accounts](security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md) ###### [Network security: Allow Local System to use computer identity for NTLM](security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) diff --git a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md index 8896c08c25..ad2a9abf62 100644 --- a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md @@ -3,13 +3,13 @@ title: Advanced security audit policy settings (Windows 10) description: This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. ms.assetid: 93b28b92-796f-4036-a53b-8b9e80f9f171 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -65,7 +65,7 @@ Detailed Tracking security policy settings and audit events can be used to monit - [Audit Process Termination](audit-process-termination.md) - [Audit RPC Events](audit-rpc-events.md) - [Audit Credential Validation](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-credential-validation) - > **Note:** For more information, see [Security Monitoring](https://blogs.technet.microsoft.com/nathangau/2018/01/25/security-monitoring-a-possible-new-way-to-detect-privilege-escalation/) +- [Audit Token Right Adjusted](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-token-right-adjusted) ## DS Access diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md index c0611c6e06..99b8a989c4 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md +++ b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md @@ -3,13 +3,13 @@ title: Advanced security auditing FAQ (Windows 10) description: This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies. ms.assetid: 80f8f187-0916-43c2-a7e8-ea712b115a06 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing.md b/windows/security/threat-protection/auditing/advanced-security-auditing.md index 63485f34ef..9270164aec 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing.md +++ b/windows/security/threat-protection/auditing/advanced-security-auditing.md @@ -3,13 +3,13 @@ title: Advanced security audit policies (Windows 10) description: Advanced security audit policy settings are found in Security Settings\\Advanced Audit Policy Configuration\\System Audit Policies and appear to overlap with basic security audit policies, but they are recorded and applied differently. ms.assetid: 6FE8AC10-F48E-4BBF-979B-43A5DFDC5DFC ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md b/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md index f416edda8c..d212b266b1 100644 --- a/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md +++ b/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md @@ -6,11 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # Appendix A: Security monitoring recommendations for many audit events diff --git a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md index c5c5466214..e559dc6001 100644 --- a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md +++ b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md @@ -3,13 +3,13 @@ title: Apply a basic audit policy on a file or folder (Windows 10) description: You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. ms.assetid: 565E7249-5CD0-4B2E-B2C0-B3A0793A51E2 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -39,6 +39,26 @@ To complete this procedure, you must be logged on as a member of the built-in Ad - To audit failure events, click **Fail.** - To audit all events, click **All.** + + +6. In the **Applies to** box, select the object(s) that the audit of events will apply to. These include: + + - **This folder only** + - **This folder, subfolders and files** + - **This folder and subfolders** + - **This folder and files** + - **Subfolders and files only** + - **Subfolders only** + - **Files only** + +7. By default, the selected **Basic Permissions** to audit are the following: + - **Read and execute** + - **List folder contents** + - **Read** + - Additionally, you can choose **Full control**, **Modify**, and/or **Write** permissions with your selected audit combination. + + + > **Important:**  Before setting up auditing for files and folders, you must enable [object access auditing](basic-audit-object-access.md) by defining auditing policy settings for the object access event category. If you do not enable object access auditing, you will receive an error message when you set up auditing for files and folders, and no files or folders will be audited.   ## Additional considerations diff --git a/windows/security/threat-protection/auditing/audit-account-lockout.md b/windows/security/threat-protection/auditing/audit-account-lockout.md index dcd17c9695..34e1304ce4 100644 --- a/windows/security/threat-protection/auditing/audit-account-lockout.md +++ b/windows/security/threat-protection/auditing/audit-account-lockout.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: da68624b-a174-482c-9bc5-ddddab38e589 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 07/16/2018 --- diff --git a/windows/security/threat-protection/auditing/audit-application-generated.md b/windows/security/threat-protection/auditing/audit-application-generated.md index e880c6b05b..72a5aecec7 100644 --- a/windows/security/threat-protection/auditing/audit-application-generated.md +++ b/windows/security/threat-protection/auditing/audit-application-generated.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 6c58a365-b25b-42b8-98ab-819002e31871 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-application-group-management.md b/windows/security/threat-protection/auditing/audit-application-group-management.md index 870ef553dd..96f7a50301 100644 --- a/windows/security/threat-protection/auditing/audit-application-group-management.md +++ b/windows/security/threat-protection/auditing/audit-application-group-management.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: 1bcaa41e-5027-4a86-96b7-f04eaf1c0606 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-audit-policy-change.md b/windows/security/threat-protection/auditing/audit-audit-policy-change.md index f8d37dcdaa..8f4d1d0d23 100644 --- a/windows/security/threat-protection/auditing/audit-audit-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-audit-policy-change.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 7153bf75-6978-4d7e-a821-59a699efb8a9 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-authentication-policy-change.md b/windows/security/threat-protection/auditing/audit-authentication-policy-change.md index 0171ab438c..8020663eb5 100644 --- a/windows/security/threat-protection/auditing/audit-authentication-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-authentication-policy-change.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes this Advanced Security ms.assetid: aa9cea7a-aadf-47b7-b704-ac253b8e79be ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md index 329e7259b8..af4339ce53 100644 --- a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: ca0587a2-a2b3-4300-aa5d-48b4553c3b36 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md b/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md index a9c4011dab..061105bbac 100644 --- a/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md +++ b/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: D9BB11CE-949A-4B48-82BF-30DC5E6FC67D ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-certification-services.md b/windows/security/threat-protection/auditing/audit-certification-services.md index 1dd10ad26a..4214420b03 100644 --- a/windows/security/threat-protection/auditing/audit-certification-services.md +++ b/windows/security/threat-protection/auditing/audit-certification-services.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: cdefc34e-fb1f-4eff-b766-17713c5a1b03 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-computer-account-management.md b/windows/security/threat-protection/auditing/audit-computer-account-management.md index 1425e2cb70..d0d902a868 100644 --- a/windows/security/threat-protection/auditing/audit-computer-account-management.md +++ b/windows/security/threat-protection/auditing/audit-computer-account-management.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: 6c406693-57bf-4411-bb6c-ff83ce548991 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-credential-validation.md b/windows/security/threat-protection/auditing/audit-credential-validation.md index 68b0305d77..feac5d138b 100644 --- a/windows/security/threat-protection/auditing/audit-credential-validation.md +++ b/windows/security/threat-protection/auditing/audit-credential-validation.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: 6654b33a-922e-4a43-8223-ec5086dfc926 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md index 93757103e6..2b345207d2 100644 --- a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md +++ b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: 1b89c8f5-bce7-4b20-8701-42585c7ab993 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-detailed-file-share.md b/windows/security/threat-protection/auditing/audit-detailed-file-share.md index 6d6e5b0095..41ed83320d 100644 --- a/windows/security/threat-protection/auditing/audit-detailed-file-share.md +++ b/windows/security/threat-protection/auditing/audit-detailed-file-share.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 60310104-b820-4033-a1cb-022a34f064ae ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-directory-service-access.md b/windows/security/threat-protection/auditing/audit-directory-service-access.md index a56a269acd..ae15d23652 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-access.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-access.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: ba2562ba-4282-4588-b87c-a3fcb771c7d0 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-directory-service-changes.md b/windows/security/threat-protection/auditing/audit-directory-service-changes.md index 8fc975671d..4110cd1ec6 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-changes.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-changes.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: 9f7c0dd4-3977-47dd-a0fb-ec2f17cad05e ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-directory-service-replication.md index 6580b8f311..06737f9521 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-replication.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-replication.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: b95d296c-7993-4e8d-8064-a8bbe284bd56 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-distribution-group-management.md b/windows/security/threat-protection/auditing/audit-distribution-group-management.md index 83d36fa376..0c779c954f 100644 --- a/windows/security/threat-protection/auditing/audit-distribution-group-management.md +++ b/windows/security/threat-protection/auditing/audit-distribution-group-management.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: d46693a4-5887-4a58-85db-2f6cba224a66 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-dpapi-activity.md b/windows/security/threat-protection/auditing/audit-dpapi-activity.md index 3efd600fab..835e1fd7f3 100644 --- a/windows/security/threat-protection/auditing/audit-dpapi-activity.md +++ b/windows/security/threat-protection/auditing/audit-dpapi-activity.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: be4d4c83-c857-4e3d-a84e-8bcc3f2c99cd ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-file-share.md b/windows/security/threat-protection/auditing/audit-file-share.md index ed86354e2b..512ae2084a 100644 --- a/windows/security/threat-protection/auditing/audit-file-share.md +++ b/windows/security/threat-protection/auditing/audit-file-share.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 9ea985f8-8936-4b79-abdb-35cbb7138f78 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-file-system.md b/windows/security/threat-protection/auditing/audit-file-system.md index 6f97bd7fdd..fe21575b2b 100644 --- a/windows/security/threat-protection/auditing/audit-file-system.md +++ b/windows/security/threat-protection/auditing/audit-file-system.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 6a71f283-b8e5-41ac-b348-0b7ec6ea0b1f ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md b/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md index 187040144e..734f231b24 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: d72936e9-ff01-4d18-b864-a4958815df59 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md b/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md index e37ee47f16..b953cf56c0 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 95457601-68d1-4385-af20-87916ddab906 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md index 6cd117429a..c82bbebd49 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 0eaf1c56-672b-4ea9-825a-22dc03eb4041 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-group-membership.md b/windows/security/threat-protection/auditing/audit-group-membership.md index 7af1da773b..18b2e9556d 100644 --- a/windows/security/threat-protection/auditing/audit-group-membership.md +++ b/windows/security/threat-protection/auditing/audit-group-membership.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: 1CD7B014-FBD9-44B9-9274-CC5715DE58B9 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-handle-manipulation.md b/windows/security/threat-protection/auditing/audit-handle-manipulation.md index 4f4f0616af..3802d34249 100644 --- a/windows/security/threat-protection/auditing/audit-handle-manipulation.md +++ b/windows/security/threat-protection/auditing/audit-handle-manipulation.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 1fbb004a-ccdc-4c80-b3da-a4aa7a9f4091 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-ipsec-driver.md b/windows/security/threat-protection/auditing/audit-ipsec-driver.md index 6b69b8a282..0f0a9fa7b5 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-driver.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-driver.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: c8b8c02f-5ad0-4ee5-9123-ea8cdae356a5 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 10/02/2018 --- diff --git a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md index 27e7cf7591..af3502ddce 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: 2b4fee9e-482a-4181-88a8-6a79d8fc8049 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 10/02/2018 --- diff --git a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md index 84c5eda210..d4aa3ebf77 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: 06ed26ec-3620-4ef4-a47a-c70df9c8827b ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 10/02/2018 --- diff --git a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md index 9f081e8e45..54e46c85cd 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: 7be67a15-c2ce-496a-9719-e25ac7699114 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 10/02/2018 --- diff --git a/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md b/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md index 995bf11ffc..d28314643d 100644 --- a/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md +++ b/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 990dd6d9-1a1f-4cce-97ba-5d7e0a7db859 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md b/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md index 4e685381b1..f8bacdd852 100644 --- a/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md +++ b/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: ddc0abef-ac7f-4849-b90d-66700470ccd6 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-kernel-object.md b/windows/security/threat-protection/auditing/audit-kernel-object.md index f4c965ec52..44049a109f 100644 --- a/windows/security/threat-protection/auditing/audit-kernel-object.md +++ b/windows/security/threat-protection/auditing/audit-kernel-object.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 75619d8b-b1eb-445b-afc9-0f9053be97fb ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-logoff.md b/windows/security/threat-protection/auditing/audit-logoff.md index 3ff2570d46..45e9abeb45 100644 --- a/windows/security/threat-protection/auditing/audit-logoff.md +++ b/windows/security/threat-protection/auditing/audit-logoff.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 681e51f2-ba06-46f5-af8c-d9c48d515432 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 07/16/2018 --- diff --git a/windows/security/threat-protection/auditing/audit-logon.md b/windows/security/threat-protection/auditing/audit-logon.md index a1fa633cae..3742607eba 100644 --- a/windows/security/threat-protection/auditing/audit-logon.md +++ b/windows/security/threat-protection/auditing/audit-logon.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: ca968d03-7d52-48c4-ba0e-2bcd2937231b ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md b/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md index f756f7d9b5..25e29659e8 100644 --- a/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 263461b3-c61c-4ec3-9dee-851164845019 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-network-policy-server.md b/windows/security/threat-protection/auditing/audit-network-policy-server.md index cc023326da..6d7eaac005 100644 --- a/windows/security/threat-protection/auditing/audit-network-policy-server.md +++ b/windows/security/threat-protection/auditing/audit-network-policy-server.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 43b2aea4-26df-46da-b761-2b30f51a80f7 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md index 309f195d7d..f1227802bd 100644 --- a/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md +++ b/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 8fd74783-1059-443e-aa86-566d78606627 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-account-logon-events.md b/windows/security/threat-protection/auditing/audit-other-account-logon-events.md index 218e662e92..edbcb2555d 100644 --- a/windows/security/threat-protection/auditing/audit-other-account-logon-events.md +++ b/windows/security/threat-protection/auditing/audit-other-account-logon-events.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: c8c6bfe0-33d2-4600-bb1a-6afa840d75b3 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-account-management-events.md b/windows/security/threat-protection/auditing/audit-other-account-management-events.md index a52ff0d042..cd054ab132 100644 --- a/windows/security/threat-protection/auditing/audit-other-account-management-events.md +++ b/windows/security/threat-protection/auditing/audit-other-account-management-events.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 4ce22eeb-a96f-4cf9-a46d-6642961a31d5 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md index 77527e8253..b10a5106ba 100644 --- a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md +++ b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 76d987cd-1917-4907-a739-dd642609a458 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-object-access-events.md b/windows/security/threat-protection/auditing/audit-other-object-access-events.md index d9513980da..3bfc786df1 100644 --- a/windows/security/threat-protection/auditing/audit-other-object-access-events.md +++ b/windows/security/threat-protection/auditing/audit-other-object-access-events.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: b9774595-595d-4199-b0c5-8dbc12b6c8b2 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 05/29/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-policy-change-events.md b/windows/security/threat-protection/auditing/audit-other-policy-change-events.md index 2690694166..e156529bf1 100644 --- a/windows/security/threat-protection/auditing/audit-other-policy-change-events.md +++ b/windows/security/threat-protection/auditing/audit-other-policy-change-events.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 8618502e-c21c-41cc-8a49-3dc1eb359e60 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md index bbe45925d3..e13d22c6e3 100644 --- a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md +++ b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md @@ -4,13 +4,13 @@ description: This security policy setting is not used. ms.assetid: 5f7f5b25-42a6-499f-8aa2-01ac79a2a63c ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-system-events.md b/windows/security/threat-protection/auditing/audit-other-system-events.md index 66a05eb6c1..839166429b 100644 --- a/windows/security/threat-protection/auditing/audit-other-system-events.md +++ b/windows/security/threat-protection/auditing/audit-other-system-events.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 2401e4cc-d94e-41ec-82a7-e10914295f8b ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-pnp-activity.md b/windows/security/threat-protection/auditing/audit-pnp-activity.md index cc7a689b7c..6e2ce1aa93 100644 --- a/windows/security/threat-protection/auditing/audit-pnp-activity.md +++ b/windows/security/threat-protection/auditing/audit-pnp-activity.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: A3D87B3B-EBBE-442A-953B-9EB75A5F600E ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-process-creation.md b/windows/security/threat-protection/auditing/audit-process-creation.md index 0868fa7fe7..8532644095 100644 --- a/windows/security/threat-protection/auditing/audit-process-creation.md +++ b/windows/security/threat-protection/auditing/audit-process-creation.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 67e39fcd-ded6-45e8-b1b6-d411e4e93019 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-process-termination.md b/windows/security/threat-protection/auditing/audit-process-termination.md index 5bf90b6f6a..3943542ccf 100644 --- a/windows/security/threat-protection/auditing/audit-process-termination.md +++ b/windows/security/threat-protection/auditing/audit-process-termination.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 65d88e53-14aa-48a4-812b-557cebbf9e50 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-registry.md b/windows/security/threat-protection/auditing/audit-registry.md index 4db7d65686..fe4cd66839 100644 --- a/windows/security/threat-protection/auditing/audit-registry.md +++ b/windows/security/threat-protection/auditing/audit-registry.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 02bcc23b-4823-46ac-b822-67beedf56b32 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-removable-storage.md b/windows/security/threat-protection/auditing/audit-removable-storage.md index f35a441ef8..96314fa0bd 100644 --- a/windows/security/threat-protection/auditing/audit-removable-storage.md +++ b/windows/security/threat-protection/auditing/audit-removable-storage.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 1746F7B3-8B41-4661-87D8-12F734AFFB26 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-rpc-events.md b/windows/security/threat-protection/auditing/audit-rpc-events.md index 1a4b0dbfbc..f35fb87e98 100644 --- a/windows/security/threat-protection/auditing/audit-rpc-events.md +++ b/windows/security/threat-protection/auditing/audit-rpc-events.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: 868aec2d-93b4-4bc8-a150-941f88838ba6 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-sam.md b/windows/security/threat-protection/auditing/audit-sam.md index 2a7efe94ec..31d65aafb1 100644 --- a/windows/security/threat-protection/auditing/audit-sam.md +++ b/windows/security/threat-protection/auditing/audit-sam.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 1d00f955-383d-4c95-bbd1-fab4a991a46e ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-security-group-management.md b/windows/security/threat-protection/auditing/audit-security-group-management.md index 91aef3a375..710f45b4ae 100644 --- a/windows/security/threat-protection/auditing/audit-security-group-management.md +++ b/windows/security/threat-protection/auditing/audit-security-group-management.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: ac2ee101-557b-4c84-b9fa-4fb23331f1aa ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 02/28/2019 --- diff --git a/windows/security/threat-protection/auditing/audit-security-state-change.md b/windows/security/threat-protection/auditing/audit-security-state-change.md index ac8fcf4c32..f002a9938a 100644 --- a/windows/security/threat-protection/auditing/audit-security-state-change.md +++ b/windows/security/threat-protection/auditing/audit-security-state-change.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: decb3218-a67d-4efa-afc0-337c79a89a2d ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-security-system-extension.md b/windows/security/threat-protection/auditing/audit-security-system-extension.md index 97c9f853c7..3d2beb88d0 100644 --- a/windows/security/threat-protection/auditing/audit-security-system-extension.md +++ b/windows/security/threat-protection/auditing/audit-security-system-extension.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 9f3c6bde-42b2-4a0a-b353-ed3106ebc005 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md index c099b898d6..ac5edaec4a 100644 --- a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md +++ b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 915abf50-42d2-45f6-9fd1-e7bd201b193d ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-special-logon.md b/windows/security/threat-protection/auditing/audit-special-logon.md index faa994ab12..cae080c72b 100644 --- a/windows/security/threat-protection/auditing/audit-special-logon.md +++ b/windows/security/threat-protection/auditing/audit-special-logon.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: e1501bac-1d09-4593-8ebb-f311231567d3 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-system-integrity.md b/windows/security/threat-protection/auditing/audit-system-integrity.md index df2120830a..606b78493e 100644 --- a/windows/security/threat-protection/auditing/audit-system-integrity.md +++ b/windows/security/threat-protection/auditing/audit-system-integrity.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the Advanced Security ms.assetid: 942a9a7f-fa31-4067-88c7-f73978bf2034 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-token-right-adjusted.md b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md new file mode 100644 index 0000000000..a4fb47fef4 --- /dev/null +++ b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md @@ -0,0 +1,27 @@ +--- +title: Audit Token Right Adjusted (Windows 10) +description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Token Right Adjusted, which determines whether the operating system generates audit events when specific changes are made to the privileges of a token. +--- + +# Audit Token Right Adjusted + +**Applies to** +- Windows 10 +- Windows Server 2016 + + +Audit Token Right Adjusted allows you to audit events generated by adjusting the privileges of a token. + +For more information, see [Security Monitoring: A Possible New Way to Detect Privilege Escalation](https://blogs.technet.microsoft.com/nathangau/2018/01/25/security-monitoring-a-possible-new-way-to-detect-privilege-escalation/). + +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Domain Controller | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
                        However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                        If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                        This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
                        However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                        If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                        This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
                        However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                        If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                        This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | + +**Events List:** + +- [4703](event-4703.md)(S): A user right was adjusted. + +**Event volume**: High. diff --git a/windows/security/threat-protection/auditing/audit-user-account-management.md b/windows/security/threat-protection/auditing/audit-user-account-management.md index 82f8975fd5..25d5f2620c 100644 --- a/windows/security/threat-protection/auditing/audit-user-account-management.md +++ b/windows/security/threat-protection/auditing/audit-user-account-management.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: f7e72998-3858-4197-a443-19586ecc4bfb ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-user-device-claims.md b/windows/security/threat-protection/auditing/audit-user-device-claims.md index 7877fe6b80..55da915b55 100644 --- a/windows/security/threat-protection/auditing/audit-user-device-claims.md +++ b/windows/security/threat-protection/auditing/audit-user-device-claims.md @@ -4,13 +4,13 @@ description: This topic for the IT professional describes the advanced security ms.assetid: D3D2BFAF-F2C0-462A-9377-673DB49D5486 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md index 07f239f4d3..f345a84336 100644 --- a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md @@ -3,13 +3,13 @@ title: Audit account logon events (Windows 10) description: Determines whether to audit each instance of a user logging on to or logging off from another device in which this device is used to validate the account. ms.assetid: 84B44181-E325-49A1-8398-AECC3CE0A516 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-account-management.md b/windows/security/threat-protection/auditing/basic-audit-account-management.md index 3d6f35ef9d..e699a88ac1 100644 --- a/windows/security/threat-protection/auditing/basic-audit-account-management.md +++ b/windows/security/threat-protection/auditing/basic-audit-account-management.md @@ -3,13 +3,13 @@ title: Audit account management (Windows 10) description: Determines whether to audit each event of account management on a device. ms.assetid: 369197E1-7E0E-45A4-89EA-16D91EF01689 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md index 65f6a0672b..5fcf6e9222 100644 --- a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md +++ b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md @@ -3,13 +3,13 @@ title: Audit directory service access (Windows 10) description: Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified. ms.assetid: 52F02EED-3CFE-4307-8D06-CF1E27693D09 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-logon-events.md index edba7f71a5..5c7672c13a 100644 --- a/windows/security/threat-protection/auditing/basic-audit-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-logon-events.md @@ -3,13 +3,13 @@ title: Audit logon events (Windows 10) description: Determines whether to audit each instance of a user logging on to or logging off from a device. ms.assetid: 78B5AFCB-0BBD-4C38-9FE9-6B4571B94A35 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-object-access.md b/windows/security/threat-protection/auditing/basic-audit-object-access.md index ae6a25d613..438dd850c9 100644 --- a/windows/security/threat-protection/auditing/basic-audit-object-access.md +++ b/windows/security/threat-protection/auditing/basic-audit-object-access.md @@ -3,13 +3,13 @@ title: Audit object access (Windows 10) description: Determines whether to audit the event of a user accessing an object--for example, a file, folder, registry key, printer, and so forth--that has its own system access control list (SACL) specified. ms.assetid: D15B6D67-7886-44C2-9972-3F192D5407EA ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-policy-change.md b/windows/security/threat-protection/auditing/basic-audit-policy-change.md index a98760482c..b80e5788af 100644 --- a/windows/security/threat-protection/auditing/basic-audit-policy-change.md +++ b/windows/security/threat-protection/auditing/basic-audit-policy-change.md @@ -3,13 +3,13 @@ title: Audit policy change (Windows 10) description: Determines whether to audit every incident of a change to user rights assignment policies, audit policies, or trust policies. ms.assetid: 1025A648-6B22-4C85-9F47-FE0897F1FA31 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md index 4a0ea891c0..a3e7893fe6 100644 --- a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md +++ b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md @@ -3,13 +3,13 @@ title: Audit privilege use (Windows 10) description: Determines whether to audit each instance of a user exercising a user right. ms.assetid: C5C6DAAF-8B58-4DFB-B1CE-F0675AE0E9F8 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md index c99e882563..4f02eab9a3 100644 --- a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md +++ b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md @@ -3,13 +3,13 @@ title: Audit process tracking (Windows 10) description: Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access. ms.assetid: 91AC5C1E-F4DA-4B16-BEE2-C92D66E4CEEA ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-audit-system-events.md b/windows/security/threat-protection/auditing/basic-audit-system-events.md index 6283d5a530..7811de4253 100644 --- a/windows/security/threat-protection/auditing/basic-audit-system-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-system-events.md @@ -3,13 +3,13 @@ title: Audit system events (Windows 10) description: Determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log. ms.assetid: BF27588C-2AA7-4365-A4BF-3BB377916447 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policies.md b/windows/security/threat-protection/auditing/basic-security-audit-policies.md index 80170efbf6..1e73acf50d 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policies.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policies.md @@ -3,13 +3,13 @@ title: Basic security audit policies (Windows 10) description: Before you implement auditing, you must decide on an auditing policy. ms.assetid: 3B678568-7AD7-4734-9BB4-53CF5E04E1D3 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md index 997ee3cfee..686cdfdc71 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md @@ -3,13 +3,13 @@ title: Basic security audit policy settings (Windows 10) description: Basic security audit policy settings are found under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. ms.assetid: 31C2C453-2CFC-4D9E-BC88-8CE1C1A8F900 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md index a99bb14e40..745c787671 100644 --- a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md +++ b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md @@ -3,13 +3,13 @@ title: Create a basic audit policy for an event category (Windows 10) description: By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization. ms.assetid: C9F52751-B40D-482E-BE9D-2C61098249D3 ms.reviewer: -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: Mir0sh +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/event-1100.md b/windows/security/threat-protection/auditing/event-1100.md index 5f995bb735..251aa8834c 100644 --- a/windows/security/threat-protection/auditing/event-1100.md +++ b/windows/security/threat-protection/auditing/event-1100.md @@ -6,11 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # 1100(S): The event logging service has shut down. diff --git a/windows/security/threat-protection/auditing/event-1102.md b/windows/security/threat-protection/auditing/event-1102.md index 1edce314ef..c1d44d55e0 100644 --- a/windows/security/threat-protection/auditing/event-1102.md +++ b/windows/security/threat-protection/auditing/event-1102.md @@ -6,11 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # 1102(S): The audit log was cleared. diff --git a/windows/security/threat-protection/auditing/event-1104.md b/windows/security/threat-protection/auditing/event-1104.md index d70f00eeb9..5854f68b90 100644 --- a/windows/security/threat-protection/auditing/event-1104.md +++ b/windows/security/threat-protection/auditing/event-1104.md @@ -6,11 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # 1104(S): The security log is now full. diff --git a/windows/security/threat-protection/auditing/event-4612.md b/windows/security/threat-protection/auditing/event-4612.md index 163c584492..2ca7cca35a 100644 --- a/windows/security/threat-protection/auditing/event-4612.md +++ b/windows/security/threat-protection/auditing/event-4612.md @@ -30,9 +30,9 @@ There is no example of this event in this document. ***Event Schema:*** -*Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. * +*Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.* -*Number of audit messages discarded: %1 * +*Number of audit messages discarded: %1* *This event is generated when audit queues are filled and events must be discarded. This most commonly occurs when security events are being generated faster than they are being written to disk, or when the auditing system loses connectivity to the event log, such as when the event log service is stopped.* diff --git a/windows/security/threat-protection/auditing/event-4615.md b/windows/security/threat-protection/auditing/event-4615.md index be8925c8ba..9231f28b82 100644 --- a/windows/security/threat-protection/auditing/event-4615.md +++ b/windows/security/threat-protection/auditing/event-4615.md @@ -48,7 +48,7 @@ It appears that this event never occurs. *LPC Server Port Name:%6* -*Windows Local Security Authority (LSA) communicates with the Windows kernel using Local Procedure Call (LPC) ports. If you see this event, an application has inadvertently or intentionally accessed this port which is reserved exclusively for LSA’s use. The application (process) should be investigated to ensure that it is not attempting to tamper with this communications channel." * +*Windows Local Security Authority (LSA) communicates with the Windows kernel using Local Procedure Call (LPC) ports. If you see this event, an application has inadvertently or intentionally accessed this port which is reserved exclusively for LSA’s use. The application (process) should be investigated to ensure that it is not attempting to tamper with this communications channel."* ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index f3c3ed088b..2ca7e8267c 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -138,7 +138,7 @@ This event generates when a logon session is created (on destination machine). I - **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4672](event-4672.md)(S): Special privileges assigned to new logon.” -**Logon Information** \[Version 2\]**: ** +**Logon Information** \[Version 2\]**:** - **Logon Type** \[Version 0, 1, 2\] \[Type = UInt32\]**:** the type of logon which was performed. The table below contains the list of possible values for this field. diff --git a/windows/security/threat-protection/auditing/event-4670.md b/windows/security/threat-protection/auditing/event-4670.md index 95a2dfe34f..45dcd000c9 100644 --- a/windows/security/threat-protection/auditing/event-4670.md +++ b/windows/security/threat-protection/auditing/event-4670.md @@ -142,7 +142,7 @@ Before this event can generate, certain ACEs might need to be set in the object - **New Security Descriptor** \[Type = UnicodeString\]**:** the new Security Descriptor Definition Language (SDDL) value for the object. -> **Note**  The ** Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. +> **Note**  The **Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. > > Example: > diff --git a/windows/security/threat-protection/auditing/event-4688.md b/windows/security/threat-protection/auditing/event-4688.md index 8e1fe42fab..94d84a85cf 100644 --- a/windows/security/threat-protection/auditing/event-4688.md +++ b/windows/security/threat-protection/auditing/event-4688.md @@ -151,7 +151,7 @@ This event generates every time a new process starts. - **New Process Name** \[Type = UnicodeString\]**:** full path and the name of the executable for the new process. -- **Token Elevation Type** \[Type = UnicodeString\]**: ** +- **Token Elevation Type** \[Type = UnicodeString\]**:** - **TokenElevationTypeDefault (1):** Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account (for which UAC disabled by default), service account or local system account. diff --git a/windows/security/threat-protection/auditing/event-4704.md b/windows/security/threat-protection/auditing/event-4704.md index f9b06a7a3b..f78b83ef3c 100644 --- a/windows/security/threat-protection/auditing/event-4704.md +++ b/windows/security/threat-protection/auditing/event-4704.md @@ -99,7 +99,7 @@ You will see unique event for every user. - **Account Name** \[Type = SID\]: the SID of security principal for which user rights were assigned. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -**New Right: ** +**New Right:** - **User Right** \[Type = UnicodeString\]: the list of assigned user rights. This event generates only for *user* rights, not logon rights. Here is the list of possible user rights: diff --git a/windows/security/threat-protection/auditing/event-4705.md b/windows/security/threat-protection/auditing/event-4705.md index d009b73786..09c240e026 100644 --- a/windows/security/threat-protection/auditing/event-4705.md +++ b/windows/security/threat-protection/auditing/event-4705.md @@ -99,7 +99,7 @@ You will see unique event for every user. - **Account Name** \[Type = SID\]: the SID of security principal for which user rights were removed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -**Removed Right: ** +**Removed Right:** - **User Right** \[Type = UnicodeString\]: the list of removed user rights. This event generates only for *user* rights, not logon rights. Here is the list of possible user rights: diff --git a/windows/security/threat-protection/auditing/event-4715.md b/windows/security/threat-protection/auditing/event-4715.md index 38d46d5ace..c51f51c999 100644 --- a/windows/security/threat-protection/auditing/event-4715.md +++ b/windows/security/threat-protection/auditing/event-4715.md @@ -100,7 +100,7 @@ This event is always logged regardless of the "Audit Policy Change" sub-category - **New Security Descriptor** \[Type = UnicodeString\]**:** new Security Descriptor Definition Language (SDDL) value for the audit policy. -> **Note**  The ** Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. +> **Note**  The **Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. > > Example: > diff --git a/windows/security/threat-protection/auditing/event-4717.md b/windows/security/threat-protection/auditing/event-4717.md index f04223bd5b..13f2c744aa 100644 --- a/windows/security/threat-protection/auditing/event-4717.md +++ b/windows/security/threat-protection/auditing/event-4717.md @@ -99,7 +99,7 @@ You will see unique event for every user if logon user rights were granted to mu - **Account Name** \[Type = SID\]: the SID of the security principal for which logon right was granted. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -**Access Granted: ** +**Access Granted:** - **Access Right** \[Type = UnicodeString\]: the name of granted logon right. This event generates only for [logon rights](https://technet.microsoft.com/library/cc728212(v=ws.10).aspx), which are as follows: diff --git a/windows/security/threat-protection/auditing/event-4718.md b/windows/security/threat-protection/auditing/event-4718.md index a86f9f5168..9bb398d835 100644 --- a/windows/security/threat-protection/auditing/event-4718.md +++ b/windows/security/threat-protection/auditing/event-4718.md @@ -99,7 +99,7 @@ You will see unique event for every user if logon user rights were removed for m - **Account Name** \[Type = SID\]: the SID of the security principal for which logon right was removed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -**Access Removed: ** +**Access Removed:** - **Access Right** \[Type = UnicodeString\]: the name of removed logon right. This event generates only for [logon rights](https://technet.microsoft.com/library/cc728212(v=ws.10).aspx), which are as follows: diff --git a/windows/security/threat-protection/auditing/event-4738.md b/windows/security/threat-protection/auditing/event-4738.md index 8597d956a6..faa3dcf853 100644 --- a/windows/security/threat-protection/auditing/event-4738.md +++ b/windows/security/threat-protection/auditing/event-4738.md @@ -266,7 +266,7 @@ For 4738(S): A user account was changed. |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Display Name**
                        **User Principal Name**
                        **Home Directory**
                        **Home Drive**
                        **Script Path**
                        **Profile Path**
                        **User Workstations**
                        **Password Last Set**
                        **Account Expires**
                        **Primary Group ID
                        Logon Hours** | We recommend monitoring all changes for these fields for critical domain and local accounts. | | **Primary Group ID** is not 513 | Typically, the **Primary Group** value is 513 for domain and local users. Other values should be monitored. | -| For user accounts for which the services list (on the **Delegation** tab) should not be empty: **AllowedToDelegateTo** is marked **<value not set> ** | If **AllowedToDelegateTo** is marked **<value not set>** on user accounts that previously had a services list (on the **Delegation** tab), it means the list was cleared. | +| For user accounts for which the services list (on the **Delegation** tab) should not be empty: **AllowedToDelegateTo** is marked **<value not set>** | If **AllowedToDelegateTo** is marked **<value not set>** on user accounts that previously had a services list (on the **Delegation** tab), it means the list was cleared. | | **SID History** is not - | This field will always be set to - unless the account was migrated from another domain. | - Consider whether to track the following user account control flags: diff --git a/windows/security/threat-protection/auditing/event-4742.md b/windows/security/threat-protection/auditing/event-4742.md index 22ae105d96..b39135ee00 100644 --- a/windows/security/threat-protection/auditing/event-4742.md +++ b/windows/security/threat-protection/auditing/event-4742.md @@ -276,7 +276,7 @@ For 4742(S): A computer account was changed. | **Display Name** is not -
                        **User Principal Name** is not -
                        **Home Directory** is not -
                        **Home Drive** is not -
                        **Script Path** is not -
                        **Profile Path** is not -
                        **User Workstations** is not -
                        **Account Expires** is not -
                        **Logon Hours** is not **-** | Typically these fields are **-** for computer accounts. Other values might indicate an anomaly and should be monitored. | | **Password Last Set** changes occur more often than usual | Changes that are more frequent than the default (typically once a month) might indicate an anomaly or attack. | | **Primary Group ID** is not 516, 521, or 515 | Typically, the **Primary Group ID** value is one of the following:
                        **516** for domain controllers
                        **521** for read only domain controllers (RODCs)
                        **515** for servers and workstations (domain computers)
                        Other values should be monitored. | -| For computer accounts for which the services list (on the **Delegation** tab) should not be empty: **AllowedToDelegateTo** is marked **<value not set> ** | If **AllowedToDelegateTo** is marked **<value not set>** on computers that previously had a services list (on the **Delegation** tab), it means the list was cleared. | +| For computer accounts for which the services list (on the **Delegation** tab) should not be empty: **AllowedToDelegateTo** is marked **<value not set>** | If **AllowedToDelegateTo** is marked **<value not set>** on computers that previously had a services list (on the **Delegation** tab), it means the list was cleared. | | **SID History** is not - | This field will always be set to - unless the account was migrated from another domain. | - Consider whether to track the following account control flags: diff --git a/windows/security/threat-protection/auditing/event-4817.md b/windows/security/threat-protection/auditing/event-4817.md index 74ffbb09b0..efdf01da8a 100644 --- a/windows/security/threat-protection/auditing/event-4817.md +++ b/windows/security/threat-protection/auditing/event-4817.md @@ -116,7 +116,7 @@ Separate events will be generated for “Registry” and “File system” polic | Job | Port | FilterConnectionPort | | | ALPC Port | Semaphore | Adapter | | -- **Object Name: ** +- **Object Name:** - Key – if “Registry” Global Object Access Auditing policy was changed. @@ -128,7 +128,7 @@ Separate events will be generated for “Registry” and “File system” polic - **New Security Descriptor** \[Type = UnicodeString\]**:** the new Security Descriptor Definition Language (SDDL) value for the Global Object Access Auditing policy. -> **Note**  The ** Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. +> **Note**  The **Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. > > Example: > diff --git a/windows/security/threat-protection/auditing/event-4864.md b/windows/security/threat-protection/auditing/event-4864.md index e62c824d10..62ced88fe8 100644 --- a/windows/security/threat-protection/auditing/event-4864.md +++ b/windows/security/threat-protection/auditing/event-4864.md @@ -44,7 +44,7 @@ There is no example of this event in this document. *Security ID:%7* -*New Flags:%8 * +*New Flags:%8* ***Required Server Roles:*** Active Directory domain controller. diff --git a/windows/security/threat-protection/auditing/event-4907.md b/windows/security/threat-protection/auditing/event-4907.md index f74c140ce4..34454c6d14 100644 --- a/windows/security/threat-protection/auditing/event-4907.md +++ b/windows/security/threat-protection/auditing/event-4907.md @@ -159,7 +159,7 @@ This event doesn't generate for Active Directory objects. - **New Security Descriptor** \[Type = UnicodeString\]**:** the new Security Descriptor Definition Language (SDDL) value for the object. -> **Note**  The ** Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. +> **Note**  The **Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. > > Example: > diff --git a/windows/security/threat-protection/auditing/event-4911.md b/windows/security/threat-protection/auditing/event-4911.md index cc73362f36..d385a72649 100644 --- a/windows/security/threat-protection/auditing/event-4911.md +++ b/windows/security/threat-protection/auditing/event-4911.md @@ -152,7 +152,7 @@ Resource attributes for file or folder can be changed, for example, using Window - **New Security Descriptor** \[Type = UnicodeString\]**:** the Security Descriptor Definition Language (SDDL) value for the new resource attributes. See more information in **Resource Attributes\\Original Security Descriptor** field section for this event. -> **Note**  The ** Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. +> **Note**  The **Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. > > Example: > diff --git a/windows/security/threat-protection/auditing/event-4913.md b/windows/security/threat-protection/auditing/event-4913.md index f8dcd9f29b..3be7e9bec3 100644 --- a/windows/security/threat-protection/auditing/event-4913.md +++ b/windows/security/threat-protection/auditing/event-4913.md @@ -156,7 +156,7 @@ This event always generates, regardless of the object’s [SACL](https://msdn.mi - **New Security Descriptor** \[Type = UnicodeString\]**:** the Security Descriptor Definition Language (SDDL) value for the new Central Policy ID (for the policy that has been applied to the object). See more information in **Central Policy ID\\Original Security Descriptor** field section for this event. -> **Note**  The ** Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. +> **Note**  The **Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. > > Example: > diff --git a/windows/security/threat-protection/auditing/event-5143.md b/windows/security/threat-protection/auditing/event-5143.md index 81e6052b16..c7f46521ae 100644 --- a/windows/security/threat-protection/auditing/event-5143.md +++ b/windows/security/threat-protection/auditing/event-5143.md @@ -141,7 +141,7 @@ This event generates every time network share object was modified. - **New SD** \[Type = UnicodeString\]**:** the new Security Descriptor Definition Language (SDDL) value for network share security descriptor. -> **Note**  The ** Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. +> **Note**  The **Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. > > Example: > diff --git a/windows/security/threat-protection/auditing/event-5145.md b/windows/security/threat-protection/auditing/event-5145.md index 696faaadce..f5ec73669e 100644 --- a/windows/security/threat-protection/auditing/event-5145.md +++ b/windows/security/threat-protection/auditing/event-5145.md @@ -177,7 +177,7 @@ REQUESTED\_ACCESS: RESULT ACE\_WHICH\_ ALLOWED\_OR\_DENIED\_ACCESS. - ACE\_WHICH\_ ALLOWED\_OR\_DENIED\_ACCESS: the Security Descriptor Definition Language (SDDL) value for Access Control Entry (ACE), which granted or denied access. -> **Note**  The ** Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. +> **Note**  The **Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. > > Example: > diff --git a/windows/security/threat-protection/auditing/event-5150.md b/windows/security/threat-protection/auditing/event-5150.md index 4d84e4bb68..c1f8d98680 100644 --- a/windows/security/threat-protection/auditing/event-5150.md +++ b/windows/security/threat-protection/auditing/event-5150.md @@ -52,7 +52,7 @@ There is no example of this event in this document. > > *Layer Name:%9* > -> *Layer Run-Time ID:%10 * +> *Layer Run-Time ID:%10* ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-5151.md b/windows/security/threat-protection/auditing/event-5151.md index 25faaeb212..699a093def 100644 --- a/windows/security/threat-protection/auditing/event-5151.md +++ b/windows/security/threat-protection/auditing/event-5151.md @@ -52,7 +52,7 @@ There is no example of this event in this document. > > *Layer Name:%9* > -> *Layer Run-Time ID:%10 * +> *Layer Run-Time ID:%10* ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-5155.md b/windows/security/threat-protection/auditing/event-5155.md index 934f310147..9964b6f390 100644 --- a/windows/security/threat-protection/auditing/event-5155.md +++ b/windows/security/threat-protection/auditing/event-5155.md @@ -24,35 +24,46 @@ By default Windows firewall won't prevent a port from being listened by an appli You can add your own filters using the WFP APIs to block listen to reproduce this event: . -There is no event example in this document. - ***Subcategory:*** [Audit Filtering Platform Connection](audit-filtering-platform-connection.md) -***Event Schema:*** +***Event Description:*** -*The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.* +This event generates every time the [Windows Filtering Platform](https://docs.microsoft.com/windows/win32/fwp/windows-filtering-platform-start-page) blocks an application or service from listening on a port for incoming connections. -*Application Information:* +
                        -> *Process ID:%1* -> -> *Application Name:%2* - -*Network Information:* - -> *Source Address:%3* -> -> *Source Port:%4* -> -> *Protocol:%5* - -*Filter Information:* - -> *Filter Run-Time ID:%6* -> -> *Layer Name:%7* -> -> *Layer Run-Time ID:%8* +***Event XML:*** +```xml + + + + 5155 + 0 + 0 + 12810 + 0 + 0x8010000000000000 + + 42196 + + + Security + NATHAN-AGENT2 + + + + 2628 + \device\harddiskvolume2\users\test\desktop\netcat\nc.exe + 0.0.0.0 + 5555 + 6 + 84576 + %%14609 + 40 + + +``` ***Required Server Roles:*** None. @@ -60,6 +71,76 @@ There is no event example in this document. ***Event Versions:*** 0. +***Field Descriptions:*** + +**Application Information**: + +- **Process ID** \[Type = Pointer\]: Hexadecimal Process ID (PID) of the process which was permitted to bind to the local port. The PID is a number used by the operating system to uniquely identify an active process. To see the PID for a specific process you can, for example, use Task Manager (Details tab, PID column): + + Task manager illustration + + If you convert the hexadecimal value to decimal, you can compare it to the values in Task Manager. + + You can also correlate this process ID with a process ID in other events, for example, “[4688](event-4688.md): A new process has been created” **Process Information\\New Process ID**. + + + +- **Application Name** \[Type = UnicodeString\]**:** Full path and the name of the executable for the process. + + Logical disk is displayed in the format \\device\\harddiskvolume\#. You can get all local volume numbers by using the **diskpart** utility. The command to get volume numbers using diskpart is “**list volume**”: + +DiskPart illustration + +**Network Information:** + +- **Source Address** \[Type = UnicodeString\]**:** The local IP address of the computer running the application. + + - IPv4 Address + + - IPv6 Address + + - :: - all IP addresses in IPv6 format + + - 0.0.0.0 - all IP addresses in IPv4 format + + - 127.0.0.1 , ::1 - localhost + +- **Source Port** \[Type = UnicodeString\]**:** The port number used by the application. + +- **Protocol** \[Type = UInt32\]: the protocol number being used. + +| Service | Protocol Number | +|----------------------------------------------------|-----------------| +| Internet Control Message Protocol (ICMP) | 1 | +| Transmission Control Protocol (TCP) | 6 | +| User Datagram Protocol (UDP) | 17 | +| General Routing Encapsulation (PPTP data over GRE) | 47 | +| Authentication Header (AH) IPSec | 51 | +| Encapsulation Security Payload (ESP) IPSec | 50 | +| Exterior Gateway Protocol (EGP) | 8 | +| Gateway-Gateway Protocol (GGP) | 3 | +| Host Monitoring Protocol (HMP) | 20 | +| Internet Group Management Protocol (IGMP) | 88 | +| MIT Remote Virtual Disk (RVD) | 66 | +| OSPF Open Shortest Path First | 89 | +| PARC Universal Packet Protocol (PUP) | 12 | +| Reliable Datagram Protocol (RDP) | 27 | +| Reservation Protocol (RSVP) QoS | 46 | + +**Filter Information:** + +- **Filter Run-Time ID** \[Type = UInt64\]: A unique filter ID which blocks the application from binding to the port. By default, Windows firewall won't prevent a port from binding to an application, and if this application doesn’t match any filters, you will get a 0 value in this field. + + To find a specific Windows Filtering Platform filter by ID, you need to execute the following command: **netsh wfp show filters**. As a result of this command, a **filters.xml** file will be generated. You need to open this file and find the specific substring with the required filter ID (**<filterId>**), for example: + + Filters.xml file illustration + +- **Layer Name** \[Type = UnicodeString\]: [Application Layer Enforcement](https://msdn.microsoft.com/library/windows/desktop/aa363971(v=vs.85).aspx) layer name. + +- **Layer Run-Time ID** \[Type = UInt64\]: Windows Filtering Platform layer identifier. To find a specific Windows Filtering Platform layer ID, you need to execute the following command: **netsh wfp show state**. As result of this command, a **wfpstate.xml** file will be generated. You need to open this file and find the specific substring with the required layer ID (**<layerId>**), for example: + +Wfpstate xml illustration + ## Security Monitoring Recommendations - If you use Windows Filtering Platform APIs to block application or services from listening on a port, then you can use this event for troubleshooting and monitoring. diff --git a/windows/security/threat-protection/auditing/event-6400.md b/windows/security/threat-protection/auditing/event-6400.md index d018fdee5e..7a379132bc 100644 --- a/windows/security/threat-protection/auditing/event-6400.md +++ b/windows/security/threat-protection/auditing/event-6400.md @@ -30,7 +30,7 @@ There is no example of this event in this document. *BranchCache: Received an incorrectly formatted response while discovering availability of content.* -*IP address of the client that sent this response:%1 * +*IP address of the client that sent this response:%1* ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-6401.md b/windows/security/threat-protection/auditing/event-6401.md index 9f647bcec8..1ce4c083dd 100644 --- a/windows/security/threat-protection/auditing/event-6401.md +++ b/windows/security/threat-protection/auditing/event-6401.md @@ -28,7 +28,7 @@ There is no example of this event in this document. ***Event Schema:*** -*BranchCache: Received invalid data from a peer. Data discarded. * +*BranchCache: Received invalid data from a peer. Data discarded.* *IP address of the client that sent this data:%1* diff --git a/windows/security/threat-protection/auditing/event-6402.md b/windows/security/threat-protection/auditing/event-6402.md index 5002d2167c..dde20455d3 100644 --- a/windows/security/threat-protection/auditing/event-6402.md +++ b/windows/security/threat-protection/auditing/event-6402.md @@ -28,7 +28,7 @@ There is no example of this event in this document. ***Event Schema:*** -*BranchCache: The message to the hosted cache offering it data is incorrectly formatted. * +*BranchCache: The message to the hosted cache offering it data is incorrectly formatted.* *IP address of the client that sent this message: %1* diff --git a/windows/security/threat-protection/auditing/event-6403.md b/windows/security/threat-protection/auditing/event-6403.md index 29629cb6a7..e8020581ad 100644 --- a/windows/security/threat-protection/auditing/event-6403.md +++ b/windows/security/threat-protection/auditing/event-6403.md @@ -28,7 +28,7 @@ There is no example of this event in this document. ***Event Schema:*** -*BranchCache: The hosted cache sent an incorrectly formatted response to the client’s message to offer it data. * +*BranchCache: The hosted cache sent an incorrectly formatted response to the client’s message to offer it data.* *Domain name of the hosted cache is:%1* diff --git a/windows/security/threat-protection/auditing/event-6404.md b/windows/security/threat-protection/auditing/event-6404.md index 0505b241b2..43228f26be 100644 --- a/windows/security/threat-protection/auditing/event-6404.md +++ b/windows/security/threat-protection/auditing/event-6404.md @@ -28,7 +28,7 @@ There is no example of this event in this document. ***Event Schema:*** -*BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate. * +*BranchCache: Hosted cache could not be authenticated using the provisioned SSL certificate.* *Domain name of the hosted cache:%1* diff --git a/windows/security/threat-protection/auditing/event-6409.md b/windows/security/threat-protection/auditing/event-6409.md index 8f28ea3891..e1f76dbf69 100644 --- a/windows/security/threat-protection/auditing/event-6409.md +++ b/windows/security/threat-protection/auditing/event-6409.md @@ -28,7 +28,7 @@ There is no example of this event in this document. ***Event Schema:*** -*BranchCache: A service connection point object could not be parsed. * +*BranchCache: A service connection point object could not be parsed.* *SCP object GUID: %1* diff --git a/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md b/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md index 99b2a8e507..70362c9d1c 100644 --- a/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md +++ b/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md @@ -10,7 +10,7 @@ ms.mktglfcycl: deploy ms.pagetype: security ms.sitesec: library author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp ms.date: 08/14/2017 ms.localizationpriority: medium --- @@ -21,7 +21,7 @@ ms.localizationpriority: medium - Windows 10 ->Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). +>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the `%windir%/Fonts` directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. diff --git a/windows/security/threat-protection/change-history-for-threat-protection.md b/windows/security/threat-protection/change-history-for-threat-protection.md index 7c5320ff0d..af17bfed1e 100644 --- a/windows/security/threat-protection/change-history-for-threat-protection.md +++ b/windows/security/threat-protection/change-history-for-threat-protection.md @@ -1,7 +1,7 @@ --- title: Change history for [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ms.reviewer: -ms.author: dolmont +ms.author: dansimp description: This topic lists new and updated topics in the WWindows Defender ATP content set. ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md index e8f58439cb..2c39b15201 100644 --- a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md +++ b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md @@ -6,43 +6,62 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -ms.author: daniha -author: danihalfin -ms.date: 02/22/2019 -ms.reviewer: +ms.author: dansimp +author: dansimp +ms.date: 09/12/2019 +ms.reviewer: dansimp manager: dansimp audience: ITPro --- -# How to control USB devices and other removable media using Windows Defender ATP +# How to control USB devices and other removable media using Microsoft Defender ATP -**Applies to:** [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Microsoft recommends [a layered approach to securing removable media](https://aka.ms/devicecontrolblog), and Windows Defender ATP provides multiple monitoring and control features to help prevent threats in unauthorized peripherals from compromising your devices: +Microsoft recommends [a layered approach to securing removable media](https://aka.ms/devicecontrolblog), and Microsoft Defender ATP provides multiple monitoring and control features to help prevent threats in unauthorized peripherals from compromising your devices: -1. [Prevent threats from removable storage](#prevent-threats-from-removable-storage) introduced by removable storage devices by enabling: - - [Windows Defender Antivirus real-time protection (RTP)](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus) to scan removable storage for malware. - - The [Exploit Guard Attack Surface Reduction (ASR) USB rule](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard) to block untrusted and unsigned processes that run from USB. - - [Direct Memory Access (DMA) protection settings](#protect-against-direct-memory-access-dma-attacks) to mitigate DMA attacks, including [Kernel DMA Protection for Thunderbolt](https://docs.microsoft.com/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and blocking DMA until a user signs in. - -2. [Detect plug and play connected events for peripherals in Windows Defender ATP advanced hunting](#detect-plug-and-play-connected-events) - - Identify or investigate suspicious usage activity. Create customized alerts based on these PnP events or any other Windows Defender ATP events with [custom detection rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/custom-detection-rules). +1. [Prevent threats from removable storage](#prevent-threats-from-removable-storage) introduced by removable storage devices by enabling: + - [Windows Defender Antivirus real-time protection (RTP)](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus) to scan removable storage for malware. + - The [Attack Surface Reduction (ASR) USB rule](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard) to block untrusted and unsigned processes that run from USB. + - [Direct Memory Access (DMA) protection settings](#protect-against-direct-memory-access-dma-attacks) to mitigate DMA attacks, including [Kernel DMA Protection for Thunderbolt](https://docs.microsoft.com/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) and blocking DMA until a user signs in. + +2. [Detect plug and play connected events for peripherals in Microsoft Defender ATP advanced hunting](#detect-plug-and-play-connected-events) + - Identify or investigate suspicious usage activity. Create customized alerts based on these PnP events or any other Microsoft Defender ATP events with [custom detection rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/custom-detection-rules). 3. [Respond to threats](#respond-to-threats) from peripherals in real-time based on properties reported by each peripheral: - - Granular configuration to deny write access to removable disks and approve or deny devices by USB vendor code, product code, device IDs, or a combination. - - Flexible policy assignment of device installation settings based on an individual or group of Azure Active Directory (Azure AD) users and devices. - -![Create device configuration profile] -These threat reduction measures help prevent malware from coming into your environment. To protect enterprise data from leaving your environment, you can also configure data loss prevention measures. For example, on Windows 10 devices you can configure [BitLocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) and [Windows Information Protection](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure), which will encrypt company data even if it is stored on a personal device, or use the [Storage/RemovableDiskDenyWriteAccess CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-storage#storage-removablediskdenywriteaccess) to deny write access to removable disks. Additionally, you can [classify and protect files on Windows devices](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview) (including their mounted USB devices) by using Windows Defender ATP and Azure Information Protection. + - Granular configuration to deny write access to removable disks and approve or deny devices by USB vendor code, product code, device IDs, or a combination. + - Flexible policy assignment of device installation settings based on an individual or group of Azure Active Directory (Azure AD) users and devices. +>[!Note] +>These threat reduction measures help prevent malware from coming into your environment. To protect enterprise data from leaving your environment, you can also configure data loss prevention measures. For example, on Windows 10 devices you can configure [BitLocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) and [Windows Information Protection](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure), which will encrypt company data even if it is stored on a personal device, or use the [Storage/RemovableDiskDenyWriteAccess CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-storage#storage-removablediskdenywriteaccess) to deny write access to removable disks. Additionally, you can [classify and protect files on Windows devices](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview) (including their mounted USB devices) by using Microsoft Defender ATP and Azure Information Protection. ## Prevent threats from removable storage -Windows Defender ATP can help identify and block malicious files on allowed removable storage peripherals. +Removable storage devices can introduce additional security risk to your organization. Microsoft Defender ATP can help identify and block malicious files on removable storage devices. -### Enable Windows Defender Antivirus Scanning +Microsoft Defender ATP can also prevent USB peripherals from being used on devices to help prevent external threats. It does this by using the properties reported by USB peripherals to determine whether or not they can be installed and used on the device. -Protecting authorized removable storage with Windows Defender Antivirus requires [enabling real-time protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus) or scheduling scans and configuring removable drives for scans. +Note that if you block USB devices or any other device classes using the device installation policies, connected devices, such as phones, can still charge. + +>[!NOTE] +>Always test and refine these settings with a pilot group of users and devices first before widely distributing to your organization. + +The following table describes the ways Microsoft Defender ATP can help prevent installation and usage of USB peripherals. + +For more information about controlling USB devices, see the [Microsoft Defender ATP blog](https://aka.ms/devicecontrolblog). + +| Control | Description | +|----------|-------------| +| [Block installation and usage of removable storage](#block-installation-and-usage-of-removable-storage) | Users can't install or use removable storage | +| [Only allow installation and usage of specifically approved peripherals](#only-allow-installation-and-usage-of-specifically-approved-peripherals) | Users can only install and use approved peripherals that report specific properties in their firmware | +| [Prevent installation of specifically prohibited peripherals](#prevent-installation-of-specifically-prohibited-peripherals) | Users can't install or use prohibited peripherals that report specific properties in their firmware | + +>[!NOTE] +>Because an unauthorized USB peripheral can have firmware that spoofs its USB properties, we recommend only allowing specifically approved USB peripherals and limiting the users who can access them. + +### Enable Windows Defender Antivirus Scanning + +Protecting authorized removable storage with Windows Defender Antivirus requires [enabling real-time protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus) or scheduling scans and configuring removable drives for scans. - If real-time protection is enabled, files are scanned before they are accessed and executed. The scanning scope includes all files, including those on mounted removable devices such as USB drives. You can optionally [run a PowerShell script to perform a custom scan](https://aka.ms/scanusb) of a USB drive after it is mounted, so that Windows Defender Antivirus starts scanning all files on a removable device once the removable device is attached. However, we recommend enabling real-time protection for improved scanning performance, especially for large storage devices. - If scheduled scans are used, then you need to disable the DisableRemovableDriveScanning setting (enabled by default) to scan the removable device during a full scan. Removable devices are scanned during a quick or custom scan regardless of the DisableRemovableDriveScanning setting. @@ -50,37 +69,37 @@ Protecting authorized removable storage with Windows Defender Antivirus requires >[!NOTE] >We recommend enabling real-time monitoring for scanning. In Intune, you can enable real-time monitoring for Windows 10 in **Device Restrictions** > **Configure** > **Windows Defender Antivirus** > **Real-time monitoring**. - ### Block untrusted and unsigned processes on USB peripherals -End-users might plug in removable devices that are infected with malware. -To prevent infections, a company can block USB files that are unsigned or untrusted. -Alternatively, companies can leverage the audit feature of attack surface reduction rules to monitor the activity of untrusted and unsigned processes that execute on a USB peripheral. -This can be done by setting **Untrusted and unsigned processes that run from USB** to either **Block** or **Audit only**, respectively. -With this rule, admins can prevent or audit unsigned or untrusted executable files from running from USB removable drives, including SD cards. +End-users might plug in removable devices that are infected with malware. +To prevent infections, a company can block USB files that are unsigned or untrusted. +Alternatively, companies can leverage the audit feature of attack surface reduction rules to monitor the activity of untrusted and unsigned processes that execute on a USB peripheral. +This can be done by setting **Untrusted and unsigned processes that run from USB** to either **Block** or **Audit only**, respectively. +With this rule, admins can prevent or audit unsigned or untrusted executable files from running from USB removable drives, including SD cards. Affected file types include executable files (such as .exe, .dll, or .scr) and script files such as a PowerShell (.ps), VisualBasic (.vbs), or JavaScript (.js) files. -These settings require [enabling real-time protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus). +These settings require [enabling real-time protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus). 1. Sign in to the [Microsoft Azure portal](https://portal.azure.com/). -2. Click **Intune** > **Device configuration** > **Profiles** > **Create profile**. +2. Click **Intune** > **Device configuration** > **Profiles** > **Create profile**. ![Create device configuration profile](images/create-device-configuration-profile.png) 3. Use the following settings: - - Name: Type a name for the profile - - Description: Type a description - - Platform: Windows 10 or later - - Profile type: Endpoint protection + - Name: Type a name for the profile + - Description: Type a description + - Platform: Windows 10 or later + - Profile type: Endpoint protection ![Create endpoint protection profile](images/create-endpoint-protection-profile.png) -4. Click **Configure** > **Windows Defender Exploit Guard** > **Attack Surface Reduction**. +4. Click **Configure** > **Windows Defender Exploit Guard** > **Attack Surface Reduction**. -5. For **Unsigned and untrusted processes that run from USB**, choose **Block**. +5. For **Unsigned and untrusted processes that run from USB**, choose **Block**. ![Block untrusted processes](images/block-untrusted-processes.png) @@ -92,13 +111,13 @@ These settings require [enabling real-time protection](https://docs.microsoft.co DMA attacks can lead to disclosure of sensitive information residing on a PC, or even injection of malware that allows attackers to bypass the lock screen or control PCs remotely. The following settings help to prevent DMA attacks: -1. Beginning with Windows 10 version 1803, Microsoft introduced [Kernel DMA Protection for Thunderbolt](https://docs.microsoft.com/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) to provide native protection against DMA attacks via Thunderbolt ports. Kernel DMA Protection for Thunderbolt is enabled by system manufacturers and cannot be turned on or off by users. +1. Beginning with Windows 10 version 1803, Microsoft introduced [Kernel DMA Protection for Thunderbolt](https://docs.microsoft.com/windows/security/information-protection/kernel-dma-protection-for-thunderbolt) to provide native protection against DMA attacks via Thunderbolt ports. Kernel DMA Protection for Thunderbolt is enabled by system manufacturers and cannot be turned on or off by users. Beginning with Windows 10 version 1809, you can adjust the level of Kernel DMA Protection by configuring the [DMA Guard CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-dmaguard#dmaguard-deviceenumerationpolicy). This is an additional control for peripherals that don't support device memory isolation (also known as DMA-remapping). Memory isolation allows the OS to leverage the I/O Memory Management Unit (IOMMU) of a device to block unallowed I/O, or memory access, by the peripheral (memory sandboxing). In other words, the OS assigns a certain memory range to the peripheral. If the peripheral attempts to read/write to memory outside of the assigned range, the OS blocks it. - - Peripherals that support device memory isolation can always connect. Peripherals that don't can be blocked, allowed, or allowed only after the user signs in (default). -2. On Windows 10 systems that do not suppprt Kernel DMA Protection, you can: + Peripherals that support device memory isolation can always connect. Peripherals that don't can be blocked, allowed, or allowed only after the user signs in (default). + +2. On Windows 10 systems that do not support Kernel DMA Protection, you can: - [Block DMA until a user signs in](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-dataprotection#dataprotection-allowdirectmemoryaccess) - [Block all connections via the Thunderbolt ports (including USB devices)](https://support.microsoft.com/help/2516445/blocking-the-sbp-2-driver-and-thunderbolt-controllers-to-reduce-1394-d) @@ -107,107 +126,77 @@ DMA attacks can lead to disclosure of sensitive information residing on a PC, or To prevent malware infections or data loss, an organization may restrict USB drives and other peripherals. The following table describes the ways Microsoft Defender Advanced Threat Protection can help prevent installation and usage of USB drives and other peripherals. -| Control | Description | -|----------|-------------| -| Allow installation and usage of USB drives and other peripherals | Allow users to install only the USB drives and other peripherals included on a list of authorized devices or device types | -| Prevent installation and usage of USB drives and other peripherals| Prevent users from installing USB drives and other peripherals included on a list of unauthorized devices and device types | + Control | Description +-|- + Allow installation and usage of USB drives and other peripherals | Allow users to install only the USB drives and other peripherals included on a list of authorized devices or device types + Prevent installation and usage of USB drives and other peripherals | Prevent users from installing USB drives and other peripherals included on a list of unauthorized devices and device types -All of the above controls can be set through the Intune [Administrative Templates](https://docs.microsoft.com/en-us/intune/administrative-templates-windows). The relevant policies are located here in the Intune Administrator Templates: +All of the above controls can be set through the Intune [Administrative Templates](https://docs.microsoft.com/intune/administrative-templates-windows). The relevant policies are located here in the Intune Administrator Templates: -![Admintemplates](images/admintemplates.png) +![AdminTemplates](images/admintemplates.png) >[!Note] >Using Intune, you can apply device configuration policies to AAD user and/or device groups. -The above policies can also be set through the [Device Installation CSP settings](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceinstallation) and the [Device Installation GPOs](https://docs.microsoft.com/en-us/previous-versions/dotnet/articles/bb530324(v=msdn.10)). +The above policies can also be set through the [Device Installation CSP settings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation) and the [Device Installation GPOs](https://docs.microsoft.com/previous-versions/dotnet/articles/bb530324(v=msdn.10)). ->[!Note] ->Always test and refine these settings with a pilot group of users and devices first before applying them in production. -For more information about controlling USB devices, see the [Microsoft Secure blog "WDATP has protections for USB and removable devices"](https://www.microsoft.com/security/blog/2018/12/19/windows-defender-atp-has-protections-for-usb-and-removable-devices/). +> [!Note] +> Always test and refine these settings with a pilot group of users and devices first before applying them in production. +For more information about controlling USB devices, see the [Microsoft Defender ATP blog](https://www.microsoft.com/security/blog/2018/12/19/windows-defender-atp-has-protections-for-usb-and-removable-devices/). ### Allow installation and usage of USB drives and other peripherals -One way to approach allowing installation and usage of USB drives and other peripherals is to start by allowing everything. Afterwards, you can start reducing the allowable USB drivers and other peripherals. +One way to approach allowing installation and usage of USB drives and other peripherals is to start by allowing everything. Afterwards, you can start reducing the allowable USB drivers and other peripherals. >[!Note] >Because an unauthorized USB peripheral can have firmware that spoofs its USB properties, we recommend only allowing specifically approved USB peripherals and limiting the users who can access them. ->1. Enable **prevent installation of devices not described by other policy settings** to all users. ->2. Enable **allow installation of devices using drivers that match these device setup classes** for all [device setup classes](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/system-defined-device-setup-classes-available-to-vendors). +> +>1. Enable **prevent installation of devices not described by other policy settings** to all users. +>2. Enable **allow installation of devices using drivers that match these device setup classes** for all [device setup classes](https://docs.microsoft.com/windows-hardware/drivers/install/system-defined-device-setup-classes-available-to-vendors). To enforce the policy for already installed devices, apply the prevent policies that have this setting. +When configuring the allow device installation policy, you will need to allow all parent attributes as well. You can view the parents of a device by opening device manager and view by connection. + +![Device by Connection](images/devicesbyconnection.png) + +In this example, the following classes needed to be added: HID, Keyboard, and {36fc9e60-c465-11cf-8056-444553540000}. More information on [Microsoft-provided USB drivers](https://docs.microsoft.com/windows-hardware/drivers/usbcon/supported-usb-classes). + +![Device host controller](images/devicehostcontroller.jpg) + If you want to restrict to certain devices, remove the device setup class of the peripheral that you want to limit. Then add the device id that you want to add. For example, -1. Remove class USBDevice from the **allow installation of devices using drivers that match these device setup** -2. Add the VID/PID to allow in the **allow installation of device that match any of these device IDs** +1. Remove class USBDevice from the **allow installation of devices using drivers that match these device setup** +2. Add the VID/PID to allow in the **allow installation of device that match any of these device IDs** ->[!Note] ->How to locate the VID/PID: Using Device Manager; right click on the device and select properties. Click details tab, click property drop down list, and choose hardware Ids. Right click the top ID value and select copy. +> [!Note] +> How to locate the VID/PID: Using Device Manager; right click on the device and select properties. Click details tab, click property drop down list, and choose hardware Ids. Right click the top ID value and select copy. >Using PowerShell: Get-WMIObject -Class Win32_DiskDrive | Select-Object -Property * ->For the typical format for the USB ID please reference the following link; (https://docs.microsoft.com/en-us/windows-hardware/drivers/install/standard-usb-identifiers) +>For the typical format for the USB ID please reference the following link; (https://docs.microsoft.com/windows-hardware/drivers/install/standard-usb-identifiers) ### Prevent installation and usage of USB drives and other peripherals -If you want to prevent a device class or certain devices, you can use the prevent device installation policies. -1. Enable **Prevent installation of devices that match any of these device IDs**. -2. Enable the **Prevent installation of devices that match these device setup classes policy**. +If you want to prevent a device class or certain devices, you can use the prevent device installation policies. ->[!Note] ->The prevent device installation policies take precedence over the allow device installation policies. +1. Enable **Prevent installation of devices that match any of these device IDs**. +2. Enable the **Prevent installation of devices that match these device setup classes policy**. -### Security Baseline - -The Microsoft Defender Advanced Threat Protection (ATP) baseline settings, represent the recommended configuration for ATP. Configuration settings for baseline are located here in the edit profile page of the configuration settings. - -![Baselines](images/baselines.png) - -### Bluetooth - -Using Intune, you can limited the services that can use Bluetooth through the “Bluetooth allowed services”. The default state of “Bluetooth allowed services” settings means everything is allowed. As soon as a service is added, that becomes the allowed list. If the customer adds the Keyboards and Mice values, and don’t add the file transfer GUIDs, file transfer should be blocked. - -![Bluetooth](images/bluetooth.png) - - - - -## Detect plug and play connected events - -You can view plug and play connected events in Windows Defender ATP advanced hunting to identify suspicious usage activity or perform internal investigations. -For examples of Windows Defender ATP advanced hunting queries, see the [Windows Defender ATP hunting queries GitHub repo](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). -Based on any Windows Defender ATP event, including the plug and play events, you can create custom alerts using the Windows Defender ATP [custom detection rule feature](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/custom-detection-rules). - -## Respond to threats - -Windows Defender ATP can prevent USB peripherals from being used on devices to help prevent external threats. It does this by using the properties reported by USB peripherals to determine whether or not they can be installed and used on the device. - ->[!NOTE] ->Always test and refine these settings with a pilot group of users and devices first before applying them in production. - -The following table describes the ways Windows Defender ATP can help prevent installation and usage of USB peripherals. -For more information about controlling USB devices, see the [Microsoft Secure blog "WDATP has protections for USB and removable devices"](https://aka.ms/devicecontrolblog). - -| Control | Description | -|----------|-------------| -| [Block installation and usage of removable storage](#block-installation-and-usage-of-removable-storage) | Users can't install or use removable storage | -| [Only allow installation and usage of specifically approved peripherals](#only-allow-installation-and-usage-of-specifically-approved-peripherals) | Users can only install and use approved peripherals that report specific properties in their firmware | -| [Prevent installation of specifically prohibited peripherals](#prevent-installation-of-specifically-prohibited-peripherals) | Users can't install or use prohibited peripherals that report specific properties in their firmware | - ->[!NOTE] ->Because an unauthorized USB peripheral can have firmware that spoofs its USB properties, we recommend only allowing specifically approved USB peripherals and limiting the users who can access them. +> [!Note] +> The prevent device installation policies take precedence over the allow device installation policies. ### Block installation and usage of removable storage 1. Sign in to the [Microsoft Azure portal](https://portal.azure.com/). -2. Click **Intune** > **Device configuration** > **Profiles** > **Create profile**. +2. Click **Intune** > **Device configuration** > **Profiles** > **Create profile**. ![Create device configuration profile](images/create-device-configuration-profile.png) -3. Use the following settings: +3. Use the following settings: - - Name: Type a name for the profile - - Description: Type a description - - Platform: Windows 10 and later - - Profile type: Device restrictions + - Name: Type a name for the profile + - Description: Type a description + - Platform: Windows 10 and later + - Profile type: Device restrictions ![Create profile](images/create-profile.png) @@ -230,11 +219,53 @@ Allowing installation of specific devices requires also enabling [DeviceInstalla ### Prevent installation of specifically prohibited peripherals -Windows Defender ATP blocks installation and usage of prohibited peripherals by using either of these options: +Microsoft Defender ATP blocks installation and usage of prohibited peripherals by using either of these options: - [Administrative Templates](https://docs.microsoft.com/intune/administrative-templates-windows) can block any device with a matching hardware ID or setup class. - [Device Installation CSP settings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation) with a custom profile in Intune. You can [prevent installation of specific device IDs](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdeviceids) or [prevent specific device classes](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventinstallationofmatchingdevicesetupclasses). +### Security Baseline + +The Microsoft Defender Advanced Threat Protection (ATP) baseline settings, represent the recommended configuration for ATP. Configuration settings for baseline are located here in the edit profile page of the configuration settings. + +![Baselines](images/baselines.png) + +### Bluetooth + +Using Intune, you can limited the services that can use Bluetooth through the “Bluetooth allowed services”. The default state of “Bluetooth allowed services” settings means everything is allowed. As soon as a service is added, that becomes the allowed list. If the customer adds the Keyboards and Mice values, and don’t add the file transfer GUIDs, file transfer should be blocked. + +![Bluetooth](images/bluetooth.png) + +## Respond to threats + +You can create custom alerts and automatic response actions with the [Microsoft Defender ATP Custom Detection Rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules). Response actions within the custom detection cover both machine and file level actions. You can also create alerts and automatic response actions using [PowerApps](https://powerapps.microsoft.com/) and [Flow](https://flow.microsoft.com/) with the [Microsoft Defender ATP connector](https://docs.microsoft.com/connectors/wdatp/). The connector supports actions for investigation, threat scanning, and restricting running applications. It is one of over 200 pre-defined connectors including Outlook, Teams, Slack, and more. Custom connectors can also be built. See [Connectors](https://docs.microsoft.com/connectors/) to learn more about connectors. + +For example, using either approach, you can automatically have the Microsoft Defender Antivirus run when a USB device is mounted onto a machine. + +## Detect plug and play connected events + +You can view plug and play connected events in Microsoft Defender ATP advanced hunting to identify suspicious usage activity or perform internal investigations. +For examples of Microsoft Defender ATP advanced hunting queries, see the [Microsoft Defender ATP hunting queries GitHub repo](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). + +Sample Power BI report templates are available for Microsoft Defender ATP that you can use for Advanced hunting queries. With these sample templates, including one for device control, you can integrate the power of Advanced hunting into Power BI. See the [GitHub repository for PowerBI templates](https://github.com/microsoft/MDATP-PowerBI-Templates) for more information. See [Create custom reports using Power BI](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-power-bi) to learn more about Power BI integration. + +### Custom Alerts and Response Actions + +You can create custom alerts and response actions with the WDATP Connector and the Custom Detection Rules: + +**Wdatp Connector response Actions:** + +**Investigate:** Initiate investigations, collect investigation package, and isolate a machine. + +**Threat Scanning** on USB devices + +**Restrict execution of all applications** on the machine except a predefined set +MDATP connector is one of over 200 pre-defined connectors including Outlook, Teams, Slack, etc. Custom connectors can be built. +- [More information on WDATP Connector Response Actions](https://docs.microsoft.com/connectors/wdatp/) + +**Custom Detection Rules Response Action:** +Both machine and file level actions can be applied. +- [More information on Custom Detection Rules Response Actions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules) ## Related topics @@ -242,8 +273,6 @@ Windows Defender ATP blocks installation and usage of prohibited peripherals by - [Defender/AllowFullScanRemovableDriveScanning](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-allowfullscanremovabledrivescanning) - [Policy/DeviceInstallation CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation) - [Perform a custom scan of a removable device](https://aka.ms/scanusb) +- [Device Control PowerBI Template for custom reporting](https://github.com/microsoft/MDATP-PowerBI-Templates) - [BitLocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) - [Windows Information Protection](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure) - - - diff --git a/windows/security/threat-protection/device-control/images/devicehostcontroller.jpg b/windows/security/threat-protection/device-control/images/devicehostcontroller.jpg new file mode 100644 index 0000000000..fd0666ef4c Binary files /dev/null and b/windows/security/threat-protection/device-control/images/devicehostcontroller.jpg differ diff --git a/windows/security/threat-protection/device-control/images/devicesbyconnection.png b/windows/security/threat-protection/device-control/images/devicesbyconnection.png new file mode 100644 index 0000000000..089a1b70fe Binary files /dev/null and b/windows/security/threat-protection/device-control/images/devicesbyconnection.png differ diff --git a/windows/security/threat-protection/device-control/images/devicevendorid.jpg b/windows/security/threat-protection/device-control/images/devicevendorid.jpg new file mode 100644 index 0000000000..10b636fc0d Binary files /dev/null and b/windows/security/threat-protection/device-control/images/devicevendorid.jpg differ diff --git a/windows/security/threat-protection/device-control/images/sortbyconnection.jpg b/windows/security/threat-protection/device-control/images/sortbyconnection.jpg new file mode 100644 index 0000000000..c86eab1470 Binary files /dev/null and b/windows/security/threat-protection/device-control/images/sortbyconnection.jpg differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md similarity index 77% rename from windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md rename to windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index 0f4d7ee1dc..1edd7842a6 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -14,16 +14,16 @@ ms.date: 04/01/2019 ms.reviewer: --- -# Enable virtualization-based protection of code integrity +# Enable virtualization-based protection of code integrity **Applies to** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -This topic covers different ways to enable Hypervisor-protected code integrity (HVCI) on Windows 10. -Some applications, including device drivers, may be incompatible with HVCI. -This can cause devices or software to malfunction and in rare cases may result in a blue screen. Such issues may occur after HVCI has been turned on or during the enablement process itself. -If this happens, see [Troubleshooting](#troubleshooting) for remediation steps. +This topic covers different ways to enable Hypervisor-protected code integrity (HVCI) on Windows 10. +Some applications, including device drivers, may be incompatible with HVCI. +This can cause devices or software to malfunction and in rare cases may result in a blue screen. Such issues may occur after HVCI has been turned on or during the enablement process itself. +If this happens, see [Troubleshooting](#troubleshooting) for remediation steps. >[!NOTE] >HVCI works with modern 7th gen CPUs or higher and its equivalent on AMD. CPU new feature is required *Mode based execution control (MBE) Virtualization*. AMD CPUs do not have MBE. @@ -37,13 +37,13 @@ If this happens, see [Troubleshooting](#troubleshooting) for remediation steps. * HVCI also ensure your other Truslets, like Credential Guard have a valid certificate. * Modern device drivers must also have an EV (Extended Validation) certificate and should support HVCI. -## How to turn on HVCI in Windows 10 +## How to turn on HVCI in Windows 10 To enable HVCI on Windows 10 devices with supporting hardware throughout an enterprise, use any of these options: - [Windows Security app](#windows-security-app) - [Microsoft Intune (or another MDM provider)](#enable-hvci-using-intune) - [Group Policy](#enable-hvci-using-group-policy) -- [System Center Configuration Manager](https://cloudblogs.microsoft.com/enterprisemobility/2015/10/30/managing-windows-10-device-guard-with-configuration-manager/) +- [System Center Configuration Manager](https://cloudblogs.microsoft.com/enterprisemobility/2015/10/30/managing-windows-10-device-guard-with-configuration-manager/) - [Registry](#use-registry-keys-to-enable-virtualization-based-protection-of-code-integrity) ### Windows Security app @@ -52,7 +52,7 @@ HVCI is labeled **Memory integrity** in the Windows Security app and it can be a ### Enable HVCI using Intune -Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp). +Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp). ### Enable HVCI using Group Policy @@ -61,11 +61,11 @@ Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP] 3. Double-click **Turn on Virtualization Based Security**. 4. Click **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled with UEFI lock** to ensure HVCI cannot be disabled remotely or select **Enabled without UEFI lock**. - ![Enable HVCI using Group Policy](images/enable-hvci-gp.png) + ![Enable HVCI using Group Policy](../images/enable-hvci-gp.png) 5. Click **Ok** to close the editor. -To apply the new policy on a domain-joined computer, either restart or run `gpupdate /force` in an elevated command prompt. +To apply the new policy on a domain-joined computer, either restart or run `gpupdate /force` in an elevated command prompt. ### Use registry keys to enable virtualization-based protection of code integrity @@ -183,66 +183,66 @@ Windows 10 and Windows Server 2016 have a WMI class for related properties and f > The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10. > [!NOTE] -> Mode Based Execution Control property will only be listed as available starting with Windows 10 version 1709. +> Mode Based Execution Control property will only be listed as available starting with Windows 10 version 1803. -The output of this command provides details of the available hardware-based security features as well as those features that are currently enabled. +The output of this command provides details of the available hardware-based security features as well as those features that are currently enabled. #### AvailableSecurityProperties This field helps to enumerate and report state on the relevant security properties for Windows Defender Device Guard. -| Value | Description | -|--------|-------------| -| **0.** | If present, no relevant properties exist on the device. | -| **1.** | If present, hypervisor support is available. | -| **2.** | If present, Secure Boot is available. | -| **3.** | If present, DMA protection is available. | -| **4.** | If present, Secure Memory Overwrite is available. | -| **5.** | If present, NX protections are available. | -| **6.** | If present, SMM mitigations are available. | -| **7.** | If present, Mode Based Execution Control is available. | +Value | Description +-|- +**0.** | If present, no relevant properties exist on the device. +**1.** | If present, hypervisor support is available. +**2.** | If present, Secure Boot is available. +**3.** | If present, DMA protection is available. +**4.** | If present, Secure Memory Overwrite is available. +**5.** | If present, NX protections are available. +**6.** | If present, SMM mitigations are available. +**7.** | If present, Mode Based Execution Control is available. #### InstanceIdentifier -A string that is unique to a particular device. Valid values are determined by WMI. +A string that is unique to a particular device. Valid values are determined by WMI. #### RequiredSecurityProperties This field describes the required security properties to enable virtualization-based security. -| Value | Description | -|--------|-------------| -| **0.** | Nothing is required. | -| **1.** | If present, hypervisor support is needed. | -| **2.** | If present, Secure Boot is needed. | -| **3.** | If present, DMA protection is needed. | -| **4.** | If present, Secure Memory Overwrite is needed. | -| **5.** | If present, NX protections are needed. | -| **6.** | If present, SMM mitigations are needed. | -| **7.** | If present, Mode Based Execution Control is needed. | +Value | Description +-|- +**0.** | Nothing is required. +**1.** | If present, hypervisor support is needed. +**2.** | If present, Secure Boot is needed. +**3.** | If present, DMA protection is needed. +**4.** | If present, Secure Memory Overwrite is needed. +**5.** | If present, NX protections are needed. +**6.** | If present, SMM mitigations are needed. +**7.** | If present, Mode Based Execution Control is needed. -#### SecurityServicesConfigured +#### SecurityServicesConfigured This field indicates whether the Windows Defender Credential Guard or HVCI service has been configured. -| Value | Description | -|--------|-------------| -| **0.** | No services configured. | -| **1.** | If present, Windows Defender Credential Guard is configured. | -| **2.** | If present, HVCI is configured. | -| **3.** | If present, System Guard Secure Launch is configured. | +Value | Description +-|- +**0.** | No services configured. +**1.** | If present, Windows Defender Credential Guard is configured. +**2.** | If present, HVCI is configured. +**3.** | If present, System Guard Secure Launch is configured. #### SecurityServicesRunning This field indicates whether the Windows Defender Credential Guard or HVCI service is running. -| Value | Description | -|--------|-------------| -| **0.** | No services running. | -| **1.** | If present, Windows Defender Credential Guard is running. | -| **2.** | If present, HVCI is running. | -| **3.** | If present, System Guard Secure Launch is running. | +Value | Description +-|- +**0.** | No services running. +**1.** | If present, Windows Defender Credential Guard is running. +**2.** | If present, HVCI is running. +**3.** | If present, System Guard Secure Launch is running. #### Version @@ -252,12 +252,11 @@ This field lists the version of this WMI class. The only valid value now is **1. This field indicates whether VBS is enabled and running. -| Value | Description | -|--------|-------------| -| **0.** | VBS is not enabled. | -| **1.** | VBS is enabled but not running. | -| **2.** | VBS is enabled and running. | - +Value | Description +-|- +**0.** | VBS is not enabled. +**1.** | VBS is enabled but not running. +**2.** | VBS is enabled and running. #### PSComputerName @@ -265,8 +264,7 @@ This field lists the computer name. All valid values for computer name. Another method to determine the available and enabled Windows Defender Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Windows Defender Device Guard properties are displayed at the bottom of the **System Summary** section. -![Windows Defender Device Guard properties in the System Summary](images/dg-fig11-dgproperties.png) - +![Windows Defender Device Guard properties in the System Summary](../images/dg-fig11-dgproperties.png) ## Troubleshooting @@ -276,9 +274,12 @@ B. If you experience software or device malfunction after using the above proced C. If you experience a critical error during boot or your system is unstable after using the above procedure to turn on HVCI, you can recover using the Windows Recovery Environment (Windows RE). To boot to Windows RE, see [Windows RE Technical Reference](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference). After logging in to Windows RE, you can turn off HVCI by renaming or deleting the SIPolicy.p7b file from the file location in step 3 above and then restart your device. -## How to turn off HVCI on the Windows 10 Fall Creators Update +## How to turn off HVCI -1. Rename or delete the SIPolicy.p7b file located at C:\Windows\System32\CodeIntegrity. +1. Run the following command from an elevated prompt to set the HVCI registry key to off +```ini +reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f +``` 2. Restart the device. 3. To confirm HVCI has been successfully disabled, open System Information and check **Virtualization-based security Services Running**, which should now have no value displayed. @@ -293,8 +294,8 @@ Set-VMSecurity -VMName -VirtualizationBasedSecurityOptOut $true ``` ### Requirements for running HVCI in Hyper-V virtual machines - - The Hyper-V host must run at least Windows Server 2016 or Windows 10 version 1607. - - The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10. - - HVCI and [nested virtualization](https://docs.microsoft.com/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time - - Virtual Fibre Channel adapters are not compatible with HVCI. Before attaching a virtual Fibre Channel Adapter to a virtual machine, you must first opt out of virtualization-based security using `Set-VMSecurity`. - - The AllowFullSCSICommandSet option for pass-through disks is not compatible with HVCI. Before configuring a pass-through disk with AllowFullSCSICommandSet, you must first opt out of virtualization-based security using `Set-VMSecurity`. +- The Hyper-V host must run at least Windows Server 2016 or Windows 10 version 1607. +- The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10. +- HVCI and [nested virtualization](https://docs.microsoft.com/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time +- Virtual Fibre Channel adapters are not compatible with HVCI. Before attaching a virtual Fibre Channel Adapter to a virtual machine, you must first opt out of virtualization-based security using `Set-VMSecurity`. +- The AllowFullSCSICommandSet option for pass-through disks is not compatible with HVCI. Before configuring a pass-through disk with AllowFullSCSICommandSet, you must first opt out of virtualization-based security using `Set-VMSecurity`. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md b/windows/security/threat-protection/device-guard/memory-integrity.md similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md rename to windows/security/threat-protection/device-guard/memory-integrity.md diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md rename to windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md diff --git a/windows/security/threat-protection/fips-140-validation.md b/windows/security/threat-protection/fips-140-validation.md index ac3e78109d..a1ad5ab37c 100644 --- a/windows/security/threat-protection/fips-140-validation.md +++ b/windows/security/threat-protection/fips-140-validation.md @@ -4,7 +4,7 @@ description: This topic provides information on how Microsoft products and crypt ms.prod: w10 audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -18,14 +18,14 @@ ms.reviewer: On this page - - [Introduction](https://technet.microsoft.com/library/cc750357.aspx#id0eo) - - [FIPS 140 Overview](https://technet.microsoft.com/library/cc750357.aspx#id0ebd) - - [Microsoft Product Validation (Information for Procurement Officers and Auditors)](https://technet.microsoft.com/library/cc750357.aspx#id0ezd) - - [Information for System Integrators](https://technet.microsoft.com/library/cc750357.aspx#id0eve) - - [Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#id0eibac) - - [FIPS 140 FAQ](https://technet.microsoft.com/library/cc750357.aspx#id0eqcac) - - [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#id0ewfac) - - [Cryptographic Algorithms](https://technet.microsoft.com/library/cc750357.aspx#id0erobg) +- [Introduction](https://technet.microsoft.com/library/cc750357.aspx#id0eo) +- [FIPS 140 Overview](https://technet.microsoft.com/library/cc750357.aspx#id0ebd) +- [Microsoft Product Validation (Information for Procurement Officers and Auditors)](https://technet.microsoft.com/library/cc750357.aspx#id0ezd) +- [Information for System Integrators](https://technet.microsoft.com/library/cc750357.aspx#id0eve) +- [Information for Software Developers](https://technet.microsoft.com/library/cc750357.aspx#id0eibac) +- [FIPS 140 FAQ](https://technet.microsoft.com/library/cc750357.aspx#id0eqcac) +- [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/library/cc750357.aspx#id0ewfac) +- [Cryptographic Algorithms](https://technet.microsoft.com/library/cc750357.aspx#id0erobg) Updated: March 2018 @@ -103,12 +103,12 @@ Rather than validate individual components and products, Microsoft chooses to va The following list contains some of the Windows components and Microsoft products that rely on FIPS 140 validated cryptographic modules: - - Schannel Security Package - - Remote Desktop Protocol (RDP) Client - - Encrypting File System (EFS) - - Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.) - - BitLocker® Drive Full-volume Encryption - - IPsec Settings of Windows Firewall +- Schannel Security Package +- Remote Desktop Protocol (RDP) Client +- Encrypting File System (EFS) +- Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.) +- BitLocker® Drive Full-volume Encryption +- IPsec Settings of Windows Firewall ## Information for System Integrators @@ -145,12 +145,12 @@ While there are alternative methods for setting the FIPS local/group security po The following list details some of the Microsoft components that use the cryptographic functionality implemented by either CNG or legacy CAPI. When the FIPS Local/Group Security Policy is set, the following components will enforce the validated module Security Policy. - - Schannel Security Package - - Remote Desktop Protocol (RDP) Client - - Encrypting File System (EFS) - - Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.) - - BitLocker® Drive Full-volume Encryption - - IPsec Settings of Windows Firewall +- Schannel Security Package +- Remote Desktop Protocol (RDP) Client +- Encrypting File System (EFS) +- Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.) +- BitLocker® Drive Full-volume Encryption +- IPsec Settings of Windows Firewall #### Effects of Setting FIPS Local/Group Security Policy Flag diff --git a/windows/security/threat-protection/get-support-for-security-baselines.md b/windows/security/threat-protection/get-support-for-security-baselines.md index 2c5d379949..c3cdc07f58 100644 --- a/windows/security/threat-protection/get-support-for-security-baselines.md +++ b/windows/security/threat-protection/get-support-for-security-baselines.md @@ -5,7 +5,7 @@ keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium -ms.author: dolmont +ms.author: dansimp author: dulcemontemayor manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/images/TVM_icon.png b/windows/security/threat-protection/images/TVM_icon.png index 41faa16718..63f8c75929 100644 Binary files a/windows/security/threat-protection/images/TVM_icon.png and b/windows/security/threat-protection/images/TVM_icon.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/Untitled-1.png b/windows/security/threat-protection/images/Untitled-1.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/Untitled-1.png rename to windows/security/threat-protection/images/Untitled-1.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/asr-notif.png b/windows/security/threat-protection/images/asr-notif.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/asr-notif.png rename to windows/security/threat-protection/images/asr-notif.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/asr-rules-gp.png b/windows/security/threat-protection/images/asr-rules-gp.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/asr-rules-gp.png rename to windows/security/threat-protection/images/asr-rules-gp.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/asr-test-tool.png b/windows/security/threat-protection/images/asr-test-tool.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/asr-test-tool.png rename to windows/security/threat-protection/images/asr-test-tool.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-allow-app-ps.png b/windows/security/threat-protection/images/cfa-allow-app-ps.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-allow-app-ps.png rename to windows/security/threat-protection/images/cfa-allow-app-ps.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-allow-app.png b/windows/security/threat-protection/images/cfa-allow-app.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-allow-app.png rename to windows/security/threat-protection/images/cfa-allow-app.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-allow-folder-ps.png b/windows/security/threat-protection/images/cfa-allow-folder-ps.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-allow-folder-ps.png rename to windows/security/threat-protection/images/cfa-allow-folder-ps.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-audit-gp.png b/windows/security/threat-protection/images/cfa-audit-gp.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-audit-gp.png rename to windows/security/threat-protection/images/cfa-audit-gp.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-filecreator.png b/windows/security/threat-protection/images/cfa-filecreator.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-filecreator.png rename to windows/security/threat-protection/images/cfa-filecreator.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-gp-enable.png b/windows/security/threat-protection/images/cfa-gp-enable.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-gp-enable.png rename to windows/security/threat-protection/images/cfa-gp-enable.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-notif.png b/windows/security/threat-protection/images/cfa-notif.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-notif.png rename to windows/security/threat-protection/images/cfa-notif.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-on.png b/windows/security/threat-protection/images/cfa-on.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-on.png rename to windows/security/threat-protection/images/cfa-on.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-prot-folders.png b/windows/security/threat-protection/images/cfa-prot-folders.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/cfa-prot-folders.png rename to windows/security/threat-protection/images/cfa-prot-folders.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/check-no.png b/windows/security/threat-protection/images/check-no.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/check-no.png rename to windows/security/threat-protection/images/check-no.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/create-endpoint-protection-profile.png b/windows/security/threat-protection/images/create-endpoint-protection-profile.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/create-endpoint-protection-profile.png rename to windows/security/threat-protection/images/create-endpoint-protection-profile.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/create-exploit-guard-policy.png b/windows/security/threat-protection/images/create-exploit-guard-policy.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/create-exploit-guard-policy.png rename to windows/security/threat-protection/images/create-exploit-guard-policy.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/dg-fig11-dgproperties.png b/windows/security/threat-protection/images/dg-fig11-dgproperties.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/dg-fig11-dgproperties.png rename to windows/security/threat-protection/images/dg-fig11-dgproperties.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/enable-cfa-app-allow.png b/windows/security/threat-protection/images/enable-cfa-app-allow.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/enable-cfa-app-allow.png rename to windows/security/threat-protection/images/enable-cfa-app-allow.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/enable-cfa-app-folder.png b/windows/security/threat-protection/images/enable-cfa-app-folder.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/enable-cfa-app-folder.png rename to windows/security/threat-protection/images/enable-cfa-app-folder.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/enable-cfa-app.png b/windows/security/threat-protection/images/enable-cfa-app.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/enable-cfa-app.png rename to windows/security/threat-protection/images/enable-cfa-app.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/enable-cfa-intune.png b/windows/security/threat-protection/images/enable-cfa-intune.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/enable-cfa-intune.png rename to windows/security/threat-protection/images/enable-cfa-intune.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/enable-ep-intune.png b/windows/security/threat-protection/images/enable-ep-intune.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/enable-ep-intune.png rename to windows/security/threat-protection/images/enable-ep-intune.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/enable-hvci-gp.png b/windows/security/threat-protection/images/enable-hvci-gp.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/enable-hvci-gp.png rename to windows/security/threat-protection/images/enable-hvci-gp.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/enable-np-intune.png b/windows/security/threat-protection/images/enable-np-intune.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/enable-np-intune.png rename to windows/security/threat-protection/images/enable-np-intune.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/ep-default.png b/windows/security/threat-protection/images/ep-default.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/ep-default.png rename to windows/security/threat-protection/images/ep-default.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/ep-prog.png b/windows/security/threat-protection/images/ep-prog.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/ep-prog.png rename to windows/security/threat-protection/images/ep-prog.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/event-viewer-import.png b/windows/security/threat-protection/images/event-viewer-import.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/event-viewer-import.png rename to windows/security/threat-protection/images/event-viewer-import.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/event-viewer.gif b/windows/security/threat-protection/images/event-viewer.gif similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/event-viewer.gif rename to windows/security/threat-protection/images/event-viewer.gif diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/events-create.gif b/windows/security/threat-protection/images/events-create.gif similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/events-create.gif rename to windows/security/threat-protection/images/events-create.gif diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/events-import.gif b/windows/security/threat-protection/images/events-import.gif similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/events-import.gif rename to windows/security/threat-protection/images/events-import.gif diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/exp-prot-gp.png b/windows/security/threat-protection/images/exp-prot-gp.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/exp-prot-gp.png rename to windows/security/threat-protection/images/exp-prot-gp.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/np-notif.png b/windows/security/threat-protection/images/np-notif.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/np-notif.png rename to windows/security/threat-protection/images/np-notif.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-blocks.png b/windows/security/threat-protection/images/sccm-asr-blocks.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-blocks.png rename to windows/security/threat-protection/images/sccm-asr-blocks.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-rules.png b/windows/security/threat-protection/images/sccm-asr-rules.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-asr-rules.png rename to windows/security/threat-protection/images/sccm-asr-rules.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa-block.png b/windows/security/threat-protection/images/sccm-cfa-block.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa-block.png rename to windows/security/threat-protection/images/sccm-cfa-block.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa.png b/windows/security/threat-protection/images/sccm-cfa.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-cfa.png rename to windows/security/threat-protection/images/sccm-cfa.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep-xml.png b/windows/security/threat-protection/images/sccm-ep-xml.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep-xml.png rename to windows/security/threat-protection/images/sccm-ep-xml.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep.png b/windows/security/threat-protection/images/sccm-ep.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-ep.png rename to windows/security/threat-protection/images/sccm-ep.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np-block.png b/windows/security/threat-protection/images/sccm-np-block.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np-block.png rename to windows/security/threat-protection/images/sccm-np-block.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np.png b/windows/security/threat-protection/images/sccm-np.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/sccm-np.png rename to windows/security/threat-protection/images/sccm-np.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/svg/check-no.svg b/windows/security/threat-protection/images/svg/check-no.svg similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/svg/check-no.svg rename to windows/security/threat-protection/images/svg/check-no.svg diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/svg/check-yes.svg b/windows/security/threat-protection/images/svg/check-yes.svg similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/svg/check-yes.svg rename to windows/security/threat-protection/images/svg/check-yes.svg diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/wdeg.png b/windows/security/threat-protection/images/wdeg.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/wdeg.png rename to windows/security/threat-protection/images/wdeg.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/wdsc-exp-prot-app-settings-options.png b/windows/security/threat-protection/images/wdsc-exp-prot-app-settings-options.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/wdsc-exp-prot-app-settings-options.png rename to windows/security/threat-protection/images/wdsc-exp-prot-app-settings-options.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/wdsc-exp-prot-app-settings.png b/windows/security/threat-protection/images/wdsc-exp-prot-app-settings.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/wdsc-exp-prot-app-settings.png rename to windows/security/threat-protection/images/wdsc-exp-prot-app-settings.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/wdsc-exp-prot-export.png b/windows/security/threat-protection/images/wdsc-exp-prot-export.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/wdsc-exp-prot-export.png rename to windows/security/threat-protection/images/wdsc-exp-prot-export.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/wdsc-exp-prot-sys-settings.png b/windows/security/threat-protection/images/wdsc-exp-prot-sys-settings.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/wdsc-exp-prot-sys-settings.png rename to windows/security/threat-protection/images/wdsc-exp-prot-sys-settings.png diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/wdsc-exp-prot.png b/windows/security/threat-protection/images/wdsc-exp-prot.png similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/images/wdsc-exp-prot.png rename to windows/security/threat-protection/images/wdsc-exp-prot.png diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 05cbed96aa..080a09e0b5 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -7,12 +7,12 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: dolmont +ms.author: dansimp author: DulceMontemayor ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: conceptual --- @@ -58,16 +58,16 @@ This built-in capability uses a game-changing risk-based approach to the discove **[Attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md)**
                        -The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations. +The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations. -- [Hardware based isolation](microsoft-defender-atp/overview-hardware-based-isolation.md) +- [Hardware based isolation](microsoft-defender-atp/overview-hardware-based-isolation.md) - [Application control](windows-defender-application-control/windows-defender-application-control.md) - [Device control](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) -- [Exploit protection](windows-defender-exploit-guard/exploit-protection-exploit-guard.md) -- [Network protection](windows-defender-exploit-guard/network-protection-exploit-guard.md) -- [Controlled folder access](windows-defender-exploit-guard/controlled-folders-exploit-guard.md) +- [Exploit protection](microsoft-defender-atp/exploit-protection.md) +- [Network protection](microsoft-defender-atp/network-protection.md) +- [Controlled folder access](microsoft-defender-atp/controlled-folders.md) - [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) -- [Attack surface reduction rules](windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) +- [Attack surface reduction rules](microsoft-defender-atp/attack-surface-reduction.md) @@ -132,7 +132,7 @@ Microsoft Defender ATP's new managed threat hunting service provides proactive h Integrate Microsoft Defender Advanced Threat Protection into your existing workflows. - [Onboarding](microsoft-defender-atp/onboard-configure.md) - [API and SIEM integration](microsoft-defender-atp/configure-siem.md) -- [Exposed APIs](microsoft-defender-atp/use-apis.md) +- [Exposed APIs](microsoft-defender-atp/apis-intro.md) - [Role-based access control (RBAC)](microsoft-defender-atp/rbac.md) - [Reporting and trends](microsoft-defender-atp/powerbi-reports.md) @@ -141,7 +141,7 @@ Integrate Microsoft Defender Advanced Threat Protection into your existing workf **[Microsoft Threat Protection](microsoft-defender-atp/threat-protection-integration.md)**
                        Microsoft Defender ATP is part of the Microsoft Threat Protection solution that helps implement end-to-end security across possible attack surfaces in the modern workplace. Bring the power of Microsoft threat protection to your organization. - [Conditional access](microsoft-defender-atp/conditional-access.md) -- [O365 ATP](microsoft-defender-atp/threat-protection-integration.md) +- [Office 365 ATP](microsoft-defender-atp/threat-protection-integration.md) - [Azure ATP](microsoft-defender-atp/threat-protection-integration.md) - [Azure Security Center](microsoft-defender-atp/threat-protection-integration.md) - [Skype for Business](microsoft-defender-atp/threat-protection-integration.md) diff --git a/windows/security/threat-protection/intelligence/coinminer-malware.md b/windows/security/threat-protection/intelligence/coinminer-malware.md index ab6330fbe8..52771c8630 100644 --- a/windows/security/threat-protection/intelligence/coinminer-malware.md +++ b/windows/security/threat-protection/intelligence/coinminer-malware.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md index 269b44ae01..fef7da884b 100644 --- a/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md +++ b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -36,4 +36,4 @@ Organizations participating in the CME effort work together to help eradicate se Any organization that is involved in cybersecurity and antimalware or interested in fighting cybercrime can participate in CME campaigns by enrolling in the [Virus Information Alliance (VIA) program](virus-information-alliance-criteria.md). It ensures that everyone agrees to use the information and tools available for campaigns for their intended purpose (that is, the eradication of malware). -If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/en-us/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/en-us/wdsi/alliances/collaboration-inquiry). +If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry). diff --git a/windows/security/threat-protection/intelligence/criteria.md b/windows/security/threat-protection/intelligence/criteria.md index dbccc045ba..79047be15a 100644 --- a/windows/security/threat-protection/intelligence/criteria.md +++ b/windows/security/threat-protection/intelligence/criteria.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md b/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md index 0367399251..1a57f85019 100644 --- a/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md +++ b/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/intelligence/developer-faq.md b/windows/security/threat-protection/intelligence/developer-faq.md index cf077a0a1b..3e680879b5 100644 --- a/windows/security/threat-protection/intelligence/developer-faq.md +++ b/windows/security/threat-protection/intelligence/developer-faq.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: levinec +ms.author: ellevin author: levinec ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/intelligence/developer-info.md b/windows/security/threat-protection/intelligence/developer-info.md index 4ae184bdda..19d1a76072 100644 --- a/windows/security/threat-protection/intelligence/developer-info.md +++ b/windows/security/threat-protection/intelligence/developer-info.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: levinec +ms.author: ellevin author: levinec ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/intelligence/developer-resources.md b/windows/security/threat-protection/intelligence/developer-resources.md index 047f060649..35aec2bd9c 100644 --- a/windows/security/threat-protection/intelligence/developer-resources.md +++ b/windows/security/threat-protection/intelligence/developer-resources.md @@ -9,7 +9,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: medium ms.pagetype: security -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -24,9 +24,9 @@ If you believe that your application or program has been incorrectly detected by Check out the following resources for information on how to submit and view submissions: -- [Submit files](https://www.microsoft.com/en-us/wdsi/filesubmission) +- [Submit files](https://www.microsoft.com/wdsi/filesubmission) -- [View your submissions](https://www.microsoft.com/en-us/wdsi/submissionhistory) +- [View your submissions](https://www.microsoft.com/wdsi/submissionhistory) ## Additional resources diff --git a/windows/security/threat-protection/intelligence/exploits-malware.md b/windows/security/threat-protection/intelligence/exploits-malware.md index 0716cab937..beff687643 100644 --- a/windows/security/threat-protection/intelligence/exploits-malware.md +++ b/windows/security/threat-protection/intelligence/exploits-malware.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/intelligence/fileless-threats.md b/windows/security/threat-protection/intelligence/fileless-threats.md index 6e0e5385e8..bc3ecd48d1 100644 --- a/windows/security/threat-protection/intelligence/fileless-threats.md +++ b/windows/security/threat-protection/intelligence/fileless-threats.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -96,6 +96,6 @@ Having described the broad categories, we can now dig into the details and provi ## Defeating fileless malware -At Microsoft, we actively monitor the security landscape to identify new threat trends and develop solutions that continuously enhance Windows security and mitigate classes of threats. We instrument durable protections that are effective against a wide range of threats. Through AntiMalware Scan Interface (AMSI), behavior monitoring, memory scanning, and boot sector protection, Microsoft Defender Advanced Threat Protection [(Microsoft Defender ATP)](https://www.microsoft.com/en-us/windowsforbusiness?ocid=docs-fileless) can inspect fileless threats even with heavy obfuscation. Machine learning technologies in the cloud allow us to scale these protections against new and emerging threats. +At Microsoft, we actively monitor the security landscape to identify new threat trends and develop solutions that continuously enhance Windows security and mitigate classes of threats. We instrument durable protections that are effective against a wide range of threats. Through AntiMalware Scan Interface (AMSI), behavior monitoring, memory scanning, and boot sector protection, Microsoft Defender Advanced Threat Protection [(Microsoft Defender ATP)](https://www.microsoft.com/windowsforbusiness?ocid=docs-fileless) can inspect fileless threats even with heavy obfuscation. Machine learning technologies in the cloud allow us to scale these protections against new and emerging threats. To learn more, read: [Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV](https://cloudblogs.microsoft.com/microsoftsecure/2018/09/27/out-of-sight-but-not-invisible-defeating-fileless-malware-with-behavior-monitoring-amsi-and-next-gen-av/) diff --git a/windows/security/threat-protection/intelligence/images/MITRE-Microsoft-Defender-ATP.png b/windows/security/threat-protection/intelligence/images/MITRE-Microsoft-Defender-ATP.png new file mode 100644 index 0000000000..446ad19d77 Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/MITRE-Microsoft-Defender-ATP.png differ diff --git a/windows/security/threat-protection/intelligence/images/Transparency-report-August-2.png b/windows/security/threat-protection/intelligence/images/Transparency-report-August-2.png new file mode 100644 index 0000000000..9769fd54cb Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/Transparency-report-August-2.png differ diff --git a/windows/security/threat-protection/intelligence/images/prevalent-malware-aug-small.png b/windows/security/threat-protection/intelligence/images/prevalent-malware-aug-small.png new file mode 100644 index 0000000000..f797263dba Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/prevalent-malware-aug-small.png differ diff --git a/windows/security/threat-protection/intelligence/images/prevalent-malware-small.png b/windows/security/threat-protection/intelligence/images/prevalent-malware-small.png deleted file mode 100644 index 15a95c2276..0000000000 Binary files a/windows/security/threat-protection/intelligence/images/prevalent-malware-small.png and /dev/null differ diff --git a/windows/security/threat-protection/intelligence/images/real-world-aug-small.png b/windows/security/threat-protection/intelligence/images/real-world-aug-small.png new file mode 100644 index 0000000000..303df698eb Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/real-world-aug-small.png differ diff --git a/windows/security/threat-protection/intelligence/images/real-world-protection-aug-small.png b/windows/security/threat-protection/intelligence/images/real-world-protection-aug-small.png new file mode 100644 index 0000000000..3a188fbf75 Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/real-world-protection-aug-small.png differ diff --git a/windows/security/threat-protection/intelligence/images/real-world-small.png b/windows/security/threat-protection/intelligence/images/real-world-small.png deleted file mode 100644 index 89bf7a1819..0000000000 Binary files a/windows/security/threat-protection/intelligence/images/real-world-small.png and /dev/null differ diff --git a/windows/security/threat-protection/intelligence/images/transparency-report-3.png b/windows/security/threat-protection/intelligence/images/transparency-report-3.png deleted file mode 100644 index 413454d293..0000000000 Binary files a/windows/security/threat-protection/intelligence/images/transparency-report-3.png and /dev/null differ diff --git a/windows/security/threat-protection/intelligence/macro-malware.md b/windows/security/threat-protection/intelligence/macro-malware.md index f26e686027..ec97b244a7 100644 --- a/windows/security/threat-protection/intelligence/macro-malware.md +++ b/windows/security/threat-protection/intelligence/macro-malware.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -31,7 +31,7 @@ We've seen macro malware download threats from the following families: * [Ransom:Win32/Teerac](Ransom:Win32/Teerac) * [TrojanDownloader:Win32/Chanitor](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Chanitor.A) * [TrojanSpy:Win32/Ursnif](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif) -* [Win32/Fynloski](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Fynloski) +* [Win32/Fynloski](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Win32/Fynloski) * [Worm:Win32/Gamarue](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Win32/Gamarue) ## How to protect against macro malware diff --git a/windows/security/threat-protection/intelligence/malware-naming.md b/windows/security/threat-protection/intelligence/malware-naming.md index 83a0c0a704..2a52b19798 100644 --- a/windows/security/threat-protection/intelligence/malware-naming.md +++ b/windows/security/threat-protection/intelligence/malware-naming.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/intelligence/phishing.md b/windows/security/threat-protection/intelligence/phishing.md index 27d9e2a4fe..4f5d3c7278 100644 --- a/windows/security/threat-protection/intelligence/phishing.md +++ b/windows/security/threat-protection/intelligence/phishing.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/intelligence/prevent-malware-infection.md b/windows/security/threat-protection/intelligence/prevent-malware-infection.md index d916ad8a4b..63ef1862ba 100644 --- a/windows/security/threat-protection/intelligence/prevent-malware-infection.md +++ b/windows/security/threat-protection/intelligence/prevent-malware-infection.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -53,7 +53,7 @@ Using pirated content is not only illegal, it can also expose your device to mal Users do not openly discuss visits to these sites, so any untoward experience are more likely to stay unreported. -To stay safe, download movies, music, and apps from official publisher websites or stores. Consider running a streamlined OS such as [Windows 10 Pro SKU S Mode](https://www.microsoft.com/en-us/windows/s-mode?ocid=cx-wdsi-articles), which ensures that only vetted apps from the Windows Store are installed. +To stay safe, download movies, music, and apps from official publisher websites or stores. Consider running a streamlined OS such as [Windows 10 Pro SKU S Mode](https://www.microsoft.com/windows/s-mode?ocid=cx-wdsi-articles), which ensures that only vetted apps from the Windows Store are installed. ## Don't attach unfamiliar removable drives diff --git a/windows/security/threat-protection/intelligence/ransomware-malware.md b/windows/security/threat-protection/intelligence/ransomware-malware.md index b7eaea126c..b91211e7da 100644 --- a/windows/security/threat-protection/intelligence/ransomware-malware.md +++ b/windows/security/threat-protection/intelligence/ransomware-malware.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -61,6 +61,6 @@ We recommend: * Educate your employees so they can identify social engineering and spear-phishing attacks. -* [Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard). It can stop ransomware from encrypting files and holding the files for ransom. +* [Controlled folder access](../microsoft-defender-atp/controlled-folders.md). It can stop ransomware from encrypting files and holding the files for ransom. For more general tips, see [prevent malware infection](prevent-malware-infection.md). diff --git a/windows/security/threat-protection/intelligence/rootkits-malware.md b/windows/security/threat-protection/intelligence/rootkits-malware.md index 528be6dda2..ffe4254e2b 100644 --- a/windows/security/threat-protection/intelligence/rootkits-malware.md +++ b/windows/security/threat-protection/intelligence/rootkits-malware.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -31,7 +31,7 @@ Many modern malware families use rootkits to try and avoid detection and removal * [Cutwail](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fCutwail) -* [Datrahere](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win64/Detrahere) (Zacinlo) +* [Datrahere](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win64/Detrahere) (Zacinlo) * [Rustock](https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Win32%2fRustock) diff --git a/windows/security/threat-protection/intelligence/safety-scanner-download.md b/windows/security/threat-protection/intelligence/safety-scanner-download.md index 07018d689f..f00d63e08f 100644 --- a/windows/security/threat-protection/intelligence/safety-scanner-download.md +++ b/windows/security/threat-protection/intelligence/safety-scanner-download.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -24,12 +24,12 @@ Microsoft Safety Scanner is a scan tool designed to find and remove malware from - [Download Microsoft Safety Scanner (64-bit)](https://go.microsoft.com/fwlink/?LinkId=212732) > [!NOTE] -> The security intelligence update version of the Microsoft Safety Scanner matches the version described [in this web page](https://www.microsoft.com/en-us/wdsi/definitions). +> The security intelligence update version of the Microsoft Safety Scanner matches the version described [in this web page](https://www.microsoft.com/wdsi/definitions). Safety Scanner only scans when manually triggered and is available for use 10 days after being downloaded. We recommend that you always download the latest version of this tool before each scan. > [!NOTE] -> This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Windows Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/en-us/wdsi/help/troubleshooting-infection). +> This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Windows Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/windows/comprehensive-security) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/wdsi/help/troubleshooting-infection). > [!NOTE] > Safety scanner is a portable executable and does not appear in the Windows Start menu or as an icon on the desktop. Note where you saved this download. diff --git a/windows/security/threat-protection/intelligence/submission-guide.md b/windows/security/threat-protection/intelligence/submission-guide.md index 54f39ce774..05e5ab7db4 100644 --- a/windows/security/threat-protection/intelligence/submission-guide.md +++ b/windows/security/threat-protection/intelligence/submission-guide.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -52,7 +52,7 @@ We encourage all software vendors and developers to read about [how Microsoft id ## How do I track or view past sample submissions? -You can track your submissions through the [submission history page](https://www.microsoft.com/en-us/wdsi/submissionhistory). Your submission will only appear on this page if you were signed in when you submitted it. +You can track your submissions through the [submission history page](https://www.microsoft.com/wdsi/submissionhistory). Your submission will only appear on this page if you were signed in when you submitted it. If you’re not signed in when you submit a sample, you will be redirected to a tracking page. Bookmark this page if you want to come back and check on the status of your submission. @@ -66,7 +66,7 @@ Each submission is shown to be in one of the following status types: * Closed—a final determination has been given by an analyst -If you are signed in, you can see the status of any files you submit to us on the [submission history page](https://www.microsoft.com/en-us/wdsi/submissionhistory). +If you are signed in, you can see the status of any files you submit to us on the [submission history page](https://www.microsoft.com/wdsi/submissionhistory). ## How does Microsoft prioritize submissions diff --git a/windows/security/threat-protection/intelligence/supply-chain-malware.md b/windows/security/threat-protection/intelligence/supply-chain-malware.md index 6ea3d8c4e2..7530ec2c2e 100644 --- a/windows/security/threat-protection/intelligence/supply-chain-malware.md +++ b/windows/security/threat-protection/intelligence/supply-chain-malware.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/intelligence/support-scams.md b/windows/security/threat-protection/intelligence/support-scams.md index 4744f0f0e3..35942059ca 100644 --- a/windows/security/threat-protection/intelligence/support-scams.md +++ b/windows/security/threat-protection/intelligence/support-scams.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md b/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md index a786d8ecd1..9bd0cfef19 100644 --- a/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md +++ b/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: high -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -18,89 +18,70 @@ search.appverid: met150 # Top scoring in industry tests -Microsoft Defender Advanced Threat Protection ([Microsoft Defender ATP](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=cx-docs-avreports)) technologies consistently achieve high scores in independent tests, demonstrating the strength of its enterprise threat protection capabilities. Microsoft aims to be transparent about these test scores. This page summarizes the results and provides analysis. +Microsoft Defender Advanced Threat Protection ([Microsoft Defender ATP](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=cx-docs-avreports)) technologies consistently achieve high scores in independent tests, demonstrating the strength of its enterprise threat protection capabilities. Microsoft aims to be transparent about these test scores. This page summarizes the results and provides analysis. ## Next generation protection [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10?ocid=cx-docs-avreports) consistently performs highly in independent tests, displaying how it is a top choice in the antivirus market. Note that these tests only provide results for antivirus and do not test for additional security protections. -Windows Defender Antivirus is part of the [next generation](https://www.youtube.com/watch?v=Xy3MOxkX_o4) Microsoft Defender ATP security stack which addresses the latest and most sophisticated threats today. In some cases, customers might not even know they were protected because a cyberattack is stopped [milliseconds after a campaign starts](https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign?ocid=cx-docs-avreports). That's because Windows Defender Antivirus detects and stops malware at first sight by using [machine learning](https://cloudblogs.microsoft.com/microsoftsecure/2018/06/07/machine-learning-vs-social-engineering?ocid=cx-docs-avreports), [artificial intelligence](https://cloudblogs.microsoft.com/microsoftsecure/2018/02/14/how-artificial-intelligence-stopped-an-emotet-outbreak?ocid=cx-docs-avreports), behavioral analysis, and other advanced technologies. +Windows Defender Antivirus is the [next generation protection](https://www.youtube.com/watch?v=Xy3MOxkX_o4) capability in the Microsoft Defender ATP security stack which addresses the latest and most sophisticated threats today. In some cases, customers might not even know they were protected because a cyberattack is stopped [milliseconds after a campaign starts](https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign?ocid=cx-docs-avreports). That's because Windows Defender Antivirus detects and stops malware at first sight by using [machine learning](https://cloudblogs.microsoft.com/microsoftsecure/2018/06/07/machine-learning-vs-social-engineering?ocid=cx-docs-avreports), [artificial intelligence](https://cloudblogs.microsoft.com/microsoftsecure/2018/02/14/how-artificial-intelligence-stopped-an-emotet-outbreak?ocid=cx-docs-avreports), behavioral analysis, and other advanced technologies.

                        +![String of images showing scores](./images/Transparency-report-August-2.png) -![Graph describing Real-World detection rate](./images/transparency-report-purple-60.png) **Download the latest transparency report: [Examining industry test results, May 2019](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE33cdd)** +**Download the latest transparency report: [Examining industry test results, August 2019](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl)** ### AV-TEST: Protection score of 6.0/6.0 in the latest test The AV-TEST Product Review and Certification Report tests on three categories: protection, performance, and usability. The scores listed below are for the Protection category which has two scores: Real-World Testing and the AV-TEST reference set (known as "Prevalent Malware"). -- March - April 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/april-2019/microsoft-windows-defender-antivirus-4.18-191517/) **Latest** +- May - June 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/june-2019/microsoft-windows-defender-antivirus-4.18-192415/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl) **Latest** - Windows Defender Antivirus achieved an overall Protection score of 6.0/6.0, with 6,849 malware samples used. This is the sixth consecutive cycle that Windows Defender Antivirus achieved a perfect Protection score. + Windows Defender Antivirus achieved an overall Protection score of 6.0/6.0, detecting 100% of 2,735 malware samples used. This is the seventh consecutive cycle that Windows Defender Antivirus achieved a perfect Protection score. + +- March - April 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/april-2019/microsoft-windows-defender-antivirus-4.18-191517/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl) - January - February 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/february-2019/microsoft-windows-defender-antivirus-4.18-190611/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE33cdd) - Windows Defender Antivirus achieved an overall Protection score of 6.0/6.0, with 13,977 malware samples used. - - November - December 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/december-2018/microsoft-windows-defender-antivirus-4.18-185074/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWusR9) - Windows Defender Antivirus achieved an overall Protection score of 6.0/6.0, detecting 100% of 19,956 malware samples. - - September - October 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/october-2018/microsoft-windows-defender-antivirus-4.18-184174/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWqOqD) - Windows Defender Antivirus achieved an overall Protection score of 6.0/6.0, protecting against 21,566 of 21,568 tested malware samples. - - July - August 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/august-2018/microsoft-windows-defender-antivirus-4.12--4.18-183212/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2IL3Y) - Windows Defender Antivirus achieved an overall Protection score of 6.0/6.0, detecting 100% of 20,022 malware samples. +### AV-Comparatives: Protection rating of 99.9% in the latest test -- May - June 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/june-2018/microsoft-windows-defender-antivirus-4.12-182374/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2v60I?ocid=cx-docs-avreports) +Business Security Test consists of three main parts: the Real-World Protection Test which mimics online malware attacks, the Malware Protection Test where the malware enters the system from outside the internet (e.g. USB), and the Performance Test which looks at the impact on the system’s performance. - Windows Defender Antivirus achieved an overall Protection score of 6.0/6.0, detecting 100% of 5,790 malware samples. +- Business Security Test 2019 (March - June): [Real-World Protection Rate 99.9%](https://www.av-comparatives.org/tests/business-security-test-2019-march-june/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl) **Latest** -||| -|---|---| -|![Graph describing Real-World detection rate](./images/real-world-small.png)|![Graph describing Prevalent Malware](./images/prevalent-malware-small.png)| + Windows Defender Antivirus has consistently improved in Real-World Protection Rates over the past year, with 99.9% in the latest test. -### AV-Comparatives: Protection rating of 99.7% in the latest test +- Business Security Test 2018 (August - November): [Real-World Protection Rate 99.6%](https://www.av-comparatives.org/tests/business-security-test-2018-august-november/) -AV-Comparatives is an independent organization offering systematic testing for security software such as PC/Mac-based antivirus products and mobile security solutions. +- Business Security Test 2018 (March - June): [Real-World Protection Rate 98.7%](https://www.av-comparatives.org/tests/business-security-test-2018-march-june/) -- Real-World Protection Test Enterprise March - April 2019: [Protection Rate 99.7%](https://www.av-comparatives.org/tests/real-world-protection-test-enterprise-march-april-2019-testresult/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE33cdd) **Latest** - - This test, as defined by AV-Comparatives, attempts to assess the effectiveness of each security program to protect a computer against active malware threats while online. The test set contained 389 test cases (such as malicious URLs). - -- Real-World Protection Test Enterprise August - November 2018: [Protection Rate 99.6%](https://www.av-comparatives.org/tests/real-world-protection-test-enterprise-august-november-2018-testresult/) - - The test set contained 1,207 test cases (such as malicious URLs). - -- Malware Protection Test Enterprise August 2018: [Protection Rate 99.9%](https://www.av-comparatives.org/tests/malware-protection-test-enterprise-august-2018-testresult/) - - This test, as defined by AV-Comparatives, attempts to assesses a security program’s ability to protect a system against infection by malicious files before, during or after execution. The results are based on testing against 1,556 malware samples. - -- Real-World Protection Test Enterprise March - June 2018: [Protection Rate 98.7%](https://www.av-comparatives.org/tests/real-world-protection-test-enterprise-march-june-2018-testresult/) - - The test set contained 1,163 test cases (such as malicious URLs). - -### SE Labs: Total accuracy rating of AAA in the latest test +### SE Labs: AAA award in the latest test SE Labs tests a range of solutions used by products and services to detect and/or protect against attacks, including endpoint software, network appliances, and cloud services. +- Enterprise Endpoint Protection April - June 2019: [AAA award](https://selabs.uk/download/enterprise/epp/2019/apr-jun-2019-enterprise.pdf) **pdf** | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl) + + Microsoft's next-gen protection was named as one of the leading products, stopping all of the targeted attacks and all but one public threat. It also handled the legitimate applications correctly. + +- Enterprise Endpoint Protection January - March 2019: [AAA award](https://selabs.uk/download/enterprise/epp/2019/jan-mar-2019-enterprise.pdf) **pdf** | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl) + - Enterprise Endpoint Protection October - December 2018: [AAA award](https://selabs.uk/download/enterprise/epp/2018/oct-dec-2018-enterprise.pdf) **pdf** | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE33cdd) - Microsoft's next-gen protection was named as one of the leading products, stopping all of the public and targeted attacks. - - Enterprise Endpoint Protection July - September 2018: [AAA award](https://selabs.uk/download/enterprise/epp/2018/jul-sep-2018-enterprise.pdf) **pdf** - Microsoft's next-gen protection was named as one of the most effective products, stopping all public and targeted attacks. It showcased its ability to block malicious URLs, deal with exploits, and classify legitimate apps and websites correctly. - -- Enterprise Endpoint Protection April - June 2018: [AAA award](https://selabs.uk/download/enterprise/epp/2018/apr-jun-2018-enterprise.pdf) **pdf** - - Microsoft's next-gen protection was named as one of the most effective products, stopping all targeted attacks and the vast majority of public threats. - ## Endpoint detection & response Microsoft Defender ATP [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats. +![String of images showing EDR capabilities](./images/MITRE-Microsoft-Defender-ATP.png) + +**Read our analysis: [MITRE evaluation highlights industry-leading EDR capabilities in Windows Defender ATP](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/MITRE-evaluation-highlights-industry-leading-EDR-capabilities-in/ba-p/369831)** + ### MITRE: Industry-leading optics and detection capabilities MITRE tested the ability of products to detect techniques commonly used by the targeted attack group APT3 (also known as Boron or UPS). To isolate detection capabilities, all protection and prevention features were turned off. Microsoft is happy to be one of the first EDR vendors to sign up for the MITRE evaluation based on the ATT&CK framework, widely regarded today as the most comprehensive catalog of attacker techniques and tactics. @@ -113,6 +94,6 @@ MITRE tested the ability of products to detect techniques commonly used by the t It is important to remember that Microsoft sees a wider and broader set of threats beyond what’s tested in the evaluations highlighted above. For example, in an average month, we identify over 100 million new threats. Even if an independent tester can acquire and test 1% of those threats, that is a million tests across 20 or 30 products. In other words, the vastness of the malware landscape makes it extremely difficult to evaluate the quality of protection against real world threats. -The capabilities within [Microsoft Defender ATP](https://www.microsoft.com/en-us/windowsforbusiness?ocid=cx-docs-avreports) provide [additional layers of protection](https://cloudblogs.microsoft.com/microsoftsecure/2017/12/11/detonating-a-bad-rabbit-windows-defender-antivirus-and-layered-machine-learning-defenses?ocid=cx-docs-avreports) that are not factored into industry antivirus tests, and address some of the latest and most sophisticated threats. Isolating AV from the rest of Microsoft Defender ATP creates a partial picture of how our security stack operates in the real world. For example, attack surface reduction and endpoint detection & response capabilities can help prevent malware from getting onto devices in the first place. We have proven that [Microsoft Defender ATP components catch samples](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2ouJA?ocid=cx-docs-avreports) that Windows Defender Antivirus missed in these industry tests, which is more representative of how effectively our security suite protects customers in the real world. +The capabilities within [Microsoft Defender ATP](https://www.microsoft.com/windowsforbusiness?ocid=cx-docs-avreports) provide [additional layers of protection](https://cloudblogs.microsoft.com/microsoftsecure/2017/12/11/detonating-a-bad-rabbit-windows-defender-antivirus-and-layered-machine-learning-defenses?ocid=cx-docs-avreports) that are not factored into industry antivirus tests, and address some of the latest and most sophisticated threats. Isolating AV from the rest of Microsoft Defender ATP creates a partial picture of how our security stack operates in the real world. For example, attack surface reduction and endpoint detection & response capabilities can help prevent malware from getting onto devices in the first place. We have proven that [Microsoft Defender ATP components catch samples](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2ouJA?ocid=cx-docs-avreports) that Windows Defender Antivirus missed in these industry tests, which is more representative of how effectively our security suite protects customers in the real world. -Using independent tests, customers can view one aspect of their security suite but can't assess the complete protection of all the security features. Microsoft is highly engaged in working with several independent testers to evolve security testing to focus on the end-to-end security stack. In the meantime, customers can evaluate Microsoft Defender Advanced Threat Protection in their own networks by signing up for a [90-day trial of Microsoft Defender ATP](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=cx-docs-avreports), or [enabling Preview features on existing tenants](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection?ocid=cx-docs-avreports). +Using independent tests, customers can view one aspect of their security suite but can't assess the complete protection of all the security features. Microsoft is highly engaged in working with several independent testers to evolve security testing to focus on the end-to-end security stack. In the meantime, customers can evaluate Microsoft Defender Advanced Threat Protection in their own networks by signing up for a [90-day trial of Microsoft Defender ATP](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=cx-docs-avreports), or [enabling Preview features on existing tenants](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection?ocid=cx-docs-avreports). diff --git a/windows/security/threat-protection/intelligence/trojans-malware.md b/windows/security/threat-protection/intelligence/trojans-malware.md index 918006ff72..c9f64fecd6 100644 --- a/windows/security/threat-protection/intelligence/trojans-malware.md +++ b/windows/security/threat-protection/intelligence/trojans-malware.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/intelligence/understanding-malware.md b/windows/security/threat-protection/intelligence/understanding-malware.md index 1be49ef74a..2486a1e427 100644 --- a/windows/security/threat-protection/intelligence/understanding-malware.md +++ b/windows/security/threat-protection/intelligence/understanding-malware.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -21,7 +21,7 @@ Malware is a term used to describe malicious applications and code that can caus Cybercriminals that distribute malware are often motivated by money and will use infected computers to launch attacks, obtain banking credentials, collect information that can be sold, sell access to computing resources, or extort payment from victims. -As criminals become more sophisticated with their attacks, Microsoft is here to help. Windows 10 is the most secure version of Windows yet and includes many features to help protect you whether you're at home, at work, or on the go. With Microsoft Defender Advanced Threat Protection ([Microsoft Defender ATP](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp)), businesses can stay protected with next-generation protection and other security capabilities. +As criminals become more sophisticated with their attacks, Microsoft is here to help. Windows 10 is the most secure version of Windows yet and includes many features to help protect you whether you're at home, at work, or on the go. With Microsoft Defender Advanced Threat Protection ([Microsoft Defender ATP](https://www.microsoft.com/WindowsForBusiness/windows-atp)), businesses can stay protected with next-generation protection and other security capabilities. For good general tips, check out the [prevent malware infection](prevent-malware-infection.md) topic. diff --git a/windows/security/threat-protection/intelligence/unwanted-software.md b/windows/security/threat-protection/intelligence/unwanted-software.md index d8e216919b..28718f36f6 100644 --- a/windows/security/threat-protection/intelligence/unwanted-software.md +++ b/windows/security/threat-protection/intelligence/unwanted-software.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro diff --git a/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md b/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md index b899f41868..cfda4379ca 100644 --- a/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md +++ b/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -50,4 +50,4 @@ To be eligible for VIA your organization must: 3. Be willing to sign and adhere to the VIA membership agreement. -If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/en-us/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/en-us/wdsi/alliances/collaboration-inquiry). +If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry). diff --git a/windows/security/threat-protection/intelligence/virus-initiative-criteria.md b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md index 50fe7168fa..adfe6b2035 100644 --- a/windows/security/threat-protection/intelligence/virus-initiative-criteria.md +++ b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -54,4 +54,4 @@ Your organization must meet the following eligibility requirements to qualify fo ### Apply now -If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/en-us/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/en-us/wdsi/alliances/collaboration-inquiry). +If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry). diff --git a/windows/security/threat-protection/intelligence/worms-malware.md b/windows/security/threat-protection/intelligence/worms-malware.md index aca7c0581d..6b392dcc81 100644 --- a/windows/security/threat-protection/intelligence/worms-malware.md +++ b/windows/security/threat-protection/intelligence/worms-malware.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: secure ms.sitesec: library ms.localizationpriority: medium -ms.author: levinec +ms.author: ellevin author: levinec manager: dansimp audience: ITPro @@ -34,7 +34,7 @@ Jenxcus (also known as Dunihi), Gamarue (also known as Androm), and Bondat have Both Bondat and Gamarue have clever ways of obscuring themselves to evade detection. By hiding what they are doing, they try to avoid detection by security software. -* [**WannaCrypt**](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/WannaCrypt) also deserves a mention here. Unlike older worms that often spread just because they could, modern worms often spread to drop a payload (e.g. ransomware). +* [**WannaCrypt**](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/WannaCrypt) also deserves a mention here. Unlike older worms that often spread just because they could, modern worms often spread to drop a payload (e.g. ransomware). This image shows how a worm can quickly spread through a shared USB drive. diff --git a/windows/security/threat-protection/mbsa-removal-and-guidance.md b/windows/security/threat-protection/mbsa-removal-and-guidance.md index b2d4621b58..d1b7cfa967 100644 --- a/windows/security/threat-protection/mbsa-removal-and-guidance.md +++ b/windows/security/threat-protection/mbsa-removal-and-guidance.md @@ -5,7 +5,7 @@ keywords: MBSA, security, removal ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium -ms.author: dolmont +ms.author: dansimp author: dulcemontemayor ms.date: 10/05/2018 ms.reviewer: diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md index 38d679e8fa..55e9157bfa 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink) Depending on the Microsoft security products that you use, some advanced features might be available for you to integrate Microsoft Defender ATP with. @@ -53,7 +53,7 @@ For tenants created on or after Windows 10, version 1809 the automated investiga > - The result of the auto-resolve action may influence the Machine risk level calculation which is based on the active alerts found on a machine. >- If a security operations analyst manually sets the status of an alert to "In progress" or "Resolved" the auto-resolve capability will not overwrite it. -## Block file +## Allow or block file Blocking is only available if your organization uses Windows Defender Antivirus as the active antimalware solution, and if the cloud-based protection feature is enabled. @@ -71,6 +71,19 @@ To turn **Allow or block** files on: Once you have enabled this feature, you can [block files](respond-file-alerts.md#allow-or-block-file) via the **Add Indicator** tab on a file's profile page. + +## Custom network indicators + +Enabling this feature allows you to create indicators for IP addresses, domains, or URLs which determine whether they will be allowed or blocked based on your custom indicator list. + +To use this feature, machines must be running Windows 10 version 1709 or later. They should also have network protection in block mode and version 4.18.1906.3 or later of the antimalware platform [see KB 4052623](https://go.microsoft.com/fwlink/?linkid=2099834). + +For more information, see [Manage indicators](manage-indicators.md). + +>[!NOTE] +>Network protection leverages reputation services that process requests in locations that might be outside of the location you have selected for your Microsoft Defender ATP data. + + ## Show user details When you enable this feature, you'll be able to see user details stored in Azure Active Directory including a user's picture, name, title, and department information when investigating user account entities. You can find user account information in the following views: diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md index 9544001b7c..11138ccab3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md @@ -24,7 +24,7 @@ ms.date: 07/24/2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The AlertEvents table in the Advanced hunting schema contains information about alerts on Microsoft Defender Security Center. Use this reference to construct queries that return information from the table. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md index fbe2aa1d4c..918e31047d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md @@ -24,7 +24,7 @@ ms.date: 04/24/2018 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-abovefoldlink) ## Performance best practices The following best practices serve as a guideline of query performance best practices and for you to get faster results and be able to run complex queries. @@ -93,4 +93,4 @@ ProcessCreationEvents | where CanonicalCommandLine contains "stop" and CanonicalCommandLine contains "MpsSvc" ``` ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-belowfoldlink) \ No newline at end of file +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-belowfoldlink) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md index a82f47f963..2f8d8b5394 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md @@ -24,7 +24,7 @@ ms.date: 07/24/2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The FileCreationEvents table in the Advanced hunting schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. @@ -59,6 +59,13 @@ For information on other tables in the Advanced hunting schema, see [the Advanc | InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | | InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | | InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | +| RequestProtocol | string | Network protocol, if applicable, used to initiate the activity: Unknown, Local, SMB, or NFS | +| ShareName | string | Name of shared folder containing the file | +| RequestSourceIP | string | IPv4 or IPv6 address of the remote device that initiated the activity | +| RequestSourcePort | string | Source port on the remote device that initiated the activity | +| RequestAccountName | string | User name of account used to remotely initiate the activity | +| RequestAccountDomain | string | Domain of the account used to remotely initiate the activity | +| RequestAccountSid | string | Security Identifier (SID) of the account to remotely initiate the activity | | ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | | SensitivityLabel | string | Label applied to an email, file, or other content to classify it for information protection | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md index d7e0521472..aabe8804ca 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md @@ -24,7 +24,7 @@ ms.date: 07/24/2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The ImageLoadEvents table in the Advanced hunting schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md index 1e8a0cfcc7..90d2fe815e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md @@ -24,7 +24,7 @@ ms.date: 07/24/2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The LogonEvents table in the Advanced hunting schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md index fa58a67cdd..5ac8eced92 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md @@ -24,7 +24,7 @@ ms.date: 07/24/2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The MachineInfo table in the Advanced hunting schema contains information about machines in the organization, including OS version, active users, and computer name. Use this reference to construct queries that return information from the table. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md index 3ec3dfd8f2..cb1ff3f42a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md @@ -24,7 +24,7 @@ ms.date: 07/24/2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The MachineNetworkInfo table in the Advanced hunting schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md index 01c38628be..34eb98af98 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md @@ -24,7 +24,7 @@ ms.date: 07/24/2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The MiscEvents table in the Advanced hunting schema contains information about multiple event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md index fb18d453d7..29cce6edf3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md @@ -24,7 +24,7 @@ ms.date: 07/24/2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The NetworkCommunicationEvents table in the Advanced hunting schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md index d6ef50a878..ff4bcab4b7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md @@ -24,7 +24,7 @@ ms.date: 07/24/2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The ProcessCreationEvents table in the Advanced hunting schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md index 40810a2f12..a0d1dd41a1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md @@ -24,7 +24,7 @@ ms.date: 07/24/2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) ## Advanced hunting table reference diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md index 75b7b12ee6..dcf2cf5422 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md @@ -24,7 +24,7 @@ ms.date: 07/24/2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) The RegistryEvents table in the Advanced hunting schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting.md index 4ca2aebb87..7c51f049ba 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting.md @@ -20,7 +20,7 @@ ms.date: 08/15/2018 # Query data using Advanced hunting in Microsoft Defender ATP ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) To get you started in querying your data, you can use the Basic or Advanced query examples, which have some preloaded queries to help you understand the basic query syntax. @@ -146,7 +146,7 @@ The filter selections will resolve as an additional query term and the results w Check out the [Advanced hunting repository](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). Contribute and use example queries shared by our customers. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink) ## Related topic - [Advanced hunting reference](advanced-hunting-reference.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue-endpoint-detection-response.md b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue-endpoint-detection-response.md index fe729da635..0f5c27cc7e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue-endpoint-detection-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue-endpoint-detection-response.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md index a3455dcc67..fe3c249332 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md +++ b/windows/security/threat-protection/microsoft-defender-atp/alerts-queue.md @@ -23,7 +23,7 @@ ms.date: 04/24/2018 **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-alertsq-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-alertsq-abovefoldlink) The **Alerts queue** shows a list of alerts that were flagged from machines in your network. By default, the queue displays alerts seen in the last 30 days in a grouped view, with the most recent alerts showing at the top of the list, helping you see the most recent alerts first. @@ -38,7 +38,7 @@ On the top navigation you can: ![Image of alerts queue](images/alerts-queue-list.png) -## Sort, filter, and group the alerts queue +## Sort, filter, and group the alerts queue You can apply the following filters to limit the list of alerts and get a more focused view the alerts. ### Severity @@ -58,10 +58,10 @@ The Windows Defender AV threat severity represents the absolute severity of the The Microsoft Defender ATP alert severity represents the severity of the detected behavior, the actual risk to the machine but more importantly the potential risk to the organization. So, for example: -- The severity of a Microsoft Defender ATP alert about a Windows Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage incurred. -- An alert about a commercial malware was detected while executing, but blocked and remediated by Windows Defender AV, is categorized as "Low" because it may have caused some damage to the individual machine but poses no organizational threat. -- An alert about malware detected while executing which can pose a threat not only to the individual machine but to the organization, regardless if it was eventually blocked, may be ranked as "Medium" or "High". -- Suspicious behavioral alerts which were not blocked or remediated will be ranked "Low", "Medium" or "High" following the same organizational threat considerations. +- The severity of a Microsoft Defender ATP alert about a Windows Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage incurred. +- An alert about a commercial malware was detected while executing, but blocked and remediated by Windows Defender AV, is categorized as "Low" because it may have caused some damage to the individual machine but poses no organizational threat. +- An alert about malware detected while executing which can pose a threat not only to the individual machine but to the organization, regardless if it was eventually blocked, may be ranked as "Medium" or "High". +- Suspicious behavioral alerts which were not blocked or remediated will be ranked "Low", "Medium" or "High" following the same organizational threat considerations. #### Understanding alert categories We've redefined the alert categories to align to the [enterprise attack tactics](https://attack.mitre.org/tactics/enterprise/) in the [MITRE ATT&CK matrix](https://attack.mitre.org/). New category names apply to all new alerts. Existing alerts will retain the previous category names. diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md b/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md index a3d83d4880..b4aec2ce09 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-microsoft-flow.md b/windows/security/threat-protection/microsoft-defender-atp/api-microsoft-flow.md new file mode 100644 index 0000000000..4af26a7805 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/api-microsoft-flow.md @@ -0,0 +1,81 @@ +--- +title: Microsoft Defender ATP Flow connector +ms.reviewer: +description: Microsoft Defender ATP Flow connector +keywords: flow, supported apis, api, Microsoft flow, query, automation +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Microsoft Defender ATP Flow connector + +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) + +Automating security procedures is a standard requirement for every modern Security Operations Center. The lack of professional Cyber defenders, forces SOC to work in the most efficient way and automation is a must. MS flow supports different connectors that were built exactly for that. You can build an end-to-end procedure automation within few minutes. + +Microsoft Defender API has an official Flow Connector with a lot of capabilities: + +![Image of edit credentials](images/api-flow-0.png) + +## Usage example + +The following example demonstrates how you can create a Flow that will be triggered any time a new Alert occurs on your tenant. + +- Login to [Microsoft Flow](https://flow.microsoft.com) + +- Go to: My flows > New > Automated + +![Image of edit credentials](images/api-flow-1.png) + +- Choose a name for your Flow, Search for **Microsoft Defender ATP Triggers** as the trigger and choose the new Alerts trigger. + +![Image of edit credentials](images/api-flow-2.png) + +- Now you have a Flow that is triggered every time a new Alert occurs. + +![Image of edit credentials](images/api-flow-3.png) + +All you need to do now, is to choose your next steps. +Lets, for example, Isolate the machine if the Severity of the Alert is **High** and mail about it. +The Alert trigger gives us only the Alert ID and the Machine ID. We can use the Connector to expand these entities. + +### Get the Alert entity using the connector + +- Choose Microsoft Defender ATP for new step. + +- Choose Alerts - Get single alert API. + +- Set the Alert Id from the last step as Input. + +![Image of edit credentials](images/api-flow-4.png) + +### Isolate the machine if the Alert's severity is High + +- Add **Condition** as a new step . + +- Check if Alert severity equals to **High**. + +- If yes, add Microsoft Defender ATP - Isolate machine action with the Machine Id and a comment. + +![Image of edit credentials](images/api-flow-5.png) + +Now you can add a new step for mailing about the Alert and the Isolation. +There are multiple Email connectors that are very easy to use, e.g. Outlook, GMail, etc.. +Save your flow and that's all. + +- You can also create **scheduled** flow that will run Advanced Hunting queries and much more! + +## Related topic +- [Microsoft Defender ATP APIs](apis-intro.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md b/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md index 4c97c07b2e..979340a3ca 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md @@ -1,7 +1,7 @@ --- -title: Microsoft Defender ATP alert API fields -description: Understand how the alert API fields map to the values in Microsoft Defender Security Center -keywords: alerts, alert fields, fields, api, fields, pull alerts, rest api, request, response +title: Microsoft Defender ATP detections API fields +description: Understand how the Detections API fields map to the values in Microsoft Defender Security Center +keywords: detections, detections fields, fields, api, fields, pull Detections, rest api, request, response search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -15,21 +15,24 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/16/2017 --- -# Microsoft Defender ATP SIEM alert API fields +# Microsoft Defender ATP detections API fields **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-apiportalmapping-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-apiportalmapping-abovefoldlink) -Understand what data fields are exposed as part of the alerts API and how they map to Microsoft Defender Security Center. +Understand what data fields are exposed as part of the detections API and how they map to Microsoft Defender Security Center. -## Alert API fields and portal mapping -The following table lists the available fields exposed in the alerts API payload. It shows examples for the populated values and a reference on how data is reflected on the portal. +>[!Note] +>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections +>- **Microsoft Defender ATP Detection** is composed from the suspicious event occurred on the Machine and its related **Alert** details. + +## Detections API fields and portal mapping +The following table lists the available fields exposed in the detections API payload. It shows examples for the populated values and a reference on how data is reflected on the portal. The ArcSight field column contains the default mapping between the Microsoft Defender ATP fields and the built-in fields in ArcSight. You can download the mapping file from the portal when you enable the SIEM integration feature and you can modify it to match the needs of your organization. For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md). @@ -39,33 +42,33 @@ Field numbers match the numbers in the images below. > > | Portal label | SIEM field name | ArcSight field | Example value | Description | > |------------------|---------------------------|---------------------|------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -> | 1 | AlertTitle | name | Windows Defender AV detected 'Mikatz' high-severity malware | Value available for every alert. | -> | 2 | Severity | deviceSeverity | High | Value available for every alert. | -> | 3 | Category | deviceEventCategory | Malware | Value available for every alert. | -> | 4 | Detection source | sourceServiceName | Antivirus | Windows Defender Antivirus or Microsoft Defender ATP. Value available for every alert. | -> | 5 | MachineName | sourceHostName | desktop-4a5ngd6 | Value available for every alert. | -> | 6 | FileName | fileName | Robocopy.exe | Available for alerts associated with a file or process. | -> | 7 | FilePath | filePath | C:\Windows\System32\Robocopy.exe | Available for alerts associated with a file or process. | -> | 8 | UserDomain | sourceNtDomain | CONTOSO | The domain of the user context running the activity, available for Microsoft Defender ATP behavioral based alerts. | -> | 9 | UserName | sourceUserName | liz.bean | The user context running the activity, available for Microsoft Defender ATP behavioral based alerts. | -> | 10 | Sha1 | fileHash | 3da065e07b990034e9db7842167f70b63aa5329 | Available for alerts associated with a file or process. | -> | 11 | Sha256 | deviceCustomString6 | ebf54f745dc81e1958f75e4ca91dd0ab989fc9787bb6b0bf993e2f5 | Available for Windows Defender AV alerts. | -> | 12 | Md5 | deviceCustomString5 | db979c04a99b96d370988325bb5a8b21 | Available for Windows Defender AV alerts. | -> | 13 | ThreatName | deviceCustomString1 | HackTool:Win32/Mikatz!dha | Available for Windows Defender AV alerts. | -> | 14 | IpAddress | sourceAddress | 218.90.204.141 | Available for alerts associated to network events. For example, 'Communication to a malicious network destination'. | -> | 15 | Url | requestUrl | down.esales360.cn | Available for alerts associated to network events. For example, 'Communication to a malicious network destination'. | -> | 16 | RemediationIsSuccess | deviceCustomNumber2 | TRUE | Available for Windows Defender AV alerts. ArcSight value is 1 when TRUE and 0 when FALSE. | -> | 17 | WasExecutingWhileDetected | deviceCustomNumber1 | FALSE | Available for Windows Defender AV alerts. ArcSight value is 1 when TRUE and 0 when FALSE. | -> | 18 | AlertId | externalId | 636210704265059241_673569822 | Value available for every alert. | -> | 19 | LinkToWDATP | flexString1 | `https://securitycenter.windows.com/alert/636210704265059241_673569822` | Value available for every alert. | -> | 20 | AlertTime | deviceReceiptTime | 2017-05-07T01:56:59.3191352Z | The time the activity relevant to the alert occurred. Value available for every alert. | -> | 21 | MachineDomain | sourceDnsDomain | contoso.com | Domain name not relevant for AAD joined machines. Value available for every alert. | +> | 1 | AlertTitle | name | Windows Defender AV detected 'Mikatz' high-severity malware | Value available for every Detection. | +> | 2 | Severity | deviceSeverity | High | Value available for every Detection. | +> | 3 | Category | deviceEventCategory | Malware | Value available for every Detection. | +> | 4 | Detection source | sourceServiceName | Antivirus | Windows Defender Antivirus or Microsoft Defender ATP. Value available for every Detection. | +> | 5 | MachineName | sourceHostName | desktop-4a5ngd6 | Value available for every Detection. | +> | 6 | FileName | fileName | Robocopy.exe | Available for detections associated with a file or process. | +> | 7 | FilePath | filePath | C:\Windows\System32\Robocopy.exe | Available for detections associated with a file or process. | +> | 8 | UserDomain | sourceNtDomain | CONTOSO | The domain of the user context running the activity, available for Microsoft Defender ATP behavioral based detections. | +> | 9 | UserName | sourceUserName | liz.bean | The user context running the activity, available for Microsoft Defender ATP behavioral based detections. | +> | 10 | Sha1 | fileHash | 3da065e07b990034e9db7842167f70b63aa5329 | Available for detections associated with a file or process. | +> | 11 | Sha256 | deviceCustomString6 | ebf54f745dc81e1958f75e4ca91dd0ab989fc9787bb6b0bf993e2f5 | Available for Windows Defender AV detections. | +> | 12 | Md5 | deviceCustomString5 | db979c04a99b96d370988325bb5a8b21 | Available for Windows Defender AV detections. | +> | 13 | ThreatName | deviceCustomString1 | HackTool:Win32/Mikatz!dha | Available for Windows Defender AV detections. | +> | 14 | IpAddress | sourceAddress | 218.90.204.141 | Available for detections associated to network events. For example, 'Communication to a malicious network destination'. | +> | 15 | Url | requestUrl | down.esales360.cn | Available for detections associated to network events. For example, 'Communication to a malicious network destination'. | +> | 16 | RemediationIsSuccess | deviceCustomNumber2 | TRUE | Available for Windows Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. | +> | 17 | WasExecutingWhileDetected | deviceCustomNumber1 | FALSE | Available for Windows Defender AV detections. ArcSight value is 1 when TRUE and 0 when FALSE. | +> | 18 | AlertId | externalId | 636210704265059241_673569822 | Value available for every Detection. | +> | 19 | LinkToWDATP | flexString1 | `https://securitycenter.windows.com/alert/636210704265059241_673569822` | Value available for every Detection. | +> | 20 | AlertTime | deviceReceiptTime | 2017-05-07T01:56:59.3191352Z | The time the event occurred. Value available for every Detection. | +> | 21 | MachineDomain | sourceDnsDomain | contoso.com | Domain name not relevant for AAD joined machines. Value available for every Detection. | > | 22 | Actor | deviceCustomString4 | BORON | Available for alerts related to a known actor group. | -> | 21+5 | ComputerDnsName | No mapping | liz-bean.contoso.com | The machine fully qualified domain name. Value available for every alert. | +> | 21+5 | ComputerDnsName | No mapping | liz-bean.contoso.com | The machine fully qualified domain name. Value available for every Detection. | > | | LogOnUsers | sourceUserId | contoso\liz-bean; contoso\jay-hardee | The domain and user of the interactive logon user/s at the time of the event. Note: For machines on Windows 10 version 1607, the domain information will not be available. | > | | InternalIPv4List | No mapping | 192.168.1.7, 10.1.14.1 | List of IPV4 internal IPs for active network interfaces. | > | | InternalIPv6List | No mapping | fd30:0000:0000:0001:ff4e:003e:0009:000e, FE80:CD00:0000:0CDE:1257:0000:211E:729C | List of IPV6 internal IPs for active network interfaces. | -> | Internal field | LastProcessedTimeUtc | No mapping | 2017-05-07T01:56:58.9936648Z | Time when event arrived at the backend. This field can be used when setting the request parameter for the range of time that alerts are retrieved. | +> | Internal field | LastProcessedTimeUtc | No mapping | 2017-05-07T01:56:58.9936648Z | Time when event arrived at the backend. This field can be used when setting the request parameter for the range of time that detections are retrieved. | > | | Not part of the schema | deviceVendor | | Static value in the ArcSight mapping - 'Microsoft'. | > | | Not part of the schema | deviceProduct | | Static value in the ArcSight mapping - 'Microsoft Defender ATP'. | > | | Not part of the schema | deviceVersion | | Static value in the ArcSight mapping - '2.0', used to identify the mapping versions. @@ -88,7 +91,7 @@ Field numbers match the numbers in the images below. ## Related topics - [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) -- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md) -- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md) -- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) +- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) +- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) +- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) - [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-user-token.md b/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md similarity index 50% rename from windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-user-token.md rename to windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md index 01dbb65739..4c582017dc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-user-token.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md @@ -1,14 +1,14 @@ --- -title: Advanced Hunting API +title: Microsoft Defender ATP APIs connection to Power BI ms.reviewer: -description: Use this API to run advanced queries -keywords: apis, supported apis, advanced hunting, query +description: Create custom reports using Power BI +keywords: apis, supported apis, Power BI, reports search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -17,24 +17,17 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Create custom reports using Power BI (user authentication) +# Create custom reports using Power BI -**Applies to:** +**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) -[!include[Prerelease information](prerelease.md)] +In this section you will learn create a Power BI report on top of Microsoft Defender ATP APIs. -Run advanced queries and show results in Microsoft Power BI. Please read about [Advanced Hunting API](run-advanced-query-api.md) before. +The first example demonstrates how to connect Power BI to Advanced Hunting API and the second example demonstrates a connection to our OData APIs (e.g. Machine Actions, Alerts, etc..) -In this section we share Power BI query sample to run a query using **user token**. - -If you want to use **application token** instead please refer to [this](run-advanced-query-sample-power-bi-app-token.md) tutorial. - -## Before you begin -You first need to [create an app](exposed-apis-create-app-nativeapp.md). - -## Run a query +## Connect Power BI to Advanced Hunting API - Open Microsoft Power BI @@ -46,18 +39,15 @@ You first need to [create an app](exposed-apis-create-app-nativeapp.md). ![Image of open advanced editor](images/power-bi-open-advanced-editor.png) -- Copy the below and paste it in the editor, after you update the values of Query +- Copy the below and paste it in the editor: - ``` +``` let + AdvancedHuntingQuery = "MiscEvents | where ActionType contains 'Anti'", - Query = "MachineInfo | where EventTime > ago(7d) | summarize EventCount=count(), LastSeen=max(EventTime) by MachineId", + HuntingUrl = "https://api.securitycenter.windows.com/api/advancedqueries", - FormattedQuery= Uri.EscapeDataString(Query), - - AdvancedHuntingUrl = "https://api.securitycenter.windows.com/api/advancedqueries?key=" & FormattedQuery, - - Response = Json.Document(Web.Contents(AdvancedHuntingUrl)), + Response = Json.Document(Web.Contents(HuntingUrl, [Query=[key=AdvancedHuntingQuery]])), TypeMap = #table( { "Type", "PowerBiType" }, @@ -88,12 +78,10 @@ You first need to [create an app](exposed-apis-create-app-nativeapp.md). in Table - ``` +``` - Click **Done** - ![Image of create advanced query](images/power-bi-create-advanced-query.png) - - Click **Edit Credentials** ![Image of edit credentials](images/power-bi-edit-credentials.png) @@ -108,13 +96,32 @@ You first need to [create an app](exposed-apis-create-app-nativeapp.md). ![Image of set credentials](images/power-bi-set-credentials-organizational-cont.png) -- View the results of your query +- Now the results of your query will appear as table and you can start build visualizations on top of it! - ![Image of query results](images/power-bi-query-results.png) +- You can duplicate this table, rename it and edit the Advanced Hunting query inside to get any data you would like. + +## Connect Power BI to OData APIs + +- The only difference from the above example is the query inside the editor. + +- Copy the below and paste it in the editor to pull all **Machine Actions** from your organization: + +``` + let + + Query = "MachineActions", + + Source = OData.Feed("https://api.securitycenter.windows.com/api/" & Query, null, [Implementation="2.0", MoreColumns=true]) + in + Source + +``` + +- You can do the same for **Alerts** and **Machines**. + +- You also can use OData queries for queries filters, see [Using OData Queries](exposed-apis-odata-samples.md) ## Related topic -- [Create custom Power BI reports with app authentication](run-advanced-query-sample-power-bi-app-token.md) - [Microsoft Defender ATP APIs](apis-intro.md) - [Advanced Hunting API](run-advanced-query-api.md) -- [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) -- [Schedule Advanced Hunting](run-advanced-query-sample-ms-flow.md) +- [Using OData Queries](exposed-apis-odata-samples.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-terms-of-use.md b/windows/security/threat-protection/microsoft-defender-atp/api-terms-of-use.md index 122b141332..e526a20669 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-terms-of-use.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-terms-of-use.md @@ -22,6 +22,12 @@ ms.topic: article Microsoft Defender ATP APIs are governed by [Microsoft API License and Terms of use](https://docs.microsoft.com/legal/microsoft-apis/terms-of-use). +### Throttling limits + +Name | Calls | Renewal period +:---|:---|:--- +API calls per connection | 100 | 60 seconds + ## Legal Notices diff --git a/windows/security/threat-protection/microsoft-defender-atp/apis-intro.md b/windows/security/threat-protection/microsoft-defender-atp/apis-intro.md index e97f64fda4..84db47e022 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/apis-intro.md +++ b/windows/security/threat-protection/microsoft-defender-atp/apis-intro.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -22,7 +22,7 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) Microsoft Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Microsoft Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-code). diff --git a/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access.md b/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access.md index f7afee3646..0924219800 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access.md +++ b/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access.md @@ -25,7 +25,7 @@ ms.date: 11/28/2018 - Office 365 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-assignaccess-abovefoldlink) Microsoft Defender ATP supports two ways to manage permissions: diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-simulations.md b/windows/security/threat-protection/microsoft-defender-atp/attack-simulations.md index ad94b7494d..f39d0ddd2f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-simulations.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-simulations.md @@ -24,7 +24,7 @@ ms.date: 11/20/2018 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-abovefoldlink) >[!TIP] >- Learn about the latest enhancements in Microsoft Defender ATP: [What's new in Microsoft Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/). @@ -58,7 +58,7 @@ Read the walkthrough document provided with each attack scenario. Each document > Simulation files or scripts mimic attack activity but are actually benign and will not harm or compromise the test machine. > > -> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-belowfoldlink) +> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-belowfoldlink) ## Related topics diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-rules-in-windows-10-enterprise-e3.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-rules-in-windows-10-enterprise-e3.md similarity index 100% rename from windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-rules-in-windows-10-enterprise-e3.md rename to windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction-rules-in-windows-10-enterprise-e3.md diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md similarity index 80% rename from windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md rename to windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index e78eb77ef5..311f6803b0 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 05/07/2019 @@ -16,32 +17,28 @@ ms.reviewer: manager: dansimp --- -# Reduce attack surfaces with attack surface reduction rules +# Reduce attack surfaces with attack surface reduction rules **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +> [!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - - -Attack surface reduction rules help prevent behaviors malware often uses to infect computers with malicious code. You can set attack surface reduction rules for computers running Windows 10, versions 1709 and 1803 or later, Windows Server, version 1803 (Semi-Annual Channel) or later, or Windows Server 2019. - +Attack surface reduction rules help prevent behaviors malware often uses to infect computers with malicious code. You can set attack surface reduction rules for computers running Windows 10, versions 1709 and 1803 or later, Windows Server, version 1803 (Semi-Annual Channel) or later, or Windows Server 2019. To use attack surface reduction rules, you need a Windows 10 Enterprise license. If you have a Windows E5 license, it gives you the advanced management capabilities to power them. These include monitoring, analytics, and workflows available in [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), as well as reporting and configuration capabilities in the Microsoft 365 Security Center. These advanced capabilities aren't available with an E3 license or with Windows 10 Enterprise without subscription, but you can use attack surface reduction rule events in Event Viewer to help facilitate deployment. - Attack surface reduction rules target behaviors that malware and malicious apps typically use to infect computers, including: -- Executable files and scripts used in Office apps or web mail that attempt to download or run files -- Obfuscated or otherwise suspicious scripts -- Behaviors that apps don't usually initiate during normal day-to-day work +* Executable files and scripts used in Office apps or web mail that attempt to download or run files +* Obfuscated or otherwise suspicious scripts +* Behaviors that apps don't usually initiate during normal day-to-day work -You can use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how attack surface reduction rules would impact your organization if they were enabled. It's best to run all rules in audit mode first so you can understand their impact on your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they may perform tasks similar to malware. By monitoring audit data and [adding exclusions](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without impacting productivity. +You can use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would impact your organization if they were enabled. It's best to run all rules in audit mode first so you can understand their impact on your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they may perform tasks similar to malware. By monitoring audit data and [adding exclusions](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without impacting productivity. -Triggered rules display a notification on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. The notification also displays in the Microsoft Defender Security Center and in the Microsoft 365 securty center. +Triggered rules display a notification on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. The notification also displays in the Microsoft Defender Security Center and in the Microsoft 365 securty center. For information about configuring attack surface reduction rules, see [Enable attack surface reduction rules](enable-attack-surface-reduction.md). @@ -49,11 +46,11 @@ For information about configuring attack surface reduction rules, see [Enable at Microsoft Defender ATP provides detailed reporting into events and blocks as part of its alert investigation scenarios. -You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender-exploit-guard.md), you can use Advanced hunting to see how controlled folder access settings could affect your environment. +You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use Advanced hunting to see how controlled folder access settings could affect your environment. -Here is an example query: +Here is an example query: -``` +```PowerShell MiscEvents | where ActionType startswith 'Asr' ``` @@ -62,13 +59,13 @@ MiscEvents You can review the Windows event log to view events that are created when attack surface reduction rules fire: -1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the file *cfa-events.xml* to an easily accessible location on the machine. +1. Download the [Evaluation Package](https://aka.ms/mp7z2w) and extract the file *cfa-events.xml* to an easily accessible location on the machine. 2. Type **Event Viewer** in the Start menu to open the Windows Event Viewer. 3. Click **Import custom view...** on the left panel, under **Actions**. - -4. Select the file *cfa-events.xml* from where it was extracted. Alternatively, [copy the XML directly](event-views-exploit-guard.md). + +4. Select the file *cfa-events.xml* from where it was extracted. Alternatively, [copy the XML directly](event-views.md). 5. Click **OK**. @@ -82,13 +79,12 @@ Event ID | Description The "engine version" of attack surface reduction events in the event log, is generated by Microsoft Defender ATP, not the operating system. Microsoft Defender ATP is integrated with Windows 10, so this feature works on all machines with Windows 10 installed. - ## Attack surface reduction rules The following sections describe each of the 15 attack surface reduction rules. This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use System Center Configuration Manager or Microsoft Intune, you do not need the GUIDs: -Rule name | GUID | File & folder exclusions --|-|- + Rule name | GUID | File & folder exclusions +-----------|------|-------------------------- Block executable content from email client and webmail | BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 | Supported Block all Office applications from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A | Supported Block Office applications from creating executable content | 3B576869-A4EC-4529-8536-B80A7769E899 | Supported @@ -111,8 +107,8 @@ Each rule description indicates which apps or file types the rule applies to. In This rule blocks the following file types from launching from email in Microsoft Outlook or Outlook.com and other popular webmail providers: -- Executable files (such as .exe, .dll, or .scr) -- Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) +* Executable files (such as .exe, .dll, or .scr) +* Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 @@ -138,7 +134,7 @@ GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A ### Block Office applications from creating executable content -This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating executable content. +This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating executable content. This rule targets a typical behavior where malware uses Office as a vector to break out of Office and save malicious components to disk, where they persist and survive a computer reboot. This rule prevents malicious code from being written to disk. @@ -154,7 +150,7 @@ GUID: 3B576869-A4EC-4529-8536-B80A7769E899 Attackers might attempt to use Office apps to migrate malicious code into other processes through code injection, so the code can masquerade as a clean process. This rule blocks code injection attempts from Office apps into other processes. There are no known legitimate business purposes for using code injection. -This rule applies to Word, Excel, and PowerPoint. +This rule applies to Word, Excel, and PowerPoint. This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 @@ -166,12 +162,12 @@ GUID: 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 ### Block JavaScript or VBScript from launching downloaded executable content -Malware often uses JavaScript and VBScript scripts to launch other malicious apps. +Malware often uses JavaScript and VBScript scripts to launch other malicious apps. -Malware written in JavaScript or VBS often acts as a downloader to fetch and launch additional native payload from the Internet. This rule prevents scripts from launching downloaded content, helping to prevent malicious use of the scripts to spread malware and infect machines. This isn't a common line-of-business use, but line-of-business applications sometimes use scripts to download and launch installers. +Malware written in JavaScript or VBS often acts as a downloader to fetch and launch additional native payload from the Internet. This rule prevents scripts from launching downloaded content, helping to prevent malicious use of the scripts to spread malware and infect machines. This isn't a common line-of-business use, but line-of-business applications sometimes use scripts to download and launch installers. ->[!IMPORTANT] ->File and folder exclusions don't apply to this attack surface reduction rule. +> [!IMPORTANT] +> File and folder exclusions don't apply to this attack surface reduction rule. This rule was introduced in: Windows 10 1709, Windows Server 1809, Windows Server 2019, SCCM CB 1710 @@ -206,16 +202,16 @@ SCCM name: Block Win32 API calls from Office macros GUID: 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B ### Block executable files from running unless they meet a prevalence, age, or trusted list criterion - + This rule blocks the following file types from launching unless they either meet prevalence or age criteria, or they're in a trusted list or exclusion list: - -- Executable files (such as .exe, .dll, or .scr) ->[!NOTE] ->You must [enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus) to use this rule. +* Executable files (such as .exe, .dll, or .scr) ->[!IMPORTANT] ->The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 is owned by Microsoft and is not specified by admins. It uses cloud-delivered protection to update its trusted list regularly. +> [!NOTE] +> You must [enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus) to use this rule. + +> [!IMPORTANT] +> The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 is owned by Microsoft and is not specified by admins. It uses cloud-delivered protection to update its trusted list regularly. > >You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to. @@ -226,13 +222,13 @@ Intune name: Executables that don't meet a prevalence, age, or trusted list crit SCCM name: Block executable files from running unless they meet a prevalence, age, or trusted list criteria GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25 - + ### Use advanced protection against ransomware - + This rule provides an extra layer of protection against ransomware. It scans executable files entering the system to determine whether they're trustworthy. If the files closely resemble ransomware, this rule blocks them from running, unless they're in a trusted list or exclusion list. ->[!NOTE] ->You must [enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus) to use this rule. +> [!NOTE] +> You must [enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus) to use this rule. This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 @@ -241,14 +237,14 @@ Intune name: Advanced ransomware protection SCCM name: Use advanced protection against ransomware GUID: c1db55ab-c21a-4637-bb3f-a12568109d35 - + ### Block credential stealing from the Windows local security authority subsystem (lsass.exe) - + Local Security Authority Subsystem Service (LSASS) authenticates users who log in to a Windows computer. Microsoft Defender Credential Guard in Windows 10 normally prevents attempts to extract credentials from LSASS. However, some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. This rule helps mitigate that risk by locking down LSASS. - >[!NOTE] - >In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that overly enumerates LSASS, you need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat. - +> [!NOTE] +> In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that overly enumerates LSASS, you need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat. + This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 Intune name: Flag credential stealing from the Windows local security authority subsystem @@ -261,26 +257,26 @@ GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 This rule blocks processes through PsExec and WMI commands from running, to prevent remote code execution that can spread malware attacks. ->[!IMPORTANT] ->File and folder exclusions do not apply to this attack surface reduction rule. +> [!IMPORTANT] +> File and folder exclusions do not apply to this attack surface reduction rule. ->[!WARNING] ->Only use this rule if you're managing your devices with [Intune](https://docs.microsoft.com/intune) or another MDM solution. This rule is incompatible with management through [System Center Configuration Manager](https://docs.microsoft.com/sccm) because this rule blocks WMI commands the SCCM client uses to function correctly. +> [!WARNING] +> Only use this rule if you're managing your devices with [Intune](https://docs.microsoft.com/intune) or another MDM solution. This rule is incompatible with management through [System Center Configuration Manager](https://docs.microsoft.com/sccm) because this rule blocks WMI commands the SCCM client uses to function correctly. -This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 +This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019 Intune name: Process creation from PSExec and WMI commands SCCM name: Not applicable GUID: d1e49aac-8f56-4280-b9ba-993a6d77406c - + ### Block untrusted and unsigned processes that run from USB - + With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards. Blocked file types include: - -- Executable files (such as .exe, .dll, or .scr) -- Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) + +* Executable files (such as .exe, .dll, or .scr) +* Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) This rule was introduced in: Windows 10 1803, Windows Server 1809, Windows Server 2019, SCCM CB 1802 @@ -294,10 +290,10 @@ GUID: b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 This rule prevents Outlook from creating child processes. It protects against social engineering attacks and prevents exploit code from abusing a vulnerability in Outlook. To achieve this, the rule prevents the launch of additional payload while still allowing legitimate Outlook functions. It also protects against [Outlook rules and forms exploits](https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/) that attackers can use when a user's credentials are compromised. ->[!NOTE] ->This rule applies to Outlook and Outlook.com only. +> [!NOTE] +> This rule applies to Outlook and Outlook.com only. -This rule was introduced in: Windows 10 1809, Windows Server 1809, Windows Server 2019, SCCM CB 1810 +This rule was introduced in: Windows 10 1809, Windows Server 1809, Windows Server 2019 Intune name: Process creation from Office communication products (beta) @@ -307,19 +303,21 @@ GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869 ### Block Adobe Reader from creating child processes -Through social engineering or exploits, malware can download and launch additional payloads and break out of Adobe Reader. This rule prevents attacks like this by blocking Adobe Reader from creating additional processes. +Through social engineering or exploits, malware can download and launch additional payloads and break out of Adobe Reader. This rule prevents attacks like this by blocking Adobe Reader from creating additional processes. -This rule was introduced in: Windows 10 1809, Windows Server 1809, Windows Server 2019, SCCM CB 1810 +This rule was introduced in: Windows 10 1809, Windows Server 1809, Windows Server 2019 Intune name: Process creation from Adobe Reader (beta) -SCCM name: Not applicable +SCCM name: Not yet available GUID: 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c ### Block persistence through WMI event subscription -Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden. With this rule, admins can prevent threats that abuse WMI to persist and stay hidden in WMI repository. +Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden. With this rule, admins can prevent threats that abuse WMI to persist and stay hidden in WMI repository. + +This rule was introduced in: Windows 10 1903, Windows Server 1903 Intune name: Block persistence through WMI event subscription @@ -329,7 +327,6 @@ GUID: e6db77e5-3df2-4cf1-b95a-636979351e5b ## Related topics -- [Enable attack surface reduction rules](enable-attack-surface-reduction.md) -- [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) -- [Compatibility of Microsoft Defender with other antivirus/antimalware](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility) - +* [Enable attack surface reduction rules](enable-attack-surface-reduction.md) +* [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) +* [Compatibility of Microsoft Defender with other antivirus/antimalware](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md b/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender.md similarity index 65% rename from windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md rename to windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender.md index dd9c960c79..cb5f42efe4 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/audit-windows-defender.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 04/02/2019 @@ -16,12 +17,11 @@ ms.reviewer: manager: dansimp --- - -# Use audit mode +# Use audit mode **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) You can enable attack surface reduction rules, exploit protection, network protection, and controlled folder access in audit mode. This lets you see a record of what *would* have happened if you had enabled the feature. @@ -33,25 +33,23 @@ To find the audited entries, go to **Applications and Services** > **Microsoft** You can use Windows Defender Advanced Threat Protection to get greater details for each event, especially for investigating attack surface reduction rules. Using the Microsoft Defender ATP console lets you [investigate issues as part of the alert timeline and investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). -This topic provides links that describe how to enable the audit functionality for each feature and how to view events in the Windows Event Viewer. +This topic provides links that describe how to enable the audit functionality for each feature and how to view events in the Windows Event Viewer. You can use Group Policy, PowerShell, and configuration service providers (CSPs) to enable audit mode. >[!TIP] >You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work. - -|Audit options | How to enable audit mode | How to view events | -|- | - | - | -|Audit applies to all events | [Enable controlled folder access](enable-controlled-folders-exploit-guard.md) | [Controlled folder access events](evaluate-controlled-folder-access.md#review-controlled-folder-access-events-in-windows-event-viewer) | -|Audit applies to individual rules | [Enable attack surface reduction rules](enable-attack-surface-reduction.md) | [Attack surface reduction rule events](evaluate-attack-surface-reduction.md#review-attack-surface-reduction-events-in-windows-event-viewer) | -|Audit applies to all events | [Enable network protection](enable-network-protection.md) | [Network protection events](evaluate-network-protection.md#review-network-protection-events-in-windows-event-viewer) | -|Audit applies to individual mitigations | [Enable exploit protection](enable-exploit-protection.md) | [Exploit protection events](exploit-protection-exploit-guard.md#review-exploit-protection-events-in-windows-event-viewer) | - + Audit options | How to enable audit mode | How to view events +-|-|- +Audit applies to all events | [Enable controlled folder access](enable-controlled-folders.md) | [Controlled folder access events](evaluate-controlled-folder-access.md#review-controlled-folder-access-events-in-windows-event-viewer) +Audit applies to individual rules | [Enable attack surface reduction rules](enable-attack-surface-reduction.md) | [Attack surface reduction rule events](evaluate-attack-surface-reduction.md#review-attack-surface-reduction-events-in-windows-event-viewer) +Audit applies to all events | [Enable network protection](enable-network-protection.md) | [Network protection events](evaluate-network-protection.md#review-network-protection-events-in-windows-event-viewer) +|Audit applies to individual mitigations | [Enable exploit protection](enable-exploit-protection.md) | [Exploit protection events](exploit-protection.md#review-exploit-protection-events-in-windows-event-viewer) ## Related topics -- [Protect devices from exploits](exploit-protection-exploit-guard.md) -- [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction-exploit-guard.md) -- [Protect your network](network-protection-exploit-guard.md) -- [Protect important folders](controlled-folders-exploit-guard.md) +* [Protect devices from exploits](exploit-protection.md) +* [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction.md) +* [Protect your network](network-protection.md) +* [Protect important folders](controlled-folders.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md b/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md index 7e77ed48e3..0d2841c46b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md +++ b/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md @@ -19,7 +19,7 @@ ms.topic: conceptual # Overview of Automated investigations ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink) The Microsoft Defender ATP service has a wide breadth of visibility on multiple machines. With this kind of optics, the service generates a multitude of alerts. The volume of alerts generated can be challenging for a typical security operations team to individually address. @@ -40,7 +40,7 @@ Entities are the starting point for Automated investigations. When an alert cont >- Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/en-us/help/4493464/windows-10-update-kb4493464)) or later >- Later versions of Windows 10 -The alerts start by analyzing the supported entities from the alert and also runs a generic machine playbook to see if there is anything else suspicious on that machine. The outcome and details from the investigation is seen in the Automated investigation view. +The Automated investigation starts by analyzing the supported entities from the alert and also runs a generic machine playbook to see if there is anything else suspicious on that machine. The outcome and details from the investigation is seen in the Automated investigation view. ### Details of an Automated investigation @@ -85,4 +85,4 @@ The default machine group is configured for semi-automatic remediation. This mea When a pending action is approved, the entity is then remediated and this new state is reflected in the **Entities** tab of the investigation. ## Related topic -- [Learn about the automated investigations dashboard](manage-auto-investigation.md) \ No newline at end of file +- [Learn about the automated investigations dashboard](manage-auto-investigation.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md b/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md index 861f47388c..6cad0006a9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md +++ b/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md @@ -23,7 +23,7 @@ ms.topic: article - Azure Active Directory - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-basicaccess-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-basicaccess-abovefoldlink) Refer to the instructions below to use basic permissions management. diff --git a/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status.md b/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status.md index 8057947dc2..6fcd846c60 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status.md +++ b/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status.md @@ -23,7 +23,7 @@ ms.date: 04/24/2018 **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-checksensor-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-checksensor-abovefoldlink) The sensor health tile is found on the Security Operations dashboard. This tile provides information on the individual machine’s ability to provide sensor data and communicate with the Microsoft Defender ATP service. It reports how many machines require attention and helps you identify problematic machines and take action to correct known issues. diff --git a/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md b/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md index dfff630e9d..7adc0c6ece 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/commercial-gov.md @@ -71,6 +71,10 @@ The following capabilities are not currently available: - Integration with third-party products +## Email notifications +Not currently available. + + ## Integrations Integrations with the following Microsoft products are not currently available: - Azure Security Center diff --git a/windows/security/threat-protection/microsoft-defender-atp/conditional-access.md b/windows/security/threat-protection/microsoft-defender-atp/conditional-access.md index 396e2730fb..eb36f604f9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/conditional-access.md +++ b/windows/security/threat-protection/microsoft-defender-atp/conditional-access.md @@ -24,7 +24,7 @@ ms.topic: article ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-abovefoldlink) Conditional Access is a capability that helps you better protect your users and enterprise information by making sure that only secure devices have access to applications. diff --git a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md index 1eadc36802..f6f11da946 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md @@ -22,7 +22,7 @@ ms.date: 04/11/2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) >[!NOTE] -> Secure score is now part of Threat & Vulnerability Management as Configuration score. The secure score page will be available for a few weeks. View the [Secure score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score) page. +> Secure score is now part of Threat & Vulnerability Management as Configuration score. The secure score page will be available for a few weeks. The Microsoft Defender Advanced Threat Protection Configuration score gives you visibility and control over the security posture of your organization based on security best practices. High configuration score means your endpoints are more resilient from cybersecurity threat attacks. @@ -34,6 +34,8 @@ Your configuration score widget shows the collective security configuration stat - Security controls ## How it works +>[!NOTE] +> Configuration score currently supports configurations set via Group Policy. Due to the current partial Intune support, configurations which might have been set through Intune might show up as misconfigured. Contact your IT Administrator to verify the actual configuration status in case your organization is using Intune for secure configuration management. The data in the configuration score widget is the product of meticulous and ongoing vulnerability discovery process aggregated with configuration discovery assessments that continuously: - Compare collected configurations to the collected benchmarks to discover misconfigured assets diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md index 0911a2d722..9356c13eb8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md b/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md index 22c9359f44..65f1d888f8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight.md @@ -1,6 +1,6 @@ --- -title: Configure HP ArcSight to pull Microsoft Defender ATP alerts -description: Configure HP ArcSight to receive and pull alerts from Microsoft Defender Security Center +title: Configure HP ArcSight to pull Microsoft Defender ATP detections +description: Configure HP ArcSight to receive and pull detections from Microsoft Defender Security Center keywords: configure hp arcsight, security information and events management tools, arcsight search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -15,10 +15,9 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/20/2018 --- -# Configure HP ArcSight to pull Microsoft Defender ATP alerts +# Configure HP ArcSight to pull Microsoft Defender ATP detections **Applies to:** @@ -27,12 +26,16 @@ ms.date: 12/20/2018 ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configurearcsight-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configurearcsight-abovefoldlink) -You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Microsoft Defender ATP alerts. +You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Microsoft Defender ATP detections. + +>[!Note] +>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections +>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. ## Before you begin -Configuring the HP ArcSight Connector tool requires several configuration files for it to pull and parse alerts from your Azure Active Directory (AAD) application. +Configuring the HP ArcSight Connector tool requires several configuration files for it to pull and parse detections from your Azure Active Directory (AAD) application. This section guides you in getting the necessary information to set and use the required configuration files correctly. @@ -163,7 +166,7 @@ The following steps assume that you have completed all the required steps in [Be You can now run queries in the HP ArcSight console. -Microsoft Defender ATP alerts will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name. +Microsoft Defender ATP detections will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name. ## Troubleshooting HP ArcSight connection @@ -187,6 +190,6 @@ Microsoft Defender ATP alerts will appear as discrete events, with "Microsoft” ## Related topics - [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) -- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md) -- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) +- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) +- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) - [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md index 0d8f88aa59..d0dfe6add3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction.md @@ -1,15 +1,14 @@ --- -title: -ms.reviewer: -description: -keywords: +title: Configure attack surface reduction +description: Configure attack surface reduction +keywords: asr, attack surface reduction, windows defender, microsoft defender, antivirus, av search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -23,22 +22,21 @@ ms.date: 07/01/2018 You can configure attack surface reduction with a number of tools, including: -- Microsoft Intune -- System Center Configuration Manager -- Group Policy -- PowerShell cmdlets - +* Microsoft Intune +* System Center Configuration Manager +* Group Policy +* PowerShell cmdlets The topics in this section describe how to configure attack surface reduction. Each topic includes instructions for the applicable configuration tool (or tools). ## In this section + Topic | Description -:---|:--- +-|- [Enable hardware-based isolation for Microsoft Edge](../windows-defender-application-guard/install-wd-app-guard.md) | How to preprare for and install Application Guard, including hardware and softeware requirements [Enable application control](../windows-defender-application-control/windows-defender-application-control.md)|How to control applications run by users and potect kernel mode processes -[Exploit protection](../windows-defender-exploit-guard/enable-exploit-protection.md)|How to automatically apply exploit mitigation techniques on both operating system processes and on individual apps -[Network protection](../windows-defender-exploit-guard/enable-network-protection.md)|How to prevent users from using any apps to acces dangerous domains -[Controlled folder access](../windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md)|How to protect valuable data from malicious apps -[Attack surface reduction](../windows-defender-exploit-guard/enable-attack-surface-reduction.md)|How to prevent actions and apps that are typically used for by exploit-seeking malware +[Exploit protection](./enable-exploit-protection.md)|How to automatically apply exploit mitigation techniques on both operating system processes and on individual apps +[Network protection](./enable-network-protection.md)|How to prevent users from using any apps to acces dangerous domains +[Controlled folder access](./enable-controlled-folders.md)|How to protect valuable data from malicious apps +[Attack surface reduction](./enable-attack-surface-reduction.md)|How to prevent actions and apps that are typically used for by exploit-seeking malware [Network firewall](../windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md)|How to protect devices and data across a network - diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md b/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md index 3c3fa5ffff..97cc98af49 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access.md @@ -104,4 +104,4 @@ Take the following steps to enable Conditional Access: For more information, see [Enable Microsoft Defender ATP with Conditional Access in Intune](https://docs.microsoft.com/intune/advanced-threat-protection). ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-belowfoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md b/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md index a381b9ef5a..e0e025ebc9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications.md @@ -23,7 +23,7 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-emailconfig-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-emailconfig-abovefoldlink) You can configure Microsoft Defender ATP to send email notifications to specified recipients for new alerts. This feature enables you to identify a group of individuals who will immediately be informed and can act on alerts based on their severity. diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md index 5e84c75371..914b140411 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp.md @@ -29,12 +29,14 @@ ms.date: 04/24/2018 ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsgp-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsgp-abovefoldlink) > [!NOTE] > To use Group Policy (GP) updates to deploy the package, you must be on Windows Server 2008 R2 or later. +> For Windows Server 2019, you may need to replace NT AUTHORITY\Well-Known-System-Account with NT AUTHORITY\SYSTEM of the XML file that the Group Policy preference creates. + ## Onboard machines using Group Policy 1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Microsoft Defender Security Center](https://securitycenter.windows.com/): diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md index 88aa16e2cf..9710f0d825 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm.md @@ -25,7 +25,7 @@ ms.date: 12/06/2018 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink) You can use mobile device management (MDM) solutions to configure machines. Microsoft Defender ATP supports MDMs by providing OMA-URIs to create policies to manage machines. diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md index 8be4bddd06..b5ebde69de 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows.md @@ -24,7 +24,7 @@ ms.topic: article - Linux - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-nonwindows-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-nonwindows-abovefoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md index f1e4b4412d..ab167bc4fd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md @@ -28,7 +28,7 @@ ms.date: 12/11/2018 ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointssccm-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointssccm-abovefoldlink) ## Onboard Windows 10 machines using System Center Configuration Manager (current branch) version 1606 @@ -36,6 +36,8 @@ System Center Configuration Manager (SCCM) (current branch) version 1606, has UI >[!NOTE] > If you’re using SCCM client version 1606 with server version 1610 or above, you must upgrade the client version to match the server version. +> Starting with version 1606 of Configuration Manager, see [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/sccm/protect/deploy-use/windows-defender-advanced-threat-protection) for ATP configuration. + ## Onboard Windows 10 machines using System Center Configuration Manager earlier versions diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md index d326a4194b..6c658e6d81 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script.md @@ -27,7 +27,7 @@ ms.topic: article ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) You can also manually onboard individual machines to Microsoft Defender ATP. You might want to do this first when testing the service before you commit to onboarding all machines in your network. diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md index 9bcaf00305..19a1f29ebd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi.md @@ -25,7 +25,7 @@ ms.date: 04/24/2018 ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configvdi-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configvdi-abovefoldlink) ## Onboard non-persistent virtual desktop infrastructure (VDI) machines diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints.md index 3387e07476..f7fccc3f2b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints.md @@ -45,4 +45,4 @@ Topic | Description [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md) | Learn how to use the configuration package to configure VDI machines. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpoints-belowfoldlink) \ No newline at end of file +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpoints-belowfoldlink) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md index 785daef982..69c4df40de 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr.md @@ -20,34 +20,36 @@ ms.topic: article # Optimize ASR rule deployment and detections **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[Attack surface reduction (ASR) rules](../windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) identify and prevent actions that are typically taken by malware during exploitation. These rules control when and how potentially malicious code can run. For example, you can prevent JavaScript or VBScript from launching a downloaded executable, block Win32 API calls from Office macros, or block processes that run from USB drives. +> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) + +[Attack surface reduction (ASR) rules](./attack-surface-reduction.md) identify and prevent actions that are typically taken by malware during exploitation. These rules control when and how potentially malicious code can run. For example, you can prevent JavaScript or VBScript from launching a downloaded executable, block Win32 API calls from Office macros, or block processes that run from USB drives. ![Attack surface management card](images/secconmgmt_asr_card.png)
                        *Attack surface management card* The **Attack surface management** card is an entry point to tools in Microsoft 365 security center that you can use to: -- Understand how ASR rules are currently deployed in your organization -- Review ASR detections and identify possible incorrect detections -- Analyze the impact of exclusions and generate the list of file paths to exclude +* Understand how ASR rules are currently deployed in your organization +* Review ASR detections and identify possible incorrect detections +* Analyze the impact of exclusions and generate the list of file paths to exclude Selecting **Go to attack surface management** takes you to **Monitoring & reports > Attack surface reduction rules > Add exclusions**. From there, you can navigate to other sections of Microsoft 365 security center. ![Add exclusions tab in the Attack surface reduction rules page in Microsoft 365 security center](images/secconmgmt_asr_m365exlusions.png)
                        *Add exclusions tab in the Attack surface reduction rules page in Microsoft 365 security center* ->[!NOTE] ->To access Microsoft 365 security center, you need a Microsoft 365 E3 or E5 license and an account that has certain roles on Azure Active Directory. [Read more about required licenses and permissions](https://docs.microsoft.com/office365/securitycompliance/microsoft-security-and-compliance#required-licenses-and-permissions) +> [!NOTE] +> To access Microsoft 365 security center, you need a Microsoft 365 E3 or E5 license and an account that has certain roles on Azure Active Directory. [Read more about required licenses and permissions](https://docs.microsoft.com/office365/securitycompliance/microsoft-security-and-compliance#required-licenses-and-permissions) -For more information about optimizing ASR rule deployment in Microsoft 365 security center, read [Monitor and manage ASR rule deployment and detections](https://docs.microsoft.com/office365/securitycompliance/monitor-devices#monitor-and-manage-asr-rule-deployment-and-detections) +For more information about optimizing ASR rule deployment in Microsoft 365 security center, read [Monitor and manage ASR rule deployment and detections](https://docs.microsoft.com/office365/securitycompliance/monitor-devices#monitor-and-manage-asr-rule-deployment-and-detections) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) +> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) # Related topics -- [Ensure your machines are configured properly](configure-machines.md) -- [Get machines onboarded to Microsoft Defender ATP](configure-machines-onboarding.md) -- [Increase compliance to the Microsoft Defender ATP security baseline](configure-machines-security-baseline.md) \ No newline at end of file + +* [Ensure your machines are configured properly](configure-machines.md) +* [Get machines onboarded to Microsoft Defender ATP](configure-machines-onboarding.md) +* [Increase compliance to the Microsoft Defender ATP security baseline](configure-machines-security-baseline.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md index 4640790859..bd168aac8b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-onboarding.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) Each onboarded machine adds an additional endpoint detection and response (EDR) sensor and increases visibility over breach activity in your network. Onboarding also ensures that a machine can be checked for vulnerable components as well security configuration issues and can receive critical remediation actions during attacks. @@ -44,32 +44,22 @@ The **Onboarding** card provides a high-level overview of your onboarding rate b Microsoft Defender ATP provides several convenient options for [onboarding Windows 10 machines](onboard-configure.md). For Intune-managed machines, however, you can leverage Intune profiles to conveniently deploy the Microsoft Defender ATP sensor to select machines, effectively onboarding these devices to the service. -From the **Onboarding** card, select **Onboard more machines** to create and assign a profile on Intune. The link takes you to a similar overview of your onboarding state. +From the **Onboarding** card, select **Onboard more machines** to create and assign a profile on Intune. The link takes you to the device compliance page on Intune, which provides a similar overview of your onboarding state. + +![Microsoft Defender ATP device compliance page on Intune device management](images/secconmgmt_onboarding_1deviceconfprofile.png)
                        + *Microsoft Defender ATP device compliance page on Intune device management* >[!TIP] >Alternatively, you can navigate to the Microsoft Defender ATP onboarding compliance page in the [Microsoft Azure portal](https://portal.azure.com/) from **All services > Intune > Device compliance > Microsoft Defender ATP**. -From the overview, create a configuration profile specifically for the deployment of the Microsoft Defender ATP sensor and assign that profile to the machines you want to onboard. +From the device compliance page, create a configuration profile specifically for the deployment of the Microsoft Defender ATP sensor and assign that profile to the machines you want to onboard. To do this, you can either: -1. Select **Create a device configuration profile to configure ATP sensor**. +- Select **Create a device configuration profile to configure ATP sensor** to start with a predefined device configuration profile. +- Create the device configuration profile from scratch. - ![Microsoft Defender ATP device compliance page on Intune device management](images/secconmgmt_onboarding_1deviceconfprofile.png)
                        - *Microsoft Defender ATP device compliance page on Intune device management* +For more information, [read about using Intune device configuration profiles to onboard machines to Microsoft Defender ATP](https://docs.microsoft.com/en-us/intune/advanced-threat-protection#onboard-devices-by-using-a-configuration-profile). -2. Specify a name for the profile, specify desired configuration options for sample sharing and reporting frequency, and select **Create** to save the new profile. - - ![Configuration profile creation screen on Intune](images/secconmgmt_onboarding_2deviceconfprofile.png)
                        - *Configuration profile creation* - -3. After creating the profile, assign it to all your machines. You can review profiles and their deployment status anytime by accessing **Device configuration > Profiles** on Intune. - - ![Profile assignment screen on Intune](images/secconmgmt_onboarding_3assignprofile.png)
                        - *Assigning the new profile to all machines* - ->[!TIP] ->To learn more about Intune profiles, read about [assigning user and device profiles](https://docs.microsoft.com/intune/device-profile-assign). - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) # Related topics - [Ensure your machines are configured properly](configure-machines.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md index 5c04c5d86d..90713b48a1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) Security baselines ensure that security features are configured according to guidance from both security experts and expert Windows system administrators. When deployed, the Microsoft Defender ATP security baseline sets Microsoft Defender ATP security controls to provide optimal protection. @@ -95,7 +95,7 @@ Machine configuration management monitors baseline compliance only of Windows 10 >[!TIP] >Security baselines on Intune provide a convenient way to comprehensively secure and protect your machines. [Learn more about security baselines on Intune](https://docs.microsoft.com/intune/security-baselines). ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) # Related topics - [Ensure your machines are configured properly](configure-machines.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md b/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md index 11f16e8b9f..3c6d45957a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-machines.md @@ -22,7 +22,7 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) With properly configured machines, you can boost overall resilience against threats and enhance your capability to detect and respond to attacks. Security configuration management helps ensure that your machines: @@ -76,4 +76,4 @@ Topic | Description [Increase compliance to the Microsoft Defender ATP security baseline](configure-machines-security-baseline.md) | Track baseline compliance and noncompliance. Deploy the security baseline to more Intune-managed machines. [Optimize ASR rule deployment and detections](configure-machines-asr.md) | Review rule deployment and tweak detections using impact analysis tools in Microsoft 365 security center. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) \ No newline at end of file +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md index 75b3616e1c..584f376ee3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md @@ -1,7 +1,7 @@ --- title: Configure and manage Microsoft Threat Experts capabilities ms.reviewer: -description: You need to register to Microsoft Threats Experts preview to configure, manage, and use it in your daily security operations and security administration work. +description: Register to Microsoft Threats Experts to configure, manage, and use it in your daily security operations and security administration work. keywords: Microsoft Threat Experts, managed threat hunting service, MTE, Microsoft managed hunting service search.product: Windows 10 search.appverid: met150 @@ -9,8 +9,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas -author: mjcaparas +ms.author: dolmont +author: DulceMontemayor ms.localizationpriority: medium manager: dansimp audience: ITPro @@ -26,9 +26,7 @@ ms.topic: article [!include[Prerelease information](prerelease.md)] ## Before you begin -To experience the full Microsoft Threat Experts targeted attack notification capability in Microsoft Defender ATP, and preview the experts-on-demand capability, you need to have a valid Premier customer service and support account. Premier charges will not be incurred during for the capability in preview, but for the generally available capability, there will be charges. - -You also need to ensure that you have Microsoft Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up. +Ensure that you have Microsoft Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up. ## Register to Microsoft Threat Experts managed threat hunting service If you're already a Microsoft Defender ATP customer, you can apply through the Microsoft Defender ATP portal. @@ -36,22 +34,22 @@ If you're already a Microsoft Defender ATP customer, you can apply through the M 1. From the navigation pane, go to **Settings > General > Advanced features > Microsoft Threat Experts**. 2. Click **Apply**. -![Image of Microsoft Threat Experts settings](images/MTE_collaboratewithmte.png) +![Image of Microsoft Threat Experts settings](images/mte-collaboratewithmte.png) 3. Enter your name and email address so that Microsoft can get back to you on your application. -![Image of Microsoft Threat Experts application](images/MTE_apply.png) +![Image of Microsoft Threat Experts application](images/mte-apply.png) 4. Read the privacy statement, then click **Submit** when you're done. You will receive a welcome email once your application is approved. -![Image of Microsoft Threat Experts application confirmation](images/MTE_applicationconfirmation.png) +![Image of Microsoft Threat Experts application confirmation](images/mte-applicationconfirmation.png) 6. From the navigation pane, go to **Settings** > **General** > **Advanced features** to turn the **Threat Experts** toggle on. Click **Save preferences**. ## Receive targeted attack notification from Microsoft Threat Experts -You can receive targeted attack notification from Microsoft Threat Experts through the following: +You can receive targeted attack notification from Microsoft Threat Experts through the following medium: - The Microsoft Defender ATP portal's **Alerts** dashboard - Your email, if you choose to configure it -To receive targeted attack notifications through email, you need to create an email notification rule. +To receive targeted attack notifications through email, create an email notification rule. ### Create an email notification rule You can create rules to send email notifications for notification recipients. See [Configure alert notifications](configure-email-notifications.md) to create, edit, delete, or troubleshoot email notification, for details. @@ -64,45 +62,32 @@ You'll start receiving targeted attack notification from Microsoft Threat Expert 2. From the dashboard, select the same alert topic that you got from the email, to view the details. -## Ask a Microsoft threat expert about suspicious cybersecurity activities in your organization +## Consult a Microsoft threat expert about suspicious cybersecurity activities in your organization >[!NOTE] >The Microsoft Threat Experts' experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. -You can partner with Microsoft Threat Experts who can be engaged directly from within the Windows Defender Security Center for timely and accurate response. Experts provide insights needed to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised machine, or a threat intelligence context that you see on your portal dashboard. +You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised machine, or a threat intelligence context that you see on your portal dashboard. -1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or machine is in view before raising an inquiry. -2. From the upper right-hand menu, click **?**, then select **Ask a threat expert**. -3. Asking a threat expert is a two-step process: you need to provide the necessary information and open a support ticket. - - **Step 1: Provide information** - a. Provide enough information to give the Microsoft Threat Experts enough context to start the investigation. Select the inquiry category from the **Provide information > Inquiry** details drop-down menu.
                        - - b. Enter the additional details to give the threat experts more context of what you’d like to investigate. Click **Next**, and it takes you to the **Open support ticket** tab.
                        - - c. Remember to use the ID number from the **Open a support ticket** tab page and include it to the details you will provide in the subsequent Customer Services and Support (CSS) pages.
                        +>[!NOTE] +>Alert inquiries related to your organization's customized threat intelligence data are currently not supported. Consult your security operations or incident response team for details. - **Step 2: Open a support ticket** - >[!NOTE] - >To experience the full Microsoft Threat Experts preview capability in Microsoft Defender ATP, you need to have a Premier customer service and support account. However, you will not be charged for the Experts-on-demand service during the preview. - - a. In the **New support request** customer support page, select the following from the dropdown menu and then click **Next**:
                        +1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or machine is in view before you send an investigation request. - **Select the product family**: **Security**
                        - **Select a product**: **Microsoft Threat Experts**
                        - **Select a category that best describes the issue**: **Microsoft Defender ATP**
                        - **Select a problem that best describes the issue**: Choose according to your inquiry category
                        - - b. Fill out the fields with the necessary information about the issue and use the auto-generated ID when you open a Customer Services and Support (CSS) ticket. Then, click **Next**.
                        - - c. In the **Select a support plan** page, select **Professional No Charge**.
                        +2. From the upper right-hand menu, click **?**. Then, select **Consult a threat expert**. - d. The severity of your issue has been pre-selected by default, per the support plan, **Professional No Charge**, that you'll use for this public preview. Select the time zone by which you'd like to receive the correspondence. Then, click **Next**.
                        - - e. Verify your contact details and add another if necessary. Then, click **Next**.
                        +>![Image of Microsoft Threat Experts Experts on Demand from the menu](images/mte-eod-menu.png) - f. Review the summary of your support request, and update if necessary. Make sure that you read and understand the **Microsoft Services Agreement** and **Privacy Statement**. Then, click **Submit**. You will see the confirmation page indicating the response time and your support request number.
                        +>A flyout screen opens. -## Sample questions to ask Microsoft Threat Experts +>![Image of Microsoft Threat Experts Experts on Demand screen](images/mte-eod.png) + +>The **Inquiry topic** field is pre-populated with the link to the relevant page for your investigation request. For example, a link to the incident, alert, or machine details page that you were at when you made the request. + +3. In the next field, provide enough information to give the Microsoft Threat Experts enough context to start the investigation. + +4. Enter the email address that you'd like to use to correspond with Microsoft Threat Experts. + +## Sample investigation topics that you can consult with Microsoft Threat Experts **Alert information** - We see a new type of alert for a living-off-the-land binary: [AlertID]. Can you tell us something more about this alert and how we can investigate further? @@ -111,12 +96,12 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w - Can you give more context or insights about this alert: “Suspicious behavior by a system utility was observed”. **Possible machine compromise** -- Can you please help answer why we see “Unknown process observed?” This is seen quite frequently on many machines and we would appreciate input on whether this is related to malicious activity. +- Can you help answer why we see “Unknown process observed?” This is seen quite frequently on many machines. We appreciate any input to clarify whether this is related to malicious activity. - Can you help validate a possible compromise on the following system on [date] with similar behaviors as the previous [malware name] malware detection on the same system in [month]? **Threat intelligence details** -- This morning, we detected a phishing email that delivered a malicious Word document to a user. This caused a series of suspicious events which triggered multiple Windows Defender alerts for [malware name] malware. Do you have any information on this malware? If yes, can you please send me a link? -- I recently saw a [social media reference e.g. Twitter or blog] post about a threat that is targeting my industry. Can you help me understand what protection Microsoft Defender ATP provides against this threat actor? +- This morning, we detected a phishing email that delivered a malicious Word document to a user. This caused a series of suspicious events which triggered multiple Microsoft Defender alerts for [malware name] malware. Do you have any information on this malware? If yes, can you send me a link? +- I recently saw a [social media reference e.g., Twitter or blog] post about a threat that is targeting my industry. Can you help me understand what protection Microsoft Defender ATP provides against this threat actor? **Microsoft Threat Experts’ alert communications** - Can your incident response team help us address the targeted attack notification that we got? @@ -129,10 +114,14 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w ## Scenario ### Receive a progress report about your managed hunting inquiry -Response from Microsoft Threat Experts varies according to your inquiry. They will email a progress report to you regarding the Ask a threat expert inquiry that you've submitted, within two days, to communicate the investigation status from the following categories: +Response from Microsoft Threat Experts varies according to your inquiry. They will email a progress report to you about your **Consult a threat expert** inquiry within two days, to communicate the investigation status from the following categories: - More information is needed to continue with the investigation - A file or several file samples are needed to determine the technical context - Investigation requires more time - Initial information was enough to conclude the investigation It is crucial to respond in a timely manner to keep the investigation moving. See the Premier customer service and support service level agreement for details. + +## Related topic +- [Microsoft Threat Experts overview](microsoft-threat-experts.md) + diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md b/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md index d12bc037b7..7738dedb9f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support.md @@ -1,6 +1,8 @@ --- title: Configure managed security service provider support -description: Take the necessary steps to configure the MSSP integration with Microsoft Defender ATP + +description: Take the necessary steps to configure the MSSP integration with Windows Defender ATP + keywords: managed security service provider, mssp, configure, integration search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -21,9 +23,11 @@ ms.date: 09/03/2018 # Configure managed security service provider integration **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-mssp-support-abovefoldlink) +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-mssp-support-abovefoldlink) + [!include[Prerelease information](prerelease.md)] @@ -35,19 +39,23 @@ You'll need to take the following configuration steps to enable the managed secu > - MSSP customers: Organizations that engage the services of MSSPs. The integration will allow MSSPs to take the following actions: -- Get access to MSSP customer's Microsoft Defender Security Center portal + +- Get access to MSSP customer's Windows Defender Security Center portal - Get email notifications, and - Fetch alerts through security information and event management (SIEM) tools -Before MSSPs can take these actions, the MSSP customer will need to grant access to their Microsoft Defender ATP tenant so that the MSSP can access the portal. +Before MSSPs can take these actions, the MSSP customer will need to grant access to their Windows Defender ATP tenant so that the MSSP can access the portal. + Typically, MSSP customers take the initial configuration steps to grant MSSPs access to their Windows Defender Security Central tenant. After access is granted, other configuration steps can be done by either the MSSP customer or the MSSP. In general, the following configuration steps need to be taken: -- **Grant the MSSP access to Microsoft Defender Security Center**
                        -This action needs to be done by the MSSP customer. It grants the MSSP access to the MSSP customer's Microsoft Defender ATP tenant. + +- **Grant the MSSP access to Windows Defender Security Center**
                        +This action needs to be done by the MSSP customer. It grants the MSSP access to the MSSP customer's Windows Defender ATP tenant. + - **Configure alert notifications sent to MSSPs**
                        This action can be taken by either the MSSP customer or MSSP. This lets the MSSPs know what alerts they need to address for the MSSP customer. @@ -61,31 +69,36 @@ This action is taken by the MSSP. It allows MSSPs to fetch alerts using APIs. ## Grant the MSSP access to the portal ->[!NOTE] + +>[!NOTE] > These set of steps are directed towards the MSSP customer.
                        > Access to the portal can only be done by the MSSP customer. -As a MSSP customer, you'll need to take the following configuration steps to grant the MSSP access to Microsoft Defender Security Center. +As a MSSP customer, you'll need to take the following configuration steps to grant the MSSP access to Windows Defender Security Center. + Authentication and authorization of the MSSP user is built on top of Azure Active Directory (Azure AD) B2B functionality. You'll need to take the following 2 steps: - Add MSSP user to your tenant as a guest user -- Grant MSSP user access to Microsoft Defender Security Center + +- Grant MSSP user access to Windows Defender Security Center + ### Add MSSP user to your tenant as a guest user Add a user who is a member of the MSSP tenant to your tenant as a guest user. To grant portal access to the MSSP, you must add the MSSP user to your Azure AD as a guest user. For more information, see [Add Azure Active Directory B2B collaboration users in the Azure portal](https://docs.microsoft.com/azure/active-directory/b2b/add-users-administrator). - -### Grant MSSP user access to Microsoft Defender Security Center -Grant the guest user access and permissions to your Microsoft Defender Security Center tenant. + +### Grant MSSP user access to Windows Defender Security Center +Grant the guest user access and permissions to your Windows Defender Security Center tenant. Granting access to guest user is done the same way as granting access to a user who is a member of your tenant. If you're using basic permissions to access the portal, the guest user must be assigned a Security Administrator role in **your** tenant. For more information, see [Use basic permissions to access the portal](basic-permissions.md). -If you're using role-based access control (RBAC), the guest user must be to added to the appropriate group or groups in **your** tenant. Fore more information on RBAC in Microsoft Defender ATP, see [Manage portal access using RBAC](rbac.md). +If you're using role-based access control (RBAC), the guest user must be to added to the appropriate group or groups in **your** tenant. Fore more information on RBAC in Windows Defender ATP, see [Manage portal access using RBAC](rbac.md). + >[!NOTE] >There is no difference between the Member user and Guest user roles from RBAC perspective. @@ -94,12 +107,14 @@ It is recommended that groups are created for MSSPs to make authorization access As a MSSP customer, you can always remove or modify the permissions granted to the MSSP by updating the Azure AD user groups. -## Access the Microsoft Defender Security Center MSSP customer portal + +## Access the Windows Defender Security Center MSSP customer portal ->[!NOTE] +>[!NOTE] >These set of steps are directed towards the MSSP. -By default, MSSP customers access their Microsoft Defender Security Center tenant through the following URL: `https://securitycenter.windows.com`. +By default, MSSP customers access their Windows Defender Security Center tenant through the following URL: `https://securitycenter.windows.com`. + MSSPs however, will need to use a tenant-specific URL in the following format: `https://securitycenter.windows.com?tid=customer_tenant_id` to access the MSSP customer portal. @@ -123,11 +138,13 @@ Use the following steps to obtain the MSSP customer tenant ID and then use the I After access the portal is granted, alert notification rules can to be created so that emails are sent to MSSPs when alerts associated with the tenant are created and set conditions are met. + For more information, see [Create rules for alert notifications](configure-email-notifications.md#create-rules-for-alert-notifications). + These check boxes must be checked: - - **Include organization name** - The customer name will be added to email notifications - - **Include tenant-specific portal link** - Alert link URL will have tenant specific parameter (tid=target_tenant_id) that allows direct access to target tenant portal +- **Include organization name** - The customer name will be added to email notifications +- **Include tenant-specific portal link** - Alert link URL will have tenant specific parameter (tid=target_tenant_id) that allows direct access to target tenant portal ## Fetch alerts from MSSP customer's tenant into the SIEM system @@ -141,46 +158,49 @@ To fetch alerts into your SIEM system you'll need to take the following steps: Step 1: Create a third-party application Step 2: Get access and refresh tokens from your customer's tenant - -Step 3: Whitelist your application on Microsoft Defender Security Center + +Step 3: Whitelist your application on Windows Defender Security Center + ### Step 1: Create an application in Azure Active Directory (Azure AD) -You'll need to create an application and grant it permissions to fetch alerts from your customer's Microsoft Defender ATP tenant. + +You'll need to create an application and grant it permissions to fetch alerts from your customer's Windows Defender ATP tenant. + 1. Sign in to the [Azure AD portal](https://aad.portal.azure.com/). 2. Select **Azure Active Directory** > **App registrations**. -3. Click **New application registration**. + +3. Click **New registration**. + 4. Specify the following values: - Name: \ SIEM MSSP Connector (replace Tenant_name with the tenant display name) - - Application type: Web app / API - - Sign-on URL: `https://SiemMsspConnector` + + - Supported account types: Account in this organizational directory only + - Redirect URI: Select Web and type `https:///SiemMsspConnector`(replace with the tenant name) -5. Click **Create**. The application is displayed in the list of applications you own. +5. Click **Register**. The application is displayed in the list of applications you own. -6. Select the application, then click **Settings** > **Properties**. +6. Select the application, then click **Overview**. -7. Copy the value from the **Application ID** field. +7. Copy the value from the **Application (client) ID** field to a safe place, you will need this in the next step. -8. Change the value in the **App ID URI** to: `https:///SiemMsspConnector` (replace \ with the tenant name. +8. Select **Certificate & secrets** in the new application panel. -9. Ensure that the **Multi-tenanted** field is set to **Yes**. +9. Click **New client secret**. -10. In the **Settings** panel, select **Reply URLs** and add the following URL: `https://localhost:44300/wdatpconnector`. - -11. Click **Save**. - -12. Select **Keys** and specify the following values: - Description: Enter a description for the key. - Expires: Select **In 1 year** -13. Click **Save**. Save the value is a safe place, you'll need this + +10. Click **Add**, copy the value of the client secret to a safe place, you will need this in the next step. + ### Step 2: Get access and refresh tokens from your customer's tenant This section guides you on how to use a PowerShell script to get the tokens from your customer's tenant. This script uses the application from the previous step to get the access and refresh tokens using the OAuth Authorization Code Flow. @@ -248,17 +268,20 @@ After providing your credentials, you'll need to grant consent to the applicatio `Set-ExecutionPolicy -ExecutionPolicy Bypass` 6. Enter the following commands: `.\MsspTokensAcquisition.ps1 -clientId -secret -tenantId ` - - - Replace \ with the Application ID you got from the previous step. - - Replace \ with the application key you created from the previous step. - - Replace \ with your customer's tenant ID. + + - Replace \ with the **Application (client) ID** you got from the previous step. + - Replace \ with the **Client Secret** you created from the previous step. + - Replace \ with your customer's **Tenant ID**. + 7. You'll be asked to provide your credentials and consent. Ignore the page redirect. 8. In the PowerShell window, you'll receive an access token and a refresh token. Save the refresh token to configure your SIEM connector. -### Step 3: Whitelist your application on Microsoft Defender Security Center -You'll need to whitelist the application you created in Microsoft Defender Security Center. + +### Step 3: Whitelist your application on Windows Defender Security Center +You'll need to whitelist the application you created in Windows Defender Security Center. + You'll need to have **Manage portal system settings** permission to whitelist the application. Otherwise, you'll need to request your customer to whitelist the application for you. @@ -272,12 +295,15 @@ You'll need to have **Manage portal system settings** permission to whitelist th 5. Click **Authorize application**. -You can now download the relevant configuration file for your SIEM and connect to the Microsoft Defender ATP API. For more information see, [Pull alerts to your SIEM tools](configure-siem.md). + +You can now download the relevant configuration file for your SIEM and connect to the Windows Defender ATP API. For more information see, [Pull alerts to your SIEM tools](configure-siem.md). + - In the ArcSight configuration file / Splunk Authentication Properties file – you will have to write your application key manually by settings the secret value. - Instead of acquiring a refresh token in the portal, use the script from the previous step to acquire a refresh token (or acquire it by other means). ## Fetch alerts from MSSP customer's tenant using APIs + For information on how to fetch alerts using REST API, see [Pull alerts using REST API](pull-alerts-using-rest-api.md). ## Related topics @@ -285,4 +311,5 @@ For information on how to fetch alerts using REST API, see [Pull alerts using RE - [Manage portal access using RBAC](rbac.md) - [Pull alerts to your SIEM tools](configure-siem.md) - [Pull alerts using REST API](pull-alerts-using-rest-api.md) + diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md index dba3eaf576..3ba4e51fda 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md @@ -17,15 +17,13 @@ ms.collection: M365-security-compliance ms.topic: article --- - # Configure machine proxy and Internet connectivity settings **Applies to:** + - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) +> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink) The Microsoft Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Microsoft Defender ATP service. @@ -36,27 +34,26 @@ The embedded Microsoft Defender ATP sensor runs in system context using the Loca The WinHTTP configuration setting is independent of the Windows Internet (WinINet) Internet browsing proxy settings and can only discover a proxy server by using the following discovery methods: - - Auto-discovery methods: - - Transparent proxy - - Web Proxy Auto-discovery Protocol (WPAD) +- Auto-discovery methods: + - Transparent proxy + - Web Proxy Auto-discovery Protocol (WPAD) > [!NOTE] > If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings. For more information on Microsoft Defender ATP URL exclusions in the proxy, see [Enable access to Microsoft Defender ATP service URLs in the proxy server](#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). - - - Manual static proxy configuration: - - Registry based configuration - - WinHTTP configured using netsh command – Suitable only for desktops in a stable topology (for example: a desktop in a corporate network behind the same proxy) - - +- Manual static proxy configuration: + - Registry based configuration + - WinHTTP configured using netsh command – Suitable only for desktops in a stable topology (for example: a desktop in a corporate network behind the same proxy) ## Configure the proxy server manually using a registry-based static proxy + Configure a registry-based static proxy to allow only Microsoft Defender ATP sensor to report diagnostic data and communicate with Microsoft Defender ATP services if a computer is not be permitted to connect to the Internet. -The static proxy is configurable through Group Policy (GP). The group policy can be found under: +The static proxy is configurable through Group Policy (GP). The group policy can be found under: + - Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Authenticated Proxy usage for the Connected User Experience and Telemetry Service - - Set it to **Enabled** and select **Disable Authenticated Proxy usage**: - ![Image of Group Policy setting](images/atp-gpo-proxy1.png) + - Set it to **Enabled** and select **Disable Authenticated Proxy usage**: + ![Image of Group Policy setting](images/atp-gpo-proxy1.png) - **Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure connected user experiences and telemetry**: - Configure the proxy:
                        ![Image of Group Policy setting](images/atp-gpo-proxy2.png) @@ -68,6 +65,7 @@ The static proxy is configurable through Group Policy (GP). The group policy can ```text : ``` + For example: 10.0.0.6:8080 The registry value `DisableEnterpriseAuthProxy` should be set to 1. @@ -87,35 +85,39 @@ Use netsh to configure a system-wide static proxy. b. Right-click **Command prompt** and select **Run as administrator**. 2. Enter the following command and press **Enter**: - ``` + + ```PowerShell netsh winhttp set proxy : ``` + For example: netsh winhttp set proxy 10.0.0.6:8080 To reset the winhttp proxy, enter the following command and press **Enter** -``` + +```PowerShell netsh winhttp reset proxy ``` + See [Netsh Command Syntax, Contexts, and Formatting](https://docs.microsoft.com/windows-server/networking/technologies/netsh/netsh-contexts) to learn more. ## Enable access to Microsoft Defender ATP service URLs in the proxy server + If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are not blocked by default. Do not disable security monitoring or inspection of these URLs, but allow them as you would other internet traffic. They permit communication with Microsoft Defender ATP service in port 80 and 443: ->[!NOTE] -> URLs that include v20 in them are only needed if you have Windows 10, version 1803 or later machines. For example, ```us-v20.events.data.microsoft.com``` is only needed if the machine is on Windows 10, version 1803 or later. +> [!NOTE] +> URLs that include v20 in them are only needed if you have Windows 10, version 1803 or later machines. For example, ```us-v20.events.data.microsoft.com``` is only needed if the machine is on Windows 10, version 1803 or later. -Service location | Microsoft.com DNS record -:---|:--- + Service location | Microsoft.com DNS record +-|- Common URLs for all locations | ```*.blob.core.windows.net```
                        ```crl.microsoft.com```
                        ```ctldl.windowsupdate.com```
                        ```events.data.microsoft.com```
                        ```notify.windows.com``` European Union | ```eu.vortex-win.data.microsoft.com```
                        ```eu-v20.events.data.microsoft.com```
                        ```winatp-gw-neu.microsoft.com```
                        ```winatp-gw-weu.microsoft.com``` United Kingdom | ```uk.vortex-win.data.microsoft.com```
                        ```uk-v20.events.data.microsoft.com```
                        ```winatp-gw-uks.microsoft.com```
                        ```winatp-gw-ukw.microsoft.com``` United States | ```us.vortex-win.data.microsoft.com```
                        ```us-v20.events.data.microsoft.com```
                        ```winatp-gw-cus.microsoft.com```
                        ```winatp-gw-eus.microsoft.com``` - - If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs. -## Microsoft Defender ATP service backend IP range +## Microsoft Defender ATP service backend IP range + If you network devices don't support the URLs white-listed in the prior section, you can use the following information. Microsoft Defender ATP is built on Azure cloud, deployed in the following regions: @@ -128,13 +130,11 @@ Microsoft Defender ATP is built on Azure cloud, deployed in the following region - \+\ - \+\ - You can find the Azure IP range on [Microsoft Azure Datacenter IP Ranges](https://www.microsoft.com/en-us/download/details.aspx?id=41653). ->[!NOTE] +> [!NOTE] > As a cloud-based solution, the IP range can change. It's recommended you move to DNS resolving setting. - ## Verify client connectivity to Microsoft Defender ATP service URLs Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Microsoft Defender ATP service URLs. @@ -151,11 +151,13 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover 4. Enter the following command and press **Enter**: - ``` + ```PowerShell HardDrivePath\WDATPConnectivityAnalyzer.cmd ``` + Replace *HardDrivePath* with the path where the WDATPConnectivityAnalyzer tool was downloaded to, for example - ``` + + ```PowerShell C:\Work\tools\WDATPConnectivityAnalyzer\WDATPConnectivityAnalyzer.cmd ``` @@ -163,13 +165,14 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover 6. Open *WDATPConnectivityAnalyzer.txt* and verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs.

                        The tool checks the connectivity of Microsoft Defender ATP service URLs that Microsoft Defender ATP client is configured to interact with. It then prints the results into the *WDATPConnectivityAnalyzer.txt* file for each URL that can potentially be used to communicate with the Microsoft Defender ATP services. For example: + ```text Testing URL : https://xxx.microsoft.com/xxx 1 - Default proxy: Succeeded (200) 2 - Proxy auto discovery (WPAD): Succeeded (200) 3 - Proxy disabled: Succeeded (200) 4 - Named proxy: Doesn't exist - 5 - Command line proxy: Doesn't exist + 5 - Command line proxy: Doesn't exist ``` If at least one of the connectivity options returns a (200) status, then the Microsoft Defender ATP client can communicate with the tested URL properly using this connectivity method.

                        @@ -177,9 +180,10 @@ If at least one of the connectivity options returns a (200) status, then the Mic However, if the connectivity check results indicate a failure, an HTTP error is displayed (see HTTP Status Codes). You can then use the URLs in the table shown in [Enable access to Microsoft Defender ATP service URLs in the proxy server](#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). The URLs you'll use will depend on the region selected during the onboarding procedure. > [!NOTE] -> The Connectivity Analyzer tool is not compatible with ASR rule [Block process creations originating from PSExec and WMI commands](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard#attack-surface-reduction-rules). You will need to temporarily disable this rule to run the connectivity tool. +> The Connectivity Analyzer tool is not compatible with ASR rule [Block process creations originating from PSExec and WMI commands](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction#attack-surface-reduction-rules). You will need to temporarily disable this rule to run the connectivity tool. > When the TelemetryProxyServer is set, in Registry or via Group Policy, Microsoft Defender ATP will fall back to direct if it can't access the defined proxy. ## Related topics + - [Onboard Windows 10 machines](configure-endpoints.md) -- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md) \ No newline at end of file +- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index 6b24d02ebe..ec708627ca 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -9,6 +9,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas +ms.author: macapara ms.localizationpriority: medium manager: dansimp audience: ITPro @@ -20,22 +21,20 @@ ms.topic: article **Applies to:** -- Windows Server 2008 R2 SP1 (pre-release) +- Windows Server 2008 R2 SP1 - Windows Server 2012 R2 - Windows Server 2016 - Windows Server, version 1803 - Windows Server, 2019 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configserver-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configserver-abovefoldlink) Microsoft Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Microsoft Defender Security Center console. The service supports the onboarding of the following servers: -- Windows Server 2008 R2 SP1 (pre-release) +- Windows Server 2008 R2 SP1 - Windows Server 2012 R2 - Windows Server 2016 - Windows Server, version 1803 @@ -66,7 +65,7 @@ You'll need to take the following steps if you choose to onboard servers through - For Windows Server 2008 R2 SP1, ensure that you fulfill the following requirements: - Install the [February monthly update rollup](https://support.microsoft.com/en-us/help/4074598/windows-7-update-kb4074598) - Install the [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/en-us/help/3080149/update-for-customer-experience-and-diagnostic-telemetry) - - Install either [.NET framework 4.5](https://www.microsoft.com/en-us/download/details.aspx?id=30653) (or later) or [KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework) + - Install either [.NET framework 4.5](https://www.microsoft.com/download/details.aspx?id=30653) (or later) or [KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework) - For Windows Server 2008 R2 SP1 and Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients. @@ -75,7 +74,7 @@ You'll need to take the following steps if you choose to onboard servers through >This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2008 R2 SP1 and Windows Server 2012 R2. - Turn on server monitoring from Microsoft Defender Security Center. -- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), simply attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multi Homing support. Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent). +- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), simply attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multihoming support. Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent). >[!TIP] @@ -207,7 +206,7 @@ For other server versions, you have two options to offboard servers from the ser >[!NOTE] >Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months. -### Uninstall servers by uinstalling the MMA agent +### Uninstall servers by uninstalling the MMA agent To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Microsoft Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Microsoft Defender ATP. For more information, see [To disable an agent](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent). diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md b/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md index c5e8719018..44e2fdd28e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-siem.md @@ -1,6 +1,6 @@ --- -title: Pull alerts to your SIEM tools from Microsoft Defender Advanced Threat Protection -description: Learn how to use REST API and configure supported security information and events management tools to receive and pull alerts. +title: Pull detections to your SIEM tools from Microsoft Defender Advanced Threat Protection +description: Learn how to use REST API and configure supported security information and events management tools to receive and pull detections. keywords: configure siem, security information and events management tools, splunk, arcsight, custom indicators, rest api, alert definitions, indicators of compromise search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,16 +18,21 @@ ms.topic: article ms.date: 10/16/2017 --- -# Pull alerts to your SIEM tools +# Pull detections to your SIEM tools **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) -## Pull alerts using security information and events management (SIEM) tools -Microsoft Defender ATP supports (SIEM) tools to pull alerts. Microsoft Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull alerts from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment. +## Pull detections using security information and events management (SIEM) tools + +>[!Note] +>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections +>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. + +Microsoft Defender ATP supports security information and event management (SIEM) tools to pull detections. Microsoft Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull detections from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment. Microsoft Defender ATP currently supports the following SIEM tools: @@ -39,16 +44,16 @@ To use either of these supported SIEM tools you'll need to: - [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) - Configure the supported SIEM tool: - - [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md) - - [Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md) + - [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) + - [Configure HP ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) -For more information on the list of fields exposed in the alerts API see, [Microsoft Defender ATP alert API fields](api-portal-mapping.md). +For more information on the list of fields exposed in the Detection API see, [Microsoft Defender ATP Detection fields](api-portal-mapping.md). -## Pull Microsoft Defender ATP alerts using REST API -Microsoft Defender ATP supports the OAuth 2.0 protocol to pull alerts using REST API. +## Pull Microsoft Defender ATP detections using REST API +Microsoft Defender ATP supports the OAuth 2.0 protocol to pull detections using REST API. -For more information, see [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md). +For more information, see [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md). ## In this section @@ -56,8 +61,8 @@ For more information, see [Pull Microsoft Defender ATP alerts using REST API](pu Topic | Description :---|:--- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)| Learn about enabling the SIEM integration feature in the **Settings** page in the portal so that you can use and generate the required information to configure supported SIEM tools. -[Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md)| Learn about installing the REST API Modular Input app and other configuration settings to enable Splunk to pull Microsoft Defender ATP alerts. -[Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md)| Learn about installing the HP ArcSight REST FlexConnector package and the files you need to configure ArcSight to pull Microsoft Defender ATP alerts. -[Microsoft Defender ATP alert API fields](api-portal-mapping.md) | Understand what data fields are exposed as part of the alerts API and how they map to Microsoft Defender Security Center. -[Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) | Use the Client credentials OAuth 2.0 flow to pull alerts from Microsoft Defender ATP using REST API. +[Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md)| Learn about installing the REST API Modular Input App and other configuration settings to enable Splunk to pull Microsoft Defender ATP detections. +[Configure HP ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md)| Learn about installing the HP ArcSight REST FlexConnector package and the files you need to configure ArcSight to pull Microsoft Defender ATP detections. +[Microsoft Defender ATP Detection fields](api-portal-mapping.md) | Understand what data fields are exposed as part of the alerts API and how they map to Microsoft Defender Security Center. +[Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) | Use the Client credentials OAuth 2.0 flow to pull detections from Microsoft Defender ATP using REST API. [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) | Address issues you might encounter when using the SIEM integration feature. diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-splunk.md b/windows/security/threat-protection/microsoft-defender-atp/configure-splunk.md index 13cf662e66..fd61b88ec1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-splunk.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-splunk.md @@ -1,6 +1,6 @@ --- -title: Configure Splunk to pull Microsoft Defender ATP alerts -description: Configure Splunk to receive and pull alerts from Microsoft Defender Security Center. +title: Configure Splunk to pull Microsoft Defender ATP detections +description: Configure Splunk to receive and pull detections from Microsoft Defender Security Center. keywords: configure splunk, security information and events management tools, splunk search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -17,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Configure Splunk to pull Microsoft Defender ATP alerts +# Configure Splunk to pull Microsoft Defender ATP detections **Applies to:** @@ -26,9 +26,13 @@ ms.topic: article ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresplunk-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresplunk-abovefoldlink) -You'll need to configure Splunk so that it can pull Microsoft Defender ATP alerts. +You'll need to configure Splunk so that it can pull Microsoft Defender ATP detections. + +>[!Note] +>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections +>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. ## Before you begin @@ -121,8 +125,8 @@ You'll need to configure Splunk so that it can pull Microsoft Defender ATP alert After completing these configuration steps, you can go to the Splunk dashboard and run queries. -## View alerts using Splunk solution explorer -Use the solution explorer to view alerts in Splunk. +## View detections using Splunk solution explorer +Use the solution explorer to view detections in Splunk. 1. In Splunk, go to **Settings** > **Searchers, reports, and alerts**. @@ -141,12 +145,12 @@ Use the solution explorer to view alerts in Splunk. >[!TIP] -> To mininimize alert duplications, you can use the following query: +> To mininimize Detection duplications, you can use the following query: >```source="rest://windows atp alerts" | spath | dedup _raw | table *``` ## Related topics - [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) -- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md) -- [Microsoft Defender ATP alert API fields](api-portal-mapping.md) -- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) +- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) +- [Microsoft Defender ATP Detection fields](api-portal-mapping.md) +- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) - [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md similarity index 78% rename from windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md rename to windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md index 7aa48ea40e..eb5c9b65bb 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin audience: ITPro @@ -21,7 +22,7 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. It protects your data by checking against a list of known, trusted apps. Controlled folder access is supported on Windows Server 2019 as well as Windows 10 clients. It can be turned on via the Windows Security App, or from the System Center Configuration Manager (SCCM) and Intune, for managed devices. Controlled folder access works best with [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), which gives you detailed reporting into controlled folder access events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). @@ -35,9 +36,9 @@ Controlled folder access is especially useful in helping to protect your documen With Controlled folder access in place, a notification will appear on the computer where the app attempted to make changes to a protected folder. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors. -The protected folders include common system folders, and you can [add additional folders](customize-controlled-folders-exploit-guard.md#protect-additional-folders). You can also [allow or whitelist apps](customize-controlled-folders-exploit-guard.md#allow-specific-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders. +The protected folders include common system folders, and you can [add additional folders](customize-controlled-folders.md#protect-additional-folders). You can also [allow or whitelist apps](customize-controlled-folders.md#allow-specific-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders. -You can use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how controlled folder access would impact your organization if it were enabled. You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. +You can use [audit mode](audit-windows-defender.md) to evaluate how controlled folder access would impact your organization if it were enabled. You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. Controlled folder access is supported on Windows 10, version 1709 and later and Windows Server 2019. @@ -49,7 +50,7 @@ Controlled folder access requires enabling [Windows Defender Antivirus real-time Microsoft Defender ATP provides detailed reporting into events and blocks as part of its [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). -You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender-exploit-guard.md), you can use Advanced hunting to see how controlled folder access settings would affect your environment if they were enabled. +You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use Advanced hunting to see how controlled folder access settings would affect your environment if they were enabled. Here is an example query @@ -62,13 +63,13 @@ MiscEvents You can review the Windows event log to see events that are created when controlled folder access blocks (or audits) an app: -1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the file *cfa-events.xml* to an easily accessible location on the machine. +1. Download the [Evaluation Package](https://aka.ms/mp7z2w) and extract the file *cfa-events.xml* to an easily accessible location on the machine. 1. Type **Event viewer** in the Start menu to open the Windows Event Viewer. 1. On the left panel, under **Actions**, click **Import custom view...**. -1. Navigate to where you extracted *cfa-events.xml* and select it. Alternatively, [copy the XML directly](event-views-exploit-guard.md). +1. Navigate to where you extracted *cfa-events.xml* and select it. Alternatively, [copy the XML directly](event-views.md). 1. Click **OK**. @@ -83,7 +84,7 @@ Event ID | Description ## In this section Topic | Description ----|--- +-|- [Evaluate controlled folder access](evaluate-controlled-folder-access.md) | Use a dedicated demo tool to see how controlled folder access works, and what events would typically be created. -[Enable controlled folder access](enable-controlled-folders-exploit-guard.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage controlled folder access in your network -[Customize controlled folder access](customize-controlled-folders-exploit-guard.md) | Add additional protected folders, and allow specified apps to access protected folders. +[Enable controlled folder access](enable-controlled-folders.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage controlled folder access in your network +[Customize controlled folder access](customize-controlled-folders.md) | Add additional protected folders, and allow specified apps to access protected folders. diff --git a/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md b/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md index c100b9ddf2..f4a2b266d9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference.md @@ -61,7 +61,7 @@ machineId | String | Id of the machine on which the event was identified. **Requ severity | String | Severity of the alert. The property values are: 'Low', 'Medium' and 'High'. **Required**. title | String | Title for the alert. **Required**. description | String | Description of the alert. **Required**. -recommendedAction| String | Action that is recommended to be taken by security officer when analyzing the alert. +recommendedAction| String | Action that is recommended to be taken by security officer when analyzing the alert. **Required**. eventTime | DateTime(UTC) | The time of the event, as obtained from the advanced query. **Required**. reportId | String | The reportId, as obtained from the advanced query. **Required**. category| String | Category of the alert. The property values are: 'None', 'SuspiciousActivity', 'Malware', 'CredentialTheft', 'Exploit', 'WebExploit', 'DocumentExploit', 'PrivilegeEscalation', 'Persistence', 'RemoteAccessTool', 'CommandAndControl', 'SuspiciousNetworkTraffic', 'Ransomware', 'MalwareDownload', 'Reconnaissance', 'WebFingerprinting', 'Weaponization', 'Delivery', 'SocialEngineering', 'CredentialStealing', 'Installation', 'Backdoor', 'Trojan', 'TrojanDownloader', 'LateralMovement', 'ExplorationEnumeration', 'NetworkPropagation', 'Exfiltration', 'NotApplicable', 'EnterprisePolicy' and 'General'. diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md index c3eaee164d..9561fe831c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -26,7 +26,7 @@ ms.topic: article Create custom detection rules from [Advanced hunting](overview-hunting.md) queries to automatically check for threat indicators and generate alerts whenever these indicators are found. >[!NOTE] ->To create and manage custom detections, [your role](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) needs to have the **manage security settings** permission. +>To create and manage custom detections, [your role](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) needs to have the **manage security settings** permission. For the detection rule to work properly and create alerts, the query must return in each row a set of MachineId, ReportId, EventTime which match to an actual event in advanced hunting. 1. In the navigation pane, select **Advanced hunting**. diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-ti-api.md b/windows/security/threat-protection/microsoft-defender-atp/custom-ti-api.md index 2601b05b63..0a42682bb7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/custom-ti-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-ti-api.md @@ -25,7 +25,7 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-customti-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-customti-abovefoldlink) You can define custom alert definitions and indicators of compromise (IOC) using the threat intelligence API. Creating custom threat intelligence alerts allows you to generate specific alerts that are applicable to your organization. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction.md similarity index 74% rename from windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md rename to windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction.md index 2b7dec1738..839daef3d1 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 05/13/2019 @@ -20,10 +21,10 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> [!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. Attack surface reduction rules help prevent actions and apps that are typically used by exploit-seeking malware to infect machines. Attack surface reduction rules are supported on Windows Server 2019 as well as Windows 10 clients. @@ -33,21 +34,20 @@ You can use Group Policy, PowerShell, and MDM CSPs to configure these settings. ## Exclude files and folders -You can exclude files and folders from being evaluated by attack surface reduction rules. This means that even if an attack surface reduction rule detects that the file contains malicious behavior, the file will not be blocked from running. +You can exclude files and folders from being evaluated by attack surface reduction rules. This means that even if an attack surface reduction rule detects that the file contains malicious behavior, the file will not be blocked from running. ->[!WARNING] ->This could potentially allow unsafe files to run and infect your devices. Excluding files or folders can severely reduce the protection provided by attack surface reduction rules. Files that would have been blocked by a rule will be allowed to run, and there will be no report or event recorded. +> [!WARNING] +> This could potentially allow unsafe files to run and infect your devices. Excluding files or folders can severely reduce the protection provided by attack surface reduction rules. Files that would have been blocked by a rule will be allowed to run, and there will be no report or event recorded. An exclusion applies to all rules that allow exclusions. You can specify an individual file, folder path, or the fully qualified domain name for a resource, but you cannot limit an exclusion to certain rules. An exclusion is applied only when the excluded application or service starts. For example, if you add an exclusion for an update service that is already running, the update service will continue to trigger events until the service is stopped and restarted. -Attack surface reduction supports environment variables and wildcards. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists). +Attack surface reduction supports environment variables and wildcards. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists). If you are encountering problems with rules detecting files that you believe should not be detected, you should [use audit mode first to test the rule](evaluate-attack-surface-reduction.md). - -Rule description | GUID --|:-:|- +Rule description | GUID +-|-|- Block all Office applications from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A Block execution of potentially obfuscated scripts | 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC Block Win32 API calls from Office macro | 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B @@ -62,19 +62,19 @@ Block process creations originating from PSExec and WMI commands | d1e49aac-8f56 Block untrusted and unsigned processes that run from USB | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 Block Office communication applications from creating child processes | 26190899-1602-49e8-8b27-eb1d0a1ce869 Block Adobe Reader from creating child processes | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c -Block persistence through WMI event subscription | e6db77e5-3df2-4cf1-b95a-636979351e5b +Block persistence through WMI event subscription | e6db77e5-3df2-4cf1-b95a-636979351e5b -See the [attack surface reduction](attack-surface-reduction-exploit-guard.md) topic for details on each rule. +See the [attack surface reduction](attack-surface-reduction.md) topic for details on each rule. ### Use Group Policy to exclude files and folders -1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -3. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack surface reduction**. +3. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack surface reduction**. -4. Double-click the **Exclude files and paths from Attack surface reduction Rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. +4. Double-click the **Exclude files and paths from Attack surface reduction Rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. ### Use PowerShell to exclude files and folders @@ -85,10 +85,10 @@ See the [attack surface reduction](attack-surface-reduction-exploit-guard.md) to Add-MpPreference -AttackSurfaceReductionOnlyExclusions "" ``` -Continue to use `Add-MpPreference -AttackSurfaceReductionOnlyExclusions` to add more folders to the list. +Continue to use `Add-MpPreference -AttackSurfaceReductionOnlyExclusions` to add more folders to the list. ->[!IMPORTANT] ->Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. +> [!IMPORTANT] +> Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. ### Use MDM CSPs to exclude files and folders @@ -100,7 +100,6 @@ See the [Windows Security](../windows-defender-security-center/windows-defender- ## Related topics -- [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction-exploit-guard.md) -- [Enable attack surface reduction rules](enable-attack-surface-reduction.md) -- [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) - +* [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction.md) +* [Enable attack surface reduction rules](enable-attack-surface-reduction.md) +* [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md b/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md similarity index 74% rename from windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md rename to windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md index 1acfffd14f..3216d16b87 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 05/13/2019 @@ -20,19 +21,19 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. Controlled folder access is supported on Windows Server 2019 as well as Windows 10 clients. This topic describes how to customize the following settings of the controlled folder access feature with the Windows Security app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs): -- [Add additional folders to be protected](#protect-additional-folders) -- [Add apps that should be allowed to access protected folders](#allow-specific-apps-to-make-changes-to-controlled-folders) +* [Add additional folders to be protected](#protect-additional-folders) +* [Add apps that should be allowed to access protected folders](#allow-specific-apps-to-make-changes-to-controlled-folders) ->[!WARNING] ->Controlled folder access monitors apps for activities that may be malicious. Sometimes it might block a legitimate app from making legitimate changes to your files. +> [!WARNING] +> Controlled folder access monitors apps for activities that may be malicious. Sometimes it might block a legitimate app from making legitimate changes to your files. > ->This may impact your organization's productivity, so you may want to consider running the feature in [audit mode](audit-windows-defender-exploit-guard.md) to fully assess the feature's impact. +> This may impact your organization's productivity, so you may want to consider running the feature in [audit mode](audit-windows-defender.md) to fully assess the feature's impact. ## Protect additional folders @@ -42,7 +43,7 @@ You can add additional folders to be protected, but you cannot remove the defaul Adding other folders to controlled folder access can be useful, for example, if you don't store files in the default Windows libraries or you've changed the location of the libraries away from the defaults. -You can also enter network shares and mapped drives. Environment variables and wildcards are supported. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists). +You can also enter network shares and mapped drives. Environment variables and wildcards are supported. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists). You can use the Windows Security app or Group Policy to add and remove additional protected folders. @@ -55,14 +56,14 @@ You can use the Windows Security app or Group Policy to add and remove additiona 3. Under the **Controlled folder access** section, click **Protected folders** 4. Click **Add a protected folder** and follow the prompts to add apps. - + ### Use Group Policy to protect additional folders -1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor**, go to **Computer configuration** and click **Administrative templates**. -3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Controlled folder access**. +3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Controlled folder access**. 4. Double-click **Configured protected folders** and set the option to **Enabled**. Click **Show** and enter each folder. @@ -77,10 +78,10 @@ You can use the Windows Security app or Group Policy to add and remove additiona Continue to use `Add-MpPreference -ControlledFolderAccessProtectedFolders` to add more folders to the list. Folders added using this cmdlet will appear in the Windows Security app. -![Screenshot of a PowerShell window with the cmdlet above entered](images/cfa-allow-folder-ps.png) +![Screenshot of a PowerShell window with the cmdlet above entered](../images/cfa-allow-folder-ps.png) ->[!IMPORTANT] ->Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. +> [!IMPORTANT] +> Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. ### Use MDM CSPs to protect additional folders @@ -88,17 +89,16 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersList](https://docs.m ## Allow specific apps to make changes to controlled folders -You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you're finding a particular app that you know and trust is being blocked by the controlled folder access feature. +You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you're finding a particular app that you know and trust is being blocked by the controlled folder access feature. ->[!IMPORTANT] ->By default, Windows adds apps that it considers friendly to the allowed list—apps added automatically by Windows are not recorded in the list shown in the Windows Security app or by using the associated PowerShell cmdlets. ->You shouldn't need to add most apps. Only add apps if they are being blocked and you can verify their trustworthiness. +> [!IMPORTANT] +> By default, Windows adds apps that it considers friendly to the allowed list—apps added automatically by Windows are not recorded in the list shown in the Windows Security app or by using the associated PowerShell cmdlets. +> You shouldn't need to add most apps. Only add apps if they are being blocked and you can verify their trustworthiness. When you add an app, you have to specify the app's location. Only the app in that location will be permitted access to the protected folders - if the app (with the same name) is located in a different location, then it will not be added to the allow list and may be blocked by controlled folder access. An allowed application or service only has write access to a controlled folder after it starts. For example, if you allow an update service that is already running, the update service will continue to trigger events until the service is stopped and restarted. - ### Use the Windows Defender Security app to allow specific apps 1. Open the Windows Security by clicking the shield icon in the task bar or searching the start menu for **Defender**. @@ -109,15 +109,15 @@ An allowed application or service only has write access to a controlled folder a 4. Click **Add an allowed app** and follow the prompts to add apps. - ![Screenshot of how to add an allowed app button](images/cfa-allow-app.png) + ![Screenshot of how to add an allowed app button](../images/cfa-allow-app.png) ### Use Group Policy to allow specific apps -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Controlled folder access**. +3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Controlled folder access**. 4. Double-click the **Configure allowed applications** setting and set the option to **Enabled**. Click **Show** and enter each app. @@ -135,22 +135,24 @@ An allowed application or service only has write access to a controlled folder a ```PowerShell Add-MpPreference -ControlledFolderAccessAllowedApplications "c:\apps\test.exe" ``` + Continue to use `Add-MpPreference -ControlledFolderAccessAllowedApplications` to add more apps to the list. Apps added using this cmdlet will appear in the Windows Security app. -![Screenshot of a PowerShell window with the above cmdlet entered](images/cfa-allow-app-ps.png) +![Screenshot of a PowerShell window with the above cmdlet entered](../images/cfa-allow-app-ps.png) ->[!IMPORTANT] ->Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. +> [!IMPORTANT] +> Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. ### Use MDM CSPs to allow specific apps -Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersAllowedApplications](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-guardedfoldersallowedapplications) configuration service provider (CSP) to allow apps to make changes to protected folders. +Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersAllowedApplications](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-guardedfoldersallowedapplications) configuration service provider (CSP) to allow apps to make changes to protected folders. ## Customize the notification See the [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. ## Related topics -- [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) -- [Enable controlled folder access](enable-controlled-folders-exploit-guard.md) -- [Evaluate attack surface reduction rules](evaluate-windows-defender-exploit-guard.md) + +* [Protect important folders with controlled folder access](controlled-folders.md) +* [Enable controlled folder access](enable-controlled-folders.md) +* [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md similarity index 72% rename from windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md index f6197a0a67..64a77031bf 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 03/26/2019 @@ -20,18 +21,18 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Exploit protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps. - + You configure these settings using the Windows Security app on an individual machine, and then export the configuration as an XML file that you can deploy to other machines. You can use Group Policy to distribute the XML file to multiple devices at once. You can also configure the mitigations with PowerShell. - This topic lists each of the mitigations available in exploit protection, indicates whether the mitigation can be applied system-wide or to individual apps, and provides a brief description of how the mitigation works. +This topic lists each of the mitigations available in exploit protection, indicates whether the mitigation can be applied system-wide or to individual apps, and provides a brief description of how the mitigation works. It also describes how to enable or configure the mitigations using Windows Security, PowerShell, and MDM CSPs. This is the first step in creating a configuration that you can deploy across your network. The next step involves [generating or exporting, importing, and deploying the configuration to multiple devices](import-export-exploit-protection-emet-xml.md). ->[!WARNING] ->Some security mitigation technologies may have compatibility issues with some applications. You should test exploit protection in all target use scenarios by using [audit mode](evaluate-exploit-protection.md) before deploying the configuration across a production environment or the rest of your network. +> [!WARNING] +> Some security mitigation technologies may have compatibility issues with some applications. You should test exploit protection in all target use scenarios by using [audit mode](evaluate-exploit-protection.md) before deploying the configuration across a production environment or the rest of your network. ## Exploit protection mitigations @@ -39,87 +40,87 @@ All mitigations can be configured for individual apps. Some mitigations can also You can set each of the mitigations to on, off, or to their default value. Some mitigations have additional options, these are indicated in the description in the table. -Default values are always specified in brackets at the **Use default** option for each mitigation. In the following example, the default for Data Execution Prevention is "On". +Default values are always specified in brackets at the **Use default** option for each mitigation. In the following example, the default for Data Execution Prevention is "On". The **Use default** configuration for each of the mitigation settings indicates our recommendation for a base level of protection for everyday usage for home users. Enterprise deployments should consider the protection required for their individual needs and may need to modify configuration away from the defaults. For the associated PowerShell cmdlets for each mitigation, see the [PowerShell reference table](#cmdlets-table) at the bottom of this topic. Mitigation | Description | Can be applied to | Audit mode available -- | - | - | :-: -Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | [!include[Check mark no](images/svg/check-no.svg)] -Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | [!include[Check mark no](images/svg/check-no.svg)] -Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | [!include[Check mark no](images/svg/check-no.svg)] -Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations including those for system structures heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](images/svg/check-no.svg)] -Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | [!include[Check mark no](images/svg/check-no.svg)] -Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | [!include[Check mark no](images/svg/check-no.svg)] -Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)] -Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)] -Block remote images | Prevents loading of images from remote devices. | App-level only | [!include[Check mark no](images/svg/check-no.svg)] -Block untrusted fonts | Prevents loading any GDI-based fonts not installed in the system fonts directory, notably fonts from the web. | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)] -Code integrity guard | Restricts loading of images signed by Microsoft, WHQL, or higher. Can optionally allow Microsoft Store signed images. | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)] -Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | App-level only | [!include[Check mark no](images/svg/check-no.svg)] -Disable Win32k system calls | Prevents an app from using the Win32k system call table. | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)] -Do not allow child processes | Prevents an app from creating child processes. | App-level only | [!include[Check mark yes](images/svg/check-yes.svg)] -Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | [!include[Check mark no](images/svg/check-no.svg)] -Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | [!include[Check mark no](images/svg/check-no.svg)] -Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark no](images/svg/check-no.svg)] -Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark no](images/svg/check-no.svg)] -Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | [!include[Check mark no](images/svg/check-no.svg)] -Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | [!include[Check mark no](images/svg/check-no.svg)] -Validate stack integrity (StackPivot) | Ensures that the stack has not been redirected for sensitive APIs. Not compatible with ACG | App-level only | [!include[Check mark no](images/svg/check-no.svg)] +-|-|-|- +Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] +Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] +Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] +Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations including those for system structures heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] +Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] +Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] +Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] +Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] +Block remote images | Prevents loading of images from remote devices. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] +Block untrusted fonts | Prevents loading any GDI-based fonts not installed in the system fonts directory, notably fonts from the web. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] +Code integrity guard | Restricts loading of images signed by Microsoft, WHQL, or higher. Can optionally allow Microsoft Store signed images. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] +Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] +Disable Win32k system calls | Prevents an app from using the Win32k system call table. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] +Do not allow child processes | Prevents an app from creating child processes. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] +Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] +Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] +Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] +Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] +Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] +Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] +Validate stack integrity (StackPivot) | Ensures that the stack has not been redirected for sensitive APIs. Not compatible with ACG | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] ->[!IMPORTANT] ->If you add an app to the **Program settings** section and configure individual mitigation settings there, they will be honored above the configuration for the same mitigations specified in the **System settings** section. The following matrix and examples help to illustrate how defaults work: +> [!IMPORTANT] +> If you add an app to the **Program settings** section and configure individual mitigation settings there, they will be honored above the configuration for the same mitigations specified in the **System settings** section. The following matrix and examples help to illustrate how defaults work: > > ->Enabled in **Program settings** | Enabled in **System settings** | Behavior ->:-: | :-: | :-: ->[!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | As defined in **Program settings** ->[!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | As defined in **Program settings** ->[!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | As defined in **System settings** ->[!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | Default as defined in **Use default** option +> Enabled in **Program settings** | Enabled in **System settings** | Behavior +> -|-|- +> [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] | As defined in **Program settings** +> [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **Program settings** +> [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **System settings** +> [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | Default as defined in **Use default** option > > -> ->- **Example 1** -> +> +> * **Example 1** +> > Mikael configures **Data Execution Prevention (DEP)** in the **System settings** section to be **Off by default**. -> +> > Mikael then adds the app *test.exe* to the **Program settings** section. In the options for that app, under **Data Execution Prevention (DEP)**, he enables the **Override system settings** option and sets the switch to **On**. There are no other apps listed in the **Program settings** section. -> ->The result will be that DEP only will be enabled for *test.exe*. All other apps will not have DEP applied. -> -> ->- **Example 2** -> +> +> The result will be that DEP only will be enabled for *test.exe*. All other apps will not have DEP applied. +> +> +> * **Example 2** +> > Josie configures **Data Execution Prevention (DEP)** in the **System settings** section to be **Off by default**. > -> Josie then adds the app *test.exe* to the **Program settings** section. In the options for that app, under **Data Execution Prevention (DEP)**, she enables the **Override system settings** option and sets the switch to **On**. +> Josie then adds the app *test.exe* to the **Program settings** section. In the options for that app, under **Data Execution Prevention (DEP)**, she enables the **Override system settings** option and sets the switch to **On**. > > Josie also adds the app *miles.exe* to the **Program settings** section and configures **Control flow guard (CFG)** to **On**. She doesn't enable the **Override system settings** option for DEP or any other mitigations for that app. > ->The result will be that DEP will be enabled for *test.exe*. DEP will not be enabled for any other app, including *miles.exe*. +>The result will be that DEP will be enabled for *test.exe*. DEP will not be enabled for any other app, including *miles.exe*. >CFG will be enabled for *miles.exe*. ->[!NOTE] ->If you have found any issues in this article, you can report it directly to a Windows Server/Windows Client partner or use the Microsoft technical support numbers for your country. +> [!NOTE] +> If you have found any issues in this article, you can report it directly to a Windows Server/Windows Client partner or use the Microsoft technical support numbers for your country. ### Configure system-level mitigations with the Windows Security app 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**. - + 3. Under the **System settings** section, find the mitigation you want to configure and select one of the following. Apps that aren't configured individually in the **Program settings** section will use the settings configured here: - - **On by default** - The mitigation is *enabled* for apps that don't have this mitigation set in the app-specific **Program settings** section - - **Off by default** - The mitigation is *disabled* for apps that don't have this mitigation set in the app-specific **Program settings** section - - **Use default** - The mitigation is either enabled or disabled, depending on the default configuration that is set up by Windows 10 installation; the default value (**On** or **Off**) is always specified next to the **Use default** label for each mitigation + * **On by default** - The mitigation is *enabled* for apps that don't have this mitigation set in the app-specific **Program settings** section + * **Off by default** - The mitigation is *disabled* for apps that don't have this mitigation set in the app-specific **Program settings** section + * **Use default** - The mitigation is either enabled or disabled, depending on the default configuration that is set up by Windows 10 installation; the default value (**On** or **Off**) is always specified next to the **Use default** label for each mitigation >[!NOTE] >You may see a User Account Control window when changing some settings. Enter administrator credentials to apply the setting. - Changing some settings may require a restart. + Changing some settings may require a restart. 4. Repeat this for all the system-level mitigations you want to configure. @@ -127,15 +128,14 @@ Validate stack integrity (StackPivot) | Ensures that the stack has not been redi 1. If the app you want to configure is already listed, click it and then click **Edit** 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app: - - Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. - - Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. - + * Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. + * Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. + 6. After selecting the app, you'll see a list of all the mitigations that can be applied. To enable the mitigation, click the check box and then change the slider to **On**. Select any additional options. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows. 7. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration. - -You can now [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) or continue on to configure app-specific mitigations. +You can now [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) or continue on to configure app-specific mitigations. Exporting the configuration as an XML file allows you to copy the configuration from one machine onto other machines. @@ -151,33 +151,34 @@ Exporting the configuration as an XML file allows you to copy the configuration You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app: ```PowerShell -Get-ProcessMitigation -Name processName.exe +Get-ProcessMitigation -Name processName.exe ``` ->[!IMPORTANT] ->System-level mitigations that have not been configured will show a status of `NOTSET`. +> [!IMPORTANT] +> System-level mitigations that have not been configured will show a status of `NOTSET`. > ->For system-level settings, `NOTSET` indicates the default setting for that mitigation has been applied. +> For system-level settings, `NOTSET` indicates the default setting for that mitigation has been applied. > ->For app-level settings, `NOTSET` indicates the system-level setting for the mitigation will be applied. +> For app-level settings, `NOTSET` indicates the system-level setting for the mitigation will be applied. > ->The default setting for each system-level mitigation can be seen in the Windows Security. +> The default setting for each system-level mitigation can be seen in the Windows Security. Use `Set` to configure each mitigation in the following format: ```PowerShell Set-ProcessMitigation - - ,, ``` + Where: -- \: - - `-Name` to indicate the mitigations should be applied to a specific app. Specify the app's executable after this flag. - - `-System` to indicate the mitigation should be applied at the system level +* \: + * `-Name` to indicate the mitigations should be applied to a specific app. Specify the app's executable after this flag. + * `-System` to indicate the mitigation should be applied at the system level - \: - - `-Enable` to enable the mitigation - - `-Disable` to disable the mitigation -- \: - - The mitigation's cmdlet as defined in the [mitigation cmdlets table](#cmdlets-table) below, along with any suboptions (surrounded with spaces). Each mitigation is separated with a comma. + * `-Enable` to enable the mitigation + * `-Disable` to disable the mitigation +* \: + * The mitigation's cmdlet as defined in the [mitigation cmdlets table](#cmdlets-table) below, along with any suboptions (surrounded with spaces). Each mitigation is separated with a comma. For example, to enable the Data Execution Prevention (DEP) mitigation with ATL thunk emulation and for an executable called *testing.exe* in the folder *C:\Apps\LOB\tests*, and to prevent that executable from creating child processes, you'd use the following command: @@ -185,8 +186,8 @@ Where: Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP, EmulateAtlThunks, DisallowChildProcessCreation ``` - >[!IMPORTANT] - >Separate each mitigation option with commas. + > [!IMPORTANT] + > Separate each mitigation option with commas. If you wanted to apply DEP at the system level, you'd use the following command: @@ -202,8 +203,7 @@ Where: Set-Processmitigation -Name test.exe -Remove -Disable DEP ``` - - You can also set some mitigations to audit mode. Instead of using the PowerShell cmdlet for the mitigation, use the **Audit mode** cmdlet as specified in the [mitigation cmdlets table](#cmdlets-table) below. + You can also set some mitigations to audit mode. Instead of using the PowerShell cmdlet for the mitigation, use the **Audit mode** cmdlet as specified in the [mitigation cmdlets table](#cmdlets-table) below. For example, to enable Arbitrary Code Guard (ACG) in audit mode for the *testing.exe* used in the example above, you'd use the following command: @@ -215,11 +215,10 @@ You can disable audit mode by using the same command but replacing `-Enable` wit ### PowerShell reference table -This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that can be used to configure each mitigation. +This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that can be used to configure each mitigation. - Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet - | - | - | - Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available @@ -228,39 +227,36 @@ Force randomization for images (Mandatory ASLR) | System and app-level | Force Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available Validate heap integrity | System and app-level | TerminateOnError | Audit not available -Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode -Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad -Block remote images | App-level only | BlockRemoteImages | Audit not available -Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly -Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned +Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode +Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad +Block remote images | App-level only | BlockRemoteImages | Audit not available +Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly +Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned Disable extension points | App-level only | ExtensionPoint | Audit not available Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess -Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter \[1\] | Audit not available -Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available -Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available -Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available +Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter \[1\] | Audit not available +Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available +Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available +Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available Validate handle usage | App-level only | StrictHandle | Audit not available -Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available -Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available - - +Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available +Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available \[1\]: Use the following format to enable EAF modules for dlls for a process: ```PowerShell -Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll +Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll ``` - ## Customize the notification See the [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. ## Related topics -- [Protect devices from exploits](exploit-protection-exploit-guard.md) -- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) -- [Evaluate exploit protection](evaluate-exploit-protection.md) -- [Enable exploit protection](enable-exploit-protection.md) -- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) +* [Protect devices from exploits](exploit-protection.md) +* [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection.md) +* [Evaluate exploit protection](evaluate-exploit-protection.md) +* [Enable exploit protection](enable-exploit-protection.md) +* [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md b/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md index 249bf4cfb4..0a4d585b53 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md +++ b/windows/security/threat-protection/microsoft-defender-atp/data-retention-settings.md @@ -26,7 +26,7 @@ ms.date: 04/24/2018 ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-gensettings-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-gensettings-abovefoldlink) During the onboarding process, a wizard takes you through the general settings of Microsoft Defender ATP. After onboarding, you might want to update the data retention settings. diff --git a/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy.md b/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy.md index 2ad4f2c528..a16de0a429 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy.md +++ b/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy.md @@ -90,6 +90,6 @@ Microsoft Defender ATP for Government (soon to be in preview) is currently under By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run. -For more information on the Microsoft Defender ATP ISO certification reports, see [Microsoft Trust Center](https://www.microsoft.com/en-us/trustcenter/compliance/iso-iec-27001). +For more information on the Microsoft Defender ATP ISO certification reports, see [Microsoft Trust Center](https://www.microsoft.com/trustcenter/compliance/iso-iec-27001). ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-datastorage-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-datastorage-belowfoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility.md b/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility.md index 4d9d0fa3ce..42ef196d91 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility.md @@ -28,7 +28,7 @@ ms.date: 04/24/2018 ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-defendercompat-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-defendercompat-abovefoldlink) The Microsoft Defender Advanced Threat Protection agent depends on Windows Defender Antivirus for some capabilities such as file scanning. diff --git a/windows/security/threat-protection/microsoft-defender-atp/deprecate.md b/windows/security/threat-protection/microsoft-defender-atp/deprecate.md deleted file mode 100644 index da3414815c..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/deprecate.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -ms.date: 10/17/2018 -ms.reviewer: -manager: dansimp -ms.author: mjcaparas -author: mjcaparas ---- -> [!WARNING] -> -> -> This page documents a feature that will soon be deprecated. For the updated and supported version, see [Use the Microsoft Defender ATP APIs](use-apis.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/emet-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/emet-exploit-protection.md new file mode 100644 index 0000000000..73df2fb5a4 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/emet-exploit-protection.md @@ -0,0 +1,87 @@ +--- +title: Compare the features in Exploit protection with EMET +keywords: emet, enhanced mitigation experience toolkit, configuration, exploit, compare, difference between, versus, upgrade, convert +description: Exploit protection in Windows 10 provides advanced configuration over the settings offered in EMET. +search.product: eADQiWindows 10XVcnh +ms.pagetype: security +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +author: levinec +ms.author: ellevin +ms.date: 08/08/2018 +ms.reviewer: +manager: dansimp +--- + +# Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender + +**Applies to:** + +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +> [!IMPORTANT] +> If you are currently using EMET, you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with exploit protection in Microsoft Defender ATP. +> +> You can [convert an existing EMET configuration file into Exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings. + +This topic describes the differences between the Enhance Mitigation Experience Toolkit (EMET) and exploit protection in Microsoft Defender ATP. + +Exploit protection in Microsoft Defender ATP is our successor to EMET and provides stronger protection, more customization, an easier user interface, and better configuration and management options. + +EMET is a standalone product for earlier versions of Windows and provides some mitigation against older, known exploit techniques. + +After July 31, 2018, it will not be supported. + +For more information about the individual features and mitigations available in Microsoft Defender ATP, as well as how to enable, configure, and deploy them to better protect your network, see the following topics: + +* [Protect devices from exploits](exploit-protection.md) +* [Configure and audit exploit protection mitigations](customize-exploit-protection.md) + +## Mitigation comparison + +The mitigations available in EMET are included in Windows Defender, under the [exploit protection feature](exploit-protection.md). + +The table in this section indicates the availability and support of native mitigations between EMET and Exploit protection. + +Mitigation | Available in Windows Defender | Available in EMET +-|-|- +Arbitrary code guard (ACG) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)]
                        As "Memory Protection Check" +Block remote images | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)]
                        As "Load Library Check" +Block untrusted fonts | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Data Execution Prevention (DEP) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Export address filtering (EAF) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Force randomization for images (Mandatory ASLR) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +NullPage Security Mitigation | [!include[Check mark yes](../images/svg/check-yes.svg)]
                        Included natively in Windows 10
                        See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](../images/svg/check-yes.svg)] +Randomize memory allocations (Bottom-Up ASLR) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Simulate execution (SimExec) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Validate API invocation (CallerCheck) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Validate exception chains (SEHOP) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Validate stack integrity (StackPivot) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Certificate trust (configurable certificate pinning) | Windows 10 provides enterprise certificate pinning | [!include[Check mark yes](../images/svg/check-yes.svg)] +Heap spray allocation | Ineffective against newer browser-based exploits; newer mitigations provide better protection
                        See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](../images/svg/check-yes.svg)] +Block low integrity images | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Code integrity guard | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Disable extension points | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Disable Win32k system calls | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Do not allow child processes | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Import address filtering (IAF) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Validate handle usage | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Validate heap integrity | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Validate image dependency integrity | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] + +> [!NOTE] +> The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10, which other EMET advanced settings are enabled by default in Windows Defender as part of enabling the anti-ROP mitigations for a process. +> +> See the [Mitigation threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information on how Windows 10 employs existing EMET technology. + +## Related topics + +* [Protect devices from exploits with Windows Defender](exploit-protection.md) +* [Evaluate exploit protection](evaluate-exploit-protection.md) +* [Enable exploit protection](enable-exploit-protection.md) +* [Configure and audit exploit protection mitigations](customize-exploit-protection.md) +* [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/enable-attack-surface-reduction.md similarity index 68% rename from windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md rename to windows/security/threat-protection/microsoft-defender-atp/enable-attack-surface-reduction.md index b346df9a75..80c8e25156 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-attack-surface-reduction.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 05/13/2019 @@ -18,7 +19,7 @@ manager: dansimp # Enable attack surface reduction rules -[Attack surface reduction rules](attack-surface-reduction-exploit-guard.md) help prevent actions and apps that malware often uses to infect computers. You can set attack surface reduction rules for computers running Windows 10 or Windows Server 2019. +[Attack surface reduction rules](attack-surface-reduction.md) help prevent actions and apps that malware often uses to infect computers. You can set attack surface reduction rules for computers running Windows 10 or Windows Server 2019. Each ASR rule contains three settings: @@ -30,11 +31,11 @@ To use ASR rules, you need either a Windows 10 Enterprise E3 or E5 license. We r You can enable attack surface reduction rules by using any of these methods: -- [Microsoft Intune](#intune) -- [Mobile Device Management (MDM)](#mdm) -- [System Center Configuration Manager (SCCM)](#sccm) -- [Group Policy](#group-policy) -- [PowerShell](#powershell) +* [Microsoft Intune](#intune) +* [Mobile Device Management (MDM)](#mdm) +* [System Center Configuration Manager (SCCM)](#sccm) +* [Group Policy](#group-policy) +* [PowerShell](#powershell) Enterprise-level management such as Intune or SCCM is recommended. Enterprise-level management will overwrite any conflicting Group Policy or PowerShell settings on startup. @@ -42,20 +43,20 @@ Enterprise-level management such as Intune or SCCM is recommended. Enterprise-le You can exclude files and folders from being evaluated by most attack surface reduction rules. This means that even if an ASR rule determines the file or folder contains malicious behavior, it will not block the file from running. This could potentially allow unsafe files to run and infect your devices. ->[!WARNING] ->Excluding files or folders can severely reduce the protection provided by ASR rules. Excluded files will be allowed to run, and no report or event will be recorded. -> ->If ASR rules are detecting files that you believe shouldn't be detected, you should [use audit mode first to test the rule](evaluate-attack-surface-reduction.md). - ->[!IMPORTANT] ->File and folder exclusions do not apply to the following ASR rules: +> [!WARNING] +> Excluding files or folders can severely reduce the protection provided by ASR rules. Excluded files will be allowed to run, and no report or event will be recorded. > ->- Block process creations originating from PSExec and WMI commands ->- Block JavaScript or VBScript from launching downloaded executable content +> If ASR rules are detecting files that you believe shouldn't be detected, you should [use audit mode first to test the rule](evaluate-attack-surface-reduction.md). + +> [!IMPORTANT] +> File and folder exclusions do not apply to the following ASR rules: +> +> * Block process creations originating from PSExec and WMI commands +> * Block JavaScript or VBScript from launching downloaded executable content You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules the exclusions apply to. An exclusion is applied only when the excluded application or service starts. For example, if you add an exclusion for an update service that is already running, the update service will continue to trigger events until the service is stopped and restarted. -ASR rules support environment variables and wildcards. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists). +ASR rules support environment variables and wildcards. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists). The following procedures for enabling ASR rules include instructions for how to exclude files and folders. @@ -66,8 +67,8 @@ The following procedures for enabling ASR rules include instructions for how to 2. In the **Endpoint protection** pane, select **Windows Defender Exploit Guard**, then select **Attack Surface Reduction**. Select the desired setting for each ASR rule. 3. Under **Attack Surface Reduction exceptions**, you can enter individual files and folders, or you can select **Import** to import a CSV file that contains files and folders to exclude from ASR rules. Each line in the CSV file should be in the following format: - - *C:\folder*, *%ProgramFiles%\folder\file*, *C:\path* + + *C:\folder*, *%ProgramFiles%\folder\file*, *C:\path* 4. Select **OK** on the three configuration panes and then select **Create** if you're creating a new endpoint protection file or **Save** if you're editing an existing one. @@ -75,7 +76,7 @@ The following procedures for enabling ASR rules include instructions for how to Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductionrules) configuration service provider (CSP) to individually enable and set the mode for each rule. -The following is a sample for reference, using [GUID values for ASR rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard#attack-surface-reduction-rules). +The following is a sample for reference, using [GUID values for ASR rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction#attack-surface-reduction-rules). OMA-URI path: ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules @@ -83,9 +84,9 @@ Value: {75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84}=2|{3B576869-A4EC-4529-8536-B80A776 The values to enable, disable, or enable in audit mode are: -- Disable = 0 -- Block (enable ASR rule) = 1 -- Audit = 2 +* Disable = 0 +* Block (enable ASR rule) = 1 +* Audit = 2 Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductiononlyexclusions) configuration service provider (CSP) to add exclusions. @@ -95,8 +96,8 @@ OMA-URI path: ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExc Value: c:\path|e:\path|c:\Whitelisted.exe ->[!NOTE] ->Be sure to enter OMA-URI values without spaces. +> [!NOTE] +> Be sure to enter OMA-URI values without spaces. ## SCCM @@ -105,12 +106,12 @@ Value: c:\path|e:\path|c:\Whitelisted.exe 1. Enter a name and a description, click **Attack Surface Reduction**, and click **Next**. 1. Choose which rules will block or audit actions and click **Next**. 1. Review the settings and click **Next** to create the policy. -1. After the policy is created, click **Close**. +1. After the policy is created, click **Close**. ## Group Policy ->[!WARNING] ->If you manage your computers and devices with Intune, SCCM, or other enterprise-level management platform, the management software will overwrite any conflicting Group Policy settings on startup. +> [!WARNING] +> If you manage your computers and devices with Intune, SCCM, or other enterprise-level management platform, the management software will overwrite any conflicting Group Policy settings on startup. 1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. @@ -119,15 +120,17 @@ Value: c:\path|e:\path|c:\Whitelisted.exe 3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Attack surface reduction**. 4. Select **Configure Attack surface reduction rules** and select **Enabled**. You can then set the individual state for each rule in the options section: - - Click **Show...** and enter the rule ID in the **Value name** column and your desired state in the **Value** column as follows: - - Disable = 0 - - Block (enable ASR rule) = 1 - - Audit = 2 - ![Group policy setting showing a blank attack surface reduction rule ID and value of 1](images/asr-rules-gp.png) + * Click **Show...** and enter the rule ID in the **Value name** column and your desired state in the **Value** column as follows: + + * Disable = 0 + * Block (enable ASR rule) = 1 + * Audit = 2 + + ![Group policy setting showing a blank attack surface reduction rule ID and value of 1](../images/asr-rules-gp.png) + +5. To exclude files and folders from ASR rules, select the **Exclude files and paths from Attack surface reduction rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. -5. To exclude files and folders from ASR rules, select the **Exclude files and paths from Attack surface reduction rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item. - ## PowerShell >[!WARNING] @@ -141,32 +144,32 @@ Value: c:\path|e:\path|c:\Whitelisted.exe Set-MpPreference -AttackSurfaceReductionRules_Ids -AttackSurfaceReductionRules_Actions Enabled ``` - To enable ASR rules in audit mode, use the following cmdlet: + To enable ASR rules in audit mode, use the following cmdlet: - ```PowerShell - Add-MpPreference -AttackSurfaceReductionRules_Ids -AttackSurfaceReductionRules_Actions AuditMode + ```PowerShell + Add-MpPreference -AttackSurfaceReductionRules_Ids -AttackSurfaceReductionRules_Actions AuditMode ``` - To turn off ASR rules, use the following cmdlet: + To turn off ASR rules, use the following cmdlet: - ```PowerShell - Add-MpPreference -AttackSurfaceReductionRules_Ids -AttackSurfaceReductionRules_Actions Disabled + ```PowerShell + Add-MpPreference -AttackSurfaceReductionRules_Ids -AttackSurfaceReductionRules_Actions Disabled ``` - >[!IMPORTANT] - >You must specify the state individually for each rule, but you can combine rules and states in a comma-separated list. - > - >In the following example, the first two rules will be enabled, the third rule will be disabled, and the fourth rule will be enabled in audit mode: - > - >```PowerShell - >Set-MpPreference -AttackSurfaceReductionRules_Ids ,,, -AttackSurfaceReductionRules_Actions Enabled, Enabled, Disabled, AuditMode - >``` + > [!IMPORTANT] + > You must specify the state individually for each rule, but you can combine rules and states in a comma-separated list. + > + > In the following example, the first two rules will be enabled, the third rule will be disabled, and the fourth rule will be enabled in audit mode: + > + > ```PowerShell + > Set-MpPreference -AttackSurfaceReductionRules_Ids ,,, -AttackSurfaceReductionRules_Actions Enabled, Enabled, Disabled, AuditMode + > ``` - You can also the `Add-MpPreference` PowerShell verb to add new rules to the existing list. + You can also the `Add-MpPreference` PowerShell verb to add new rules to the existing list. - >[!WARNING] - >`Set-MpPreference` will always overwrite the existing set of rules. If you want to add to the existing set, you should use `Add-MpPreference` instead. - >You can obtain a list of rules and their current state by using `Get-MpPreference` + > [!WARNING] + > `Set-MpPreference` will always overwrite the existing set of rules. If you want to add to the existing set, you should use `Add-MpPreference` instead. + > You can obtain a list of rules and their current state by using `Get-MpPreference` 3. To exclude files and folders from ASR rules, use the following cmdlet: @@ -174,14 +177,13 @@ Value: c:\path|e:\path|c:\Whitelisted.exe Add-MpPreference -AttackSurfaceReductionOnlyExclusions "" ``` - Continue to use `Add-MpPreference -AttackSurfaceReductionOnlyExclusions` to add more files and folders to the list. - - >[!IMPORTANT] - >Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. + Continue to use `Add-MpPreference -AttackSurfaceReductionOnlyExclusions` to add more files and folders to the list. + > [!IMPORTANT] + > Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. ## Related topics -- [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction-exploit-guard.md) -- [Evaluate attack surface reduction](evaluate-attack-surface-reduction.md) -- [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus) +* [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction.md) +* [Evaluate attack surface reduction](evaluate-attack-surface-reduction.md) +* [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md b/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md similarity index 57% rename from windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md rename to windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md index 29ed15335f..40cbdce038 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 05/13/2019 @@ -20,24 +21,25 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[Controlled folder access](controlled-folders-exploit-guard.md) helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). Controlled folder access is included with Windows 10 and Windows Server 2019. +[Controlled folder access](controlled-folders.md) helps you protect valuable data from malicious apps and threats, such as ransomware. Controlled folder access is included with Windows 10 and Windows Server 2019. You can enable controlled folder access by using any of these methods: -- [Windows Security app](#windows-security-app) -- [Microsoft Intune](#intune) -- [Mobile Device Management (MDM)](#mdm) -- [System Center Configuration Manager (SCCM)](#sccm) -- [Group Policy](#group-policy) -- [PowerShell](#powershell) +* [Windows Security app](#windows-security-app) +* [Microsoft Intune](#intune) +* [Mobile Device Management (MDM)](#mdm) +* [System Center Configuration Manager (SCCM)](#sccm) +* [Group Policy](#group-policy) +* [PowerShell](#powershell) [Audit mode](evaluate-controlled-folder-access.md) allows you to test how the feature would work (and review events) without impacting the normal use of the machine. Group Policy settings that disable local administrator list merging will override controlled folder access settings. They also override protected folders and allowed apps set by the local administrator through controlled folder access. These policies include: -- Windows Defender Antivirus **Configure local administrator merge behavior for lists** -- System Center Endpoint Protection **Allow users to add exclusions and overrides** + +* Windows Defender Antivirus **Configure local administrator merge behavior for lists** +* System Center Endpoint Protection **Allow users to add exclusions and overrides** For more information about disabling local list merging, see [Prevent or allow users to locally modify Windows Defender AV policy settings](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus#configure-how-locally-and-globally-defined-threat-remediation-and-exclusions-lists-are-merged). @@ -49,30 +51,32 @@ For more information about disabling local list merging, see [Prevent or allow u 3. Set the switch for **Controlled folder access** to **On**. ->[!NOTE] ->If controlled folder access is configured with Group Policy, PowerShell, or MDM CSPs, the state will change in the Windows Security app after a restart of the device. ->If the feature is set to **Audit mode** with any of those tools, the Windows Security app will show the state as **Off**. +> [!NOTE] +> If controlled folder access is configured with Group Policy, PowerShell, or MDM CSPs, the state will change in the Windows Security app after a restart of the device. +> If the feature is set to **Audit mode** with any of those tools, the Windows Security app will show the state as **Off**. + +> If you are protecting user profile data, we recommend that the user profile should be on the default Windows installation drive. ## Intune 1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune. 1. Click **Device configuration** > **Profiles** > **Create profile**. 1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**. - ![Create endpoint protection profile](images/create-endpoint-protection-profile.png) -1. Click **Configure** > **Windows Defender Exploit Guard** > **Network filtering** > **Enable**. -1. Type the path to each application that has access to protected folders and the path to any additional folder that needs protection and click **Add**. + ![Create endpoint protection profile](../images/create-endpoint-protection-profile.png) +1. Click **Configure** > **Windows Defender Exploit Guard** > **Controlled folder access** > **Enable**. +1. Type the path to each application that has access to protected folders and the path to any additional folder that needs protection and click **Add**. - ![Enable controlled folder access in Intune](images/enable-cfa-intune.png) + ![Enable controlled folder access in Intune](../images/enable-cfa-intune.png) - >[!NOTE] - >Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted. + > [!NOTE] + > Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted. -1. Click **OK** to save each open blade and click **Create**. +1. Click **OK** to save each open blade and click **Create**. 1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**. -## MDM +## MDM -Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-controlledfolderaccessprotectedfolders) configuration service provider (CSP) to allow apps to make changes to protected folders. +Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-controlledfolderaccessprotectedfolders) configuration service provider (CSP) to allow apps to make changes to protected folders. ## SCCM @@ -80,28 +84,28 @@ Use the [./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders](htt 2. Click **Home** > **Create Exploit Guard Policy**. 3. Enter a name and a description, click **Controlled folder access**, and click **Next**. 4. Choose whether block or audit changes, allow other apps, or add other folders, and click **Next**. - >[!NOTE] - >Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted. + > [!NOTE] + > Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted. 5. Review the settings and click **Next** to create the policy. -6. After the policy is created, click **Close**. +6. After the policy is created, click **Close**. ## Group Policy -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled folder access**. +3. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled folder access**. -6. Double-click the **Configure Controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: - - **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log - - **Disable (Default)** - The Controlled folder access feature will not work. All apps can make changes to files in protected folders. - - **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. +4. Double-click the **Configure Controlled folder access** setting and set the option to **Enabled**. In the options section you must specify one of the following: + * **Enable** - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log + * **Disable (Default)** - The Controlled folder access feature will not work. All apps can make changes to files in protected folders. + * **Audit Mode** - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization. - ![Screenshot of group policy option with Enabled and then Enable selected in the drop-down](images/cfa-gp-enable.png) + ![Screenshot of group policy option with Enabled and then Enable selected in the drop-down](../images/cfa-gp-enable.png) ->[!IMPORTANT] ->To fully enable controlled folder access, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. +> [!IMPORTANT] +> To fully enable controlled folder access, you must set the Group Policy option to **Enabled** and also select **Enable** in the options drop-down menu. ## PowerShell @@ -119,6 +123,6 @@ Use `Disabled` to turn the feature off. ## Related topics -- [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) -- [Customize controlled folder access](customize-controlled-folders-exploit-guard.md) -- [Evaluate Microsoft Defender ATP](evaluate-windows-defender-exploit-guard.md) +* [Protect important folders with controlled folder access](controlled-folders.md) +* [Customize controlled folder access](customize-controlled-folders.md) +* [Evaluate Microsoft Defender ATP](../microsoft-defender-atp/evaluate-atp.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-custom-ti.md b/windows/security/threat-protection/microsoft-defender-atp/enable-custom-ti.md deleted file mode 100644 index 754b7d28e8..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-custom-ti.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Enable the custom threat intelligence API in Microsoft Defender ATP -description: Learn how to setup the custom threat intelligence application in Microsoft Defender ATP to create custom threat intelligence (TI). -keywords: enable custom threat intelligence application, custom ti application, application name, client id, authorization url, resource, client secret, access tokens -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Enable the custom threat intelligence API in Microsoft Defender ATP (Deprecated) - -**Applies to:** - - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -> [!TIP] -> This topic has been deprecated. See [Indicators](ti-indicator.md) for the updated content. -> -> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-enablecustomti-abovefoldlink) - -Before you can create custom threat intelligence (TI) using REST API, you'll need to set up the custom threat intelligence application through Microsoft Defender Security Center. - -1. In the navigation pane, select **Settings** > **Threat intel**. - - ![Image of threat intel API menu](images/atp-threat-intel-api.png) - -2. Select **Enable threat intel API**. This activates the **Azure Active Directory application** setup sections with pre-populated values. - -3. Copy the individual values or select **Save details to file** to download a file that contains all the values. - - >[!WARNING] - >The client secret is only displayed once. Make sure you keep a copy of it in a safe place.
                        - For more information about getting a new secret see, [Learn how to get a new secret](troubleshoot-custom-ti.md#learn-how-to-get-a-new-client-secret). - -4. Select **Generate tokens** to get an access and refresh token. - -You’ll need to use the access token in the Authorization header when doing REST API calls. - -## Related topics -- [Understand threat intelligence concepts](threat-indicator-concepts.md) -- [Create custom alerts using the threat intelligence API](custom-ti-api.md) -- [PowerShell code examples for the custom threat intelligence API](powershell-example-code.md) -- [Python code examples for the custom threat intelligence API](python-example-code.md) -- [Experiment with custom threat intelligence alerts](experiment-custom-ti.md) -- [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md similarity index 70% rename from windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md index e3fd820ba9..76bada624f 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 05/09/2019 @@ -20,93 +21,93 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[Exploit protection](exploit-protection-exploit-guard.md) helps protect against malware that uses exploits to infect devices and spread. It consists of a number of mitigations that can be applied to either the operating system or individual apps. +[Exploit protection](exploit-protection.md) helps protect against malware that uses exploits to infect devices and spread. It consists of a number of mitigations that can be applied to either the operating system or individual apps. -Many features from the Enhanced Mitigation Experience Toolkit (EMET) are included in exploit protection. +Many features from the Enhanced Mitigation Experience Toolkit (EMET) are included in exploit protection. You can also set mitigations to [audit mode](evaluate-exploit-protection.md). Audit mode allows you to test how the mitigations would work (and review events) without impacting the normal use of the machine. You can enable each mitigation separately by using any of these methods: -- [Windows Security app](#windows-security-app) -- [Microsoft Intune](#intune) -- [Mobile Device Management (MDM)](#mdm) -- [System Center Configuration Manager (SCCM)](#sccm) -- [Group Policy](#group-policy) -- [PowerShell](#powershell) +* [Windows Security app](#windows-security-app) +* [Microsoft Intune](#intune) +* [Mobile Device Management (MDM)](#mdm) +* [System Center Configuration Manager (SCCM)](#sccm) +* [Group Policy](#group-policy) +* [PowerShell](#powershell) -They are configured by default in Windows 10. +They are configured by default in Windows 10. -You can set each mitigation to on, off, or to its default value. +You can set each mitigation to on, off, or to its default value. Some mitigations have additional options. -You can [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) and deploy them to other machines. +You can [export these settings as an XML file](import-export-exploit-protection-emet-xml.md) and deploy them to other machines. ## Windows Security app 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**. - + 3. Go to **Program settings** and choose the app you want to apply mitigations to: 1. If the app you want to configure is already listed, click it and then click **Edit** 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app: - - Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. - - Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. - + * Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. + * Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. + 4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows. -5. Repeat this for all the apps and mitigations you want to configure. +5. Repeat this for all the apps and mitigations you want to configure. -3. Under the **System settings** section, find the mitigation you want to configure and select one of the following. Apps that aren't configured individually in the **Program settings** section will use the settings configured here: - - **On by default** - The mitigation is *enabled* for apps that don't have this mitigation set in the app-specific **Program settings** section - - **Off by default** - The mitigation is *disabled* for apps that don't have this mitigation set in the app-specific **Program settings** section - - **Use default** - The mitigation is either enabled or disabled, depending on the default configuration that is set up by Windows 10 installation; the default value (**On** or **Off**) is always specified next to the **Use default** label for each mitigation +6. Under the **System settings** section, find the mitigation you want to configure and select one of the following. Apps that aren't configured individually in the **Program settings** section will use the settings configured here: + * **On by default** - The mitigation is *enabled* for apps that don't have this mitigation set in the app-specific **Program settings** section + * **Off by default** - The mitigation is *disabled* for apps that don't have this mitigation set in the app-specific **Program settings** section + * **Use default** - The mitigation is either enabled or disabled, depending on the default configuration that is set up by Windows 10 installation; the default value (**On** or **Off**) is always specified next to the **Use default** label for each mitigation -5. Repeat this for all the system-level mitigations you want to configure. Click **Apply** when you're done setting up your configuration. +7. Repeat this for all the system-level mitigations you want to configure. Click **Apply** when you're done setting up your configuration. If you add an app to the **Program settings** section and configure individual mitigation settings there, they will be honored above the configuration for the same mitigations specified in the **System settings** section. The following matrix and examples help to illustrate how defaults work: Enabled in **Program settings** | Enabled in **System settings** | Behavior -:-: | :-: | :-: -[!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | As defined in **Program settings** -[!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | As defined in **Program settings** -[!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | As defined in **System settings** -[!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | Default as defined in **Use default** option +-|-|- +[!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] | As defined in **Program settings** +[!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **Program settings** +[!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **System settings** +[!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | Default as defined in **Use default** option + +**Example 1** -**Example 1** - Mikael configures **Data Execution Prevention (DEP)** in the **System settings** section to be **Off by default**. Mikael then adds the app *test.exe* to the **Program settings** section. In the options for that app, under **Data Execution Prevention (DEP)**, he enables the **Override system settings** option and sets the switch to **On**. There are no other apps listed in the **Program settings** section. - + The result will be that DEP only will be enabled for *test.exe*. All other apps will not have DEP applied. **Example 2** Josie configures **Data Execution Prevention (DEP)** in the **System settings** section to be **Off by default**. -Josie then adds the app *test.exe* to the **Program settings** section. In the options for that app, under **Data Execution Prevention (DEP)**, she enables the **Override system settings** option and sets the switch to **On**. +Josie then adds the app *test.exe* to the **Program settings** section. In the options for that app, under **Data Execution Prevention (DEP)**, she enables the **Override system settings** option and sets the switch to **On**. Josie also adds the app *miles.exe* to the **Program settings** section and configures **Control flow guard (CFG)** to **On**. She doesn't enable the **Override system settings** option for DEP or any other mitigations for that app. -The result will be that DEP will be enabled for *test.exe*. DEP will not be enabled for any other app, including *miles.exe*. +The result will be that DEP will be enabled for *test.exe*. DEP will not be enabled for any other app, including *miles.exe*. CFG will be enabled for *miles.exe*. 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**. - + 3. Go to **Program settings** and choose the app you want to apply mitigations to: 1. If the app you want to configure is already listed, click it and then click **Edit** 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app: - - Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. - - Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. - + * Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. + * Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. + 4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows. 5. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration. @@ -116,11 +117,11 @@ CFG will be enabled for *miles.exe*. 1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune. 1. Click **Device configuration** > **Profiles** > **Create profile**. 1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**. - ![Create endpoint protection profile](images/create-endpoint-protection-profile.png) + ![Create endpoint protection profile](../images/create-endpoint-protection-profile.png) 1. Click **Configure** > **Windows Defender Exploit Guard** > **Exploit protection**. 1. Upload an [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) with the exploit protection settings: - ![Enable network protection in Intune](images/enable-ep-intune.png) -1. Click **OK** to save each open blade and click **Create**. + ![Enable network protection in Intune](../images/enable-ep-intune.png) +1. Click **OK** to save each open blade and click **Create**. 1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**. ## MDM @@ -134,50 +135,51 @@ Use the [./Vendor/MSFT/Policy/Config/ExploitGuard/ExploitProtectionSettings](htt 1. Enter a name and a description, click **Exploit protection**, and click **Next**. 1. Browse to the location of the exploit protection XML file and click **Next**. 1. Review the settings and click **Next** to create the policy. -1. After the policy is created, click **Close**. +1. After the policy is created, click **Close**. ## Group Policy -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -1. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +1. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -1. Expand the tree to **Windows components** > **Windows Defender Exploit Guard** > **Exploit Protection** > **Use a common set of exploit protection settings**. +1. Expand the tree to **Windows components** > **Windows Defender Exploit Guard** > **Exploit Protection** > **Use a common set of exploit protection settings**. -6. Click **Enabled** and type the location of the [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) and click **OK**. +1. Click **Enabled** and type the location of the [XML file](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-exploitguard) and click **OK**. ## PowerShell You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app: ```PowerShell -Get-ProcessMitigation -Name processName.exe +Get-ProcessMitigation -Name processName.exe ``` ->[!IMPORTANT] ->System-level mitigations that have not been configured will show a status of `NOTSET`. +> [!IMPORTANT] +> System-level mitigations that have not been configured will show a status of `NOTSET`. > ->For system-level settings, `NOTSET` indicates the default setting for that mitigation has been applied. +> For system-level settings, `NOTSET` indicates the default setting for that mitigation has been applied. > ->For app-level settings, `NOTSET` indicates the system-level setting for the mitigation will be applied. +> For app-level settings, `NOTSET` indicates the system-level setting for the mitigation will be applied. > ->The default setting for each system-level mitigation can be seen in the Windows Security. +> The default setting for each system-level mitigation can be seen in the Windows Security. Use `Set` to configure each mitigation in the following format: ```PowerShell Set-ProcessMitigation - - ,, ``` + Where: -- \: - - `-Name` to indicate the mitigations should be applied to a specific app. Specify the app's executable after this flag. - - `-System` to indicate the mitigation should be applied at the system level -- \: - - `-Enable` to enable the mitigation - - `-Disable` to disable the mitigation -- \: - - The mitigation's cmdlet along with any suboptions (surrounded with spaces). Each mitigation is separated with a comma. +* \: + * `-Name` to indicate the mitigations should be applied to a specific app. Specify the app's executable after this flag. + * `-System` to indicate the mitigation should be applied at the system level +* \: + * `-Enable` to enable the mitigation + * `-Disable` to disable the mitigation +* \: + * The mitigation's cmdlet along with any suboptions (surrounded with spaces). Each mitigation is separated with a comma. For example, to enable the Data Execution Prevention (DEP) mitigation with ATL thunk emulation and for an executable called *testing.exe* in the folder *C:\Apps\LOB\tests*, and to prevent that executable from creating child processes, you'd use the following command: @@ -185,8 +187,8 @@ For example, to enable the Data Execution Prevention (DEP) mitigation with ATL t Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP, EmulateAtlThunks, DisallowChildProcessCreation ``` ->[!IMPORTANT] ->Separate each mitigation option with commas. +> [!IMPORTANT] +> Separate each mitigation option with commas. If you wanted to apply DEP at the system level, you'd use the following command: @@ -202,8 +204,7 @@ If you need to restore the mitigation back to the system default, you need to in Set-Processmitigation -Name test.exe -Remove -Disable DEP ``` -This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that can be used to configure each mitigation. - +This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that can be used to configure each mitigation. Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet - | - | - | - @@ -213,39 +214,35 @@ Force randomization for images (Mandatory ASLR) | System and app-level | Force Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available Validate heap integrity | System and app-level | TerminateOnHeapError | Audit not available -Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode -Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad -Block remote images | App-level only | BlockRemoteImages | Audit not available -Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly -Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned +Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode +Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad +Block remote images | App-level only | BlockRemoteImages | Audit not available +Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly +Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned Disable extension points | App-level only | ExtensionPoint | Audit not available Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess -Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter \[1\] | Audit not available -Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available -Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available -Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available +Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter \[1\] | Audit not available +Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available +Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available +Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available Validate handle usage | App-level only | StrictHandle | Audit not available -Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available -Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available - - +Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available +Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available \[1\]: Use the following format to enable EAF modules for dlls for a process: ```PowerShell -Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll +Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlus -EAFModules dllName1.dll,dllName2.dll ``` - ## Customize the notification See the [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center) topic for more information about customizing the notification when a rule is triggered and blocks an app or file. - ## Related topics -- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) -- [Evaluate exploit protection](evaluate-exploit-protection.md) -- [Configure and audit exploit protection mitigations](customize-exploit-protection.md) -- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) +* [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection.md) +* [Evaluate exploit protection](evaluate-exploit-protection.md) +* [Configure and audit exploit protection mitigations](customize-exploit-protection.md) +* [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md similarity index 58% rename from windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md index dc62facca9..97a6409ed0 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.reviewer: @@ -20,31 +21,29 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[Network protection](network-protection-exploit-guard.md) helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. +[Network protection](network-protection.md) helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. You can [audit network protection](evaluate-network-protection.md) in a test environment to see which apps would be blocked before you enable it. You can enable network protection by using any of these methods: -- [Microsoft Intune](#intune) -- [Mobile Device Management (MDM)](#mdm) -- [System Center Configuration Manager (SCCM)](#sccm) -- [Group Policy](#group-policy) -- [PowerShell](#powershell) +* [Microsoft Intune](#intune) +* [Mobile Device Management (MDM)](#mdm) +* [System Center Configuration Manager (SCCM)](#sccm) +* [Group Policy](#group-policy) +* [PowerShell](#powershell) ## Intune 1. Sign in to the [Azure portal](https://portal.azure.com) and open Intune. -2. Click **Device configuration** > **Profiles** > **Create profile**. -3. Name the profile, choose **Windows 10 and later** and **Endpoint protection**. - ![Create endpoint protection profile](images/create-endpoint-protection-profile.png) -4. Click **Configure** > **Windows Defender Exploit Guard** > **Network filtering** > **Enable**. - - ![Enable network protection in Intune](images/enable-np-intune.png) - -5. Click **OK** to save each open blade and click **Create**. -6. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**. +1. Click **Device configuration** > **Profiles** > **Create profile**. +1. Name the profile, choose **Windows 10 and later** and **Endpoint protection**. + ![Create endpoint protection profile](../images/create-endpoint-protection-profile.png) +1. Click **Configure** > **Windows Defender Exploit Guard** > **Network filtering** > **Enable**. + ![Enable network protection in Intune](../images/enable-np-intune.png) +1. Click **OK** to save each open blade and click **Create**. +1. Click the profile **Assignments**, assign to **All Users & All Devices**, and click **Save**. ## MDM @@ -57,60 +56,58 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection](https://d 1. Enter a name and a description, click **Network protection**, and click **Next**. 1. Choose whether to block or audit access to suspicious domains and click **Next**. 1. Review the settings and click **Next** to create the policy. -1. After the policy is created, click **Close**. +1. After the policy is created, click **Close**. -## Group Policy +## Group Policy -You can use the following procedure to enable network protection on domain-joined computers or on a standalone computer. +You can use the following procedure to enable network protection on domain-joined computers or on a standalone computer. -1. On a standalone computer, click **Start**, type and then click **Edit group policy**. +1. On a standalone computer, click **Start**, type and then click **Edit group policy**. -Or- - + On a domain-joined Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Network protection**. +3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Network protection**. 4. Double-click the **Prevent users and apps from accessing dangerous websites** setting and set the option to **Enabled**. In the options section, you must specify one of the following: - - **Block** - Users will not be able to access malicious IP addresses and domains - - **Disable (Default)** - The Network protection feature will not work. Users will not be blocked from accessing malicious domains - - **Audit Mode** - If a user visits a malicious IP address or domain, an event will be recorded in the Windows event log but the user will not be blocked from visiting the address. + * **Block** - Users will not be able to access malicious IP addresses and domains + * **Disable (Default)** - The Network protection feature will not work. Users will not be blocked from accessing malicious domains + * **Audit Mode** - If a user visits a malicious IP address or domain, an event will be recorded in the Windows event log but the user will not be blocked from visiting the address. ->[!IMPORTANT] ->To fully enable network protection, you must set the Group Policy option to **Enabled** and also select **Block** in the options drop-down menu. +> [!IMPORTANT] +> To fully enable network protection, you must set the Group Policy option to **Enabled** and also select **Block** in the options drop-down menu. You can confirm network protection is enabled on a local computer by using Registry editor: 1. Click **Start** and type **regedit** to open **Registry Editor**. 1. Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection -1. Click **EnableNetworkProtection** and confirm the value: - - 0=Off - - 1=On - - 2=Audit +1. Click **EnableNetworkProtection** and confirm the value: + * 0=Off + * 1=On + * 2=Audit ## PowerShell 1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and click **Run as administrator** 2. Enter the following cmdlet: - ``` + ```PowerShell Set-MpPreference -EnableNetworkProtection Enabled ``` You can enable the feature in audit mode using the following cmdlet: -``` +```PowerShell Set-MpPreference -EnableNetworkProtection AuditMode ``` Use `Disabled` instead of `AuditMode` or `Enabled` to turn the feature off. - ## Related topics -- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md) -- [Network protection](network-protection-exploit-guard.md) -- [Evaluate network protection](evaluate-network-protection.md) -- [Troubleshoot network protection](troubleshoot-np.md) +* [Network protection](network-protection.md) +* [Evaluate network protection](evaluate-network-protection.md) +* [Troubleshoot network protection](troubleshoot-np.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration.md b/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration.md index 2c9fa62654..3fbbd36ff6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration.md @@ -1,6 +1,6 @@ --- title: Enable SIEM integration in Microsoft Defender ATP -description: Enable SIEM integration to receive alerts in your security information and event management (SIEM) solution. +description: Enable SIEM integration to receive detections in your security information and event management (SIEM) solution. keywords: enable siem connector, siem, connector, security information and events search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/10/2018 --- # Enable SIEM integration in Microsoft Defender ATP @@ -24,9 +23,13 @@ ms.date: 12/10/2018 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-enablesiem-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-enablesiem-abovefoldlink) -Enable security information and event management (SIEM) integration so you can pull alerts from Microsoft Defender Security Center using your SIEM solution or by connecting directly to the alerts REST API. +Enable security information and event management (SIEM) integration so you can pull detections from Microsoft Defender Security Center using your SIEM solution or by connecting directly to the detections REST API. + +>[!Note] +>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections +>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. ## Prerequisites - The user who activates the setting must have permissions to create an app in Azure Active Directory (AAD). This is typically someone with a **Global administrator** role. @@ -55,7 +58,7 @@ Enable security information and event management (SIEM) integration so you can p > - WDATP-connector.jsonparser.properties > - WDATP-connector.properties
                        - If you want to connect directly to the alerts REST API through programmatic access, choose **Generic API**. + If you want to connect directly to the detections REST API through programmatic access, choose **Generic API**. 4. Copy the individual values or select **Save details to file** to download a file that contains all the values. @@ -64,14 +67,14 @@ Enable security information and event management (SIEM) integration so you can p > [!NOTE] > You'll need to generate a new Refresh token every 90 days. -You can now proceed with configuring your SIEM solution or connecting to the alerts REST API through programmatic access. You'll need to use the tokens when configuring your SIEM solution to allow it to receive alerts from Microsoft Defender Security Center. +You can now proceed with configuring your SIEM solution or connecting to the detections REST API through programmatic access. You'll need to use the tokens when configuring your SIEM solution to allow it to receive detections from Microsoft Defender Security Center. ## Integrate Microsoft Defender ATP with IBM QRadar -You can configure IBM QRadar to collect alerts from Microsoft Defender ATP. For more information, see [IBM Knowledge Center](https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/c_dsm_guide_MS_Win_Defender_ATP_overview.html?cp=SS42VS_7.3.1). +You can configure IBM QRadar to collect detections from Microsoft Defender ATP. For more information, see [IBM Knowledge Center](https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/c_dsm_guide_MS_Win_Defender_ATP_overview.html?cp=SS42VS_7.3.1). ## Related topics -- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md) -- [Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md) -- [Microsoft Defender ATP alert API fields](api-portal-mapping.md) -- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) +- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) +- [Configure HP ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) +- [Microsoft Defender ATP Detection fields](api-portal-mapping.md) +- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) - [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp.md index 1939474a15..ee4f4e583c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -19,25 +19,30 @@ ms.topic: conceptual --- # Evaluate Microsoft Defender ATP + [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. -You can evaluate Microsoft Defender Advanced Threat Protection in your organization by [starting your free trial](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp). +You can evaluate Microsoft Defender Advanced Threat Protection in your organization by [starting your free trial](https://www.microsoft.com/WindowsForBusiness/windows-atp). -You can also evaluate the different security capabilities in Microsoft Defender ATP by using the following instructions. +You can also evaluate the different security capabilities in Microsoft Defender ATP by using the following instructions. ## Evaluate attack surface reduction + These capabilities help prevent attacks and exploitations from infecting your organization. -- [Evaluate attack surface reduction](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) -- [Evaluate exploit protection](../windows-defender-exploit-guard/evaluate-exploit-protection.md) -- [Evaluate network protection](../windows-defender-exploit-guard/evaluate-exploit-protection.md) -- [Evaluate controlled folder access](../windows-defender-exploit-guard/evaluate-controlled-folder-access.md) + +- [Evaluate attack surface reduction](./evaluate-attack-surface-reduction.md) +- [Evaluate exploit protection](./evaluate-exploit-protection.md) +- [Evaluate network protection](./evaluate-exploit-protection.md) +- [Evaluate controlled folder access](./evaluate-controlled-folder-access.md) - [Evaluate application guard](../windows-defender-application-guard/test-scenarios-wd-app-guard.md) - [Evaluate network firewall](../windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) ## Evaluate next generation protection + Next gen protections help detect and block the latest threats. + - [Evaluate antivirus](../windows-defender-antivirus/evaluate-windows-defender-antivirus.md) - ## See Also + [Get started with Microsoft Defender Advanced Threat Protection](get-started.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-attack-surface-reduction.md similarity index 68% rename from windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md rename to windows/security/threat-protection/microsoft-defender-atp/evaluate-attack-surface-reduction.md index 145da203d5..271622f774 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-attack-surface-reduction.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 04/02/2019 @@ -20,14 +21,14 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Attack surface reduction rules help prevent actions and apps that are typically used by exploit-seeking malware to infect machines. Attack surface reduction rules are supported on Windows Server 2019 as well as Windows 10 clients. This topic helps you evaluate attack surface reduction rules. It explains how to enable audit mode so you can test the feature directly in your organization. ->[!TIP] ->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. +> [!TIP] +> You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. ## Use audit mode to measure impact @@ -43,42 +44,27 @@ Set-MpPreference -AttackSurfaceReductionRules_Actions AuditMode This enables all attack surface reduction rules in audit mode. ->[!TIP] ->If you want to fully audit how attack surface reduction rules will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s). -You can also use Group Policy, Intune, or MDM CSPs to configure and deploy the setting, as described in the main [Attack surface reduction rules topic](attack-surface-reduction-exploit-guard.md). +> [!TIP] +> If you want to fully audit how attack surface reduction rules will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s). +You can also use Group Policy, Intune, or MDM CSPs to configure and deploy the setting, as described in the main [Attack surface reduction rules topic](attack-surface-reduction.md). ## Review attack surface reduction events in Windows Event Viewer To review apps that would have been blocked, open Event Viewer and filter for Event ID 1121 in the Microsoft-Windows-Windows-Defender/Operational log. The following table lists all network protection events. - -| Event ID | Description | -|----------|-------------| -|5007 | Event when settings are changed | -| 1121 | Event when an attack surface reduction rule fires in block mode | -| 1122 | Event when an attack surface reduction rule fires in audit mode | + Event ID | Description +-|- + 5007 | Event when settings are changed + 1121 | Event when an attack surface reduction rule fires in block mode + 1122 | Event when an attack surface reduction rule fires in audit mode ## Customize attack surface reduction rules -During your evaluation, you may wish to configure each rule individualy or exclude certain files and processes from being evaluated by the feature. +During your evaluation, you may wish to configure each rule individually or exclude certain files and processes from being evaluated by the feature. See the [Customize attack surface reduction rules](customize-attack-surface-reduction.md) topic for information on configuring the feature with management tools, including Group Policy and MDM CSP policies. ## Related topics -- [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction-exploit-guard.md) -- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) -- [Use audit mode to evaluate Windows Defender Exploit Guard](audit-windows-defender-exploit-guard.md) - - - - - - - - - - - - - +* [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction.md) +* [Use audit mode to evaluate Windows Defender](audit-windows-defender.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-controlled-folder-access.md similarity index 61% rename from windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md rename to windows/security/threat-protection/microsoft-defender-atp/evaluate-controlled-folder-access.md index 08d11df095..5f8fc8a0da 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-controlled-folder-access.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 11/16/2018 @@ -20,16 +21,16 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[Controlled folder access](controlled-folders-exploit-guard.md) is a feature that helps protect your documents and files from modification by suspicious or malicious apps. Controlled folder access is supported on Windows Server 2019 as well as Windows 10 clients. +[Controlled folder access](controlled-folders.md) is a feature that helps protect your documents and files from modification by suspicious or malicious apps. Controlled folder access is supported on Windows Server 2019 as well as Windows 10 clients. It is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/wdsi/threats/ransomware) that can attempt to encrypt your files and hold them hostage. This topic helps you evaluate controlled folder access. It explains how to enable audit mode so you can test the feature directly in your organization. ->[!TIP] ->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. +> [!TIP] +> You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. ## Use audit mode to measure impact @@ -43,27 +44,28 @@ To enable audit mode, use the following PowerShell cmdlet: Set-MpPreference -EnableControlledFolderAccess AuditMode ``` ->[!TIP] ->If you want to fully audit how controlled folder access will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s). -You can also use Group Policy, Intune, MDM, or System Center Configuration Manager to configure and deploy the setting, as described in the main [controlled folder access topic](controlled-folders-exploit-guard.md). +> [!TIP] +> If you want to fully audit how controlled folder access will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s). +You can also use Group Policy, Intune, MDM, or System Center Configuration Manager to configure and deploy the setting, as described in the main [controlled folder access topic](controlled-folders.md). ## Review controlled folder access events in Windows Event Viewer The following controlled folder access events appear in Windows Event Viewer under Microsoft/Windows/Windows Defender/Operational folder. -| Event ID | Description | -| --- | --- | -| 5007 | Event when settings are changed | -| 1124 | Audited controlled folder access event | -| 1123 | Blocked controlled folder access event | +Event ID | Description +-|- + 5007 | Event when settings are changed + 1124 | Audited controlled folder access event + 1123 | Blocked controlled folder access event ## Customize protected folders and apps -During your evaluation, you may wish to add to the list of protected folders, or allow certain apps to modify files. +During your evaluation, you may wish to add to the list of protected folders, or allow certain apps to modify files. -See [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) for configuring the feature with management tools, including Group Policy, PowerShell, and MDM CSP. +See [Protect important folders with controlled folder access](controlled-folders.md) for configuring the feature with management tools, including Group Policy, PowerShell, and MDM CSP. ## Related topics -- [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) -- [Evaluate Microsoft Defender ATP](evaluate-windows-defender-exploit-guard.md) -- [Use audit mode](audit-windows-defender-exploit-guard.md) + +* [Protect important folders with controlled folder access](controlled-folders.md) +* [Evaluate Microsoft Defender ATP]../(microsoft-defender-atp/evaluate-atp.md) +* [Use audit mode](audit-windows-defender.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md similarity index 55% rename from windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md index 61220879a8..4d70c50373 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 04/02/2019 @@ -20,75 +21,74 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[Exploit protection](exploit-protection-exploit-guard.md) helps protect devices from malware that uses exploits to spread and infect other devices. +[Exploit protection](exploit-protection.md) helps protect devices from malware that uses exploits to spread and infect other devices. It consists of a number of mitigations that can be applied to either the operating system or an individual app. -Many of the features that were part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) are included in exploit protection. +Many of the features that were part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) are included in exploit protection. -This topic helps you enable exploit protection in audit mode and review related events in Event Viewer. +This topic helps you enable exploit protection in audit mode and review related events in Event Viewer. You can enable audit mode for certain app-level mitigations to see how they will work in a test environment. This lets you see a record of what *would* have happened if you had enabled the mitigation in production. You can make sure it doesn't affect your line-of-business apps, and see which suspicious or malicious events occur. ->[!TIP] ->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how exploit protection works. +> [!TIP] +> You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how exploit protection works. ## Enable exploit protection in audit mode -You can set mitigations in audit mode for specific programs either by using the Windows Security app or PowerShell. +You can set mitigations in audit mode for specific programs either by using the Windows Security app or PowerShell. ### Windows Security app 1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection**. - + 3. Go to **Program settings** and choose the app you want to apply mitigations to: 1. If the app you want to configure is already listed, click it and then click **Edit** 2. If the app is not listed, at the top of the list click **Add program to customize** and then choose how you want to add the app: - - Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. - - Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. - + * Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. + * Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. + 4. After selecting the app, you'll see a list of all the mitigations that can be applied. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows. 5. Repeat this for all the apps and mitigations you want to configure. Click **Apply** when you're done setting up your configuration. ### PowerShell -To set app-level mitigations to audit mode, use `Set-ProcessMitigation` with the **Audit mode** cmdlet. +To set app-level mitigations to audit mode, use `Set-ProcessMitigation` with the **Audit mode** cmdlet. Configure each mitigation in the following format: - ```PowerShell Set-ProcessMitigation - - ,, ``` Where: -- \: - - `-Name` to indicate the mitigations should be applied to a specific app. Specify the app's executable after this flag. -- \: - - `-Enable` to enable the mitigation - - `-Disable` to disable the mitigation -- \: - - The mitigation's cmdlet as defined in the following table. Each mitigation is separated with a comma. +* \: + * `-Name` to indicate the mitigations should be applied to a specific app. Specify the app's executable after this flag. +* \: + * `-Enable` to enable the mitigation + * `-Disable` to disable the mitigation +* \: + * The mitigation's cmdlet as defined in the following table. Each mitigation is separated with a comma. -| Mitigation | Audit mode cmdlet | -| - | - | -|Arbitrary code guard (ACG) | AuditDynamicCode | -|Block low integrity images | AuditImageLoad | -|Block untrusted fonts | AuditFont, FontAuditOnly | -|Code integrity guard | AuditMicrosoftSigned, AuditStoreSigned | -|Disable Win32k system calls | AuditSystemCall | -|Do not allow child processes | AuditChildProcess | + Mitigation | Audit mode cmdlet +-|- + Arbitrary code guard (ACG) | AuditDynamicCode + Block low integrity images | AuditImageLoad + Block untrusted fonts | AuditFont, FontAuditOnly + Code integrity guard | AuditMicrosoftSigned, AuditStoreSigned + Disable Win32k system calls | AuditSystemCall + Do not allow child processes | AuditChildProcess For example, to enable Arbitrary Code Guard (ACG) in audit mode for an app named *testing.exe*, run the following command: ```PowerShell -Set-ProcesMitigation -Name c:\apps\lob\tests\testing.exe -Enable AuditDynamicCode +Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable AuditDynamicCode ``` You can disable audit mode by replacing `-Enable` with `-Disable`. @@ -98,21 +98,21 @@ You can disable audit mode by replacing `-Enable` with `-Disable`. To review which apps would have been blocked, open Event Viewer and filter for the following events in the Security-Mitigations log. Feature | Provider/source | Event ID | Description -:-|:-|:-:|:- -Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 1 | ACG audit -Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 3 | Do not allow child processes audit -Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 5 | Block low integrity images audit -Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 7 | Block remote images audit -Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 9 | Disable win32k system calls audit -Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 11 | Code integrity guard audit +-|-|-|- + Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 1 | ACG audit + Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 3 | Do not allow child processes audit + Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 5 | Block low integrity images audit + Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 7 | Block remote images audit + Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 9 | Disable win32k system calls audit + Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 11 | Code integrity guard audit ## Related topics -- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) -- [Enable exploit protection](enable-exploit-protection.md) -- [Configure and audit exploit protection mitigations](customize-exploit-protection.md) -- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) -- [Troubleshoot exploit protection](troubleshoot-exploit-protection-mitigations.md) -- [Enable network protection](enable-network-protection.md) -- [Enable controlled folder access](enable-controlled-folders-exploit-guard.md) -- [Enable attack surface reduction](enable-attack-surface-reduction.md) +* [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection.md) +* [Enable exploit protection](enable-exploit-protection.md) +* [Configure and audit exploit protection mitigations](customize-exploit-protection.md) +* [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) +* [Troubleshoot exploit protection](troubleshoot-exploit-protection-mitigations.md) +* [Enable network protection](enable-network-protection.md) +* [Enable controlled folder access](enable-controlled-folders.md) +* [Enable attack surface reduction](enable-attack-surface-reduction.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection.md similarity index 76% rename from windows/security/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md rename to windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection.md index 5015d0f283..6e3840831e 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 05/10/2019 @@ -20,15 +21,14 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[Network protection](network-protection-exploit-guard.md) helps prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. +[Network protection](network-protection.md) helps prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. This topic helps you evaluate Network protection by enabling the feature and guiding you to a testing site. The site in this evaluation topic are not malicious, they are specially created websites that pretend to be malicious. The site will replicate the behavior that would happen if a user visited a malicious site or domain. - ->[!TIP] ->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how other protection features work. +> [!TIP] +> You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how other protection features work. ## Enable network protection in audit mode @@ -51,10 +51,10 @@ You might want to do this to make sure it doesn't affect line-of-business apps o The network connection will be allowed and a test message will be displayed. -![Example notification that says Connection blocked: Your IT administrator caused Windows Security to block this network connection. Contact your IT help desk.](images/np-notif.png) - +![Example notification that says Connection blocked: Your IT administrator caused Windows Security to block this network connection. Contact your IT help desk.](../images/np-notif.png) + ## Review network protection events in Windows Event Viewer - + To review apps that would have been blocked, open Event Viewer and filter for Event ID 1125 in the Microsoft-Windows-Windows-Defender/Operational log. The following table lists all network protection events. | Event ID | Provide/Source | Description | @@ -63,10 +63,8 @@ To review apps that would have been blocked, open Event Viewer and filter for Ev |1125 | Windows Defender (Operational) | Event when a network connection is audited | |1126 | Windows Defender (Operational) | Event when a network connection is blocked | - ## Related topics -- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md) -- [Network protection](network-protection-exploit-guard.md) -- [Enable network protection](enable-network-protection.md) -- [Troubleshoot network protection](troubleshoot-np.md) +* [Network protection](network-protection.md) +* [Enable network protection](enable-network-protection.md) +* [Troubleshoot network protection](troubleshoot-np.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md index 9b2eecd333..bc33d59c55 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md @@ -20,7 +20,6 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] Conducting a comprehensive security product evaluation can be a complex process requiring cumbersome environment and machine configuration before an end-to-end attack simulation can actually be done. Adding to the complexity is the challenge of tracking where the simulation activities, alerts, and results are reflected during the evaluation. @@ -43,25 +42,32 @@ When you access the evaluation lab for the first time, you'll find an introducti It's a good idea to read the guide before starting the evaluation process so that you can conduct a thorough assessment of the platform. +>[!NOTE] +>- Each environment is provisioned with only three test machines. +>- Each machine will be available for only three days from the day of activation. +>- When you've used up these three machines, no new machines are provided. +Deleting a machine does not refresh the available test machine count. +>- Given the limited resources, it’s advisable to use the machines carefully. + ## Evaluation setup When you add a machine to your environment, Microsoft Defender ATP sets up a well-configured machine with connection details. The machine will be configured with the most up to date version of Windows 10 and Office 2019 Standard as well as other apps such as Java, Python, and SysIntenals. The machine will automatically be onboarded to your tenant with the recommended Windows security components turned on and in audit mode - with no effort on your side. - The following security components are pre-configured in the test machines: + The following security components are pre-configured in the test machines: - - [Attack Surface Reduction](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard) - - [Block at first sight](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus) - - [Controlled Folder Access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard) - - [Exploit Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection) - - [Network Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard) - - [Potentially unwanted application detection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus) - - [Cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus) - - [Windows Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview) +- [Attack Surface Reduction](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard) +- [Block at first sight](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus) +- [Controlled Folder Access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard) +- [Exploit Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection) +- [Network Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard) +- [Potentially unwanted application detection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus) +- [Cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus) +- [Windows Defender SmartScreen](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview) - >[!NOTE] - > Windows Defender Antivirus will be on (not in audit). If Windows Defender Antivirus blocks you from running your simulation, you may turn off real-time protection on the machine through Windows Security. For more information, see [Configure always-on protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus). +>[!NOTE] +> Windows Defender Antivirus will be on (not in audit). If Windows Defender Antivirus blocks you from running your simulation, you may turn off real-time protection on the machine through Windows Security. For more information, see [Configure always-on protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus). Automated investigation settings will be dependent on tenant settings. It will be configured to be semi-automated by default. For more information, see [Overview of Automated investigations](automated-investigations.md). @@ -78,7 +84,11 @@ Automated investigation settings will be dependent on tenant settings. It will b 3. Select **Add machine**. >[!WARNING] - > The evaluation environment can only be provisioned up to three test machines. Each machine will only be available for three days from the day of activation. + >- Each environment is provisioned with only three test machines. + >- Each machine will be available for only three days from the day of activation. + >- When you've used up these three machines, no new machines are provided. + Deleting a machine does not refresh the available test machine count. + >- Given the limited resources, it’s advisable to use the machines carefully. ![Image of add machine](images/evaluation-add-machine.png) diff --git a/windows/security/threat-protection/microsoft-defender-atp/event-error-codes.md b/windows/security/threat-protection/microsoft-defender-atp/event-error-codes.md index 080111bee7..0875478e90 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/event-error-codes.md +++ b/windows/security/threat-protection/microsoft-defender-atp/event-error-codes.md @@ -342,7 +342,7 @@ See As "Load Library Check" +Block untrusted fonts | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Data Execution Prevention (DEP) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Export address filtering (EAF) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Force randomization for images (Mandatory ASLR) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +NullPage Security Mitigation | [!include[Check mark yes](../images/svg/check-yes.svg)]
                        Included natively in Windows 10
                        See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](../images/svg/check-yes.svg)] +Randomize memory allocations (Bottom-Up ASLR) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Simulate execution (SimExec) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Validate API invocation (CallerCheck) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Validate exception chains (SEHOP) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Validate stack integrity (StackPivot) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] +Certificate trust (configurable certificate pinning) | Windows 10 provides enterprise certificate pinning | [!include[Check mark yes](../images/svg/check-yes.svg)] +Heap spray allocation | Ineffective against newer browser-based exploits; newer mitigations provide better protection
                        See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](../images/svg/check-yes.svg)] +Block low integrity images | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Code integrity guard | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Disable extension points | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Disable Win32k system calls | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Do not allow child processes | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Import address filtering (IAF) | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Validate handle usage | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Validate heap integrity | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] +Validate image dependency integrity | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] + +> [!NOTE] +> The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10, which other EMET advanced settings are enabled by default, as part of enabling the anti-ROP mitigations for a process. +> +> See the [Mitigation threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information on how Windows 10 employs existing EMET technology. + +## Related topics + +* [Protect devices from exploits](exploit-protection.md) +* [Evaluate exploit protection](evaluate-exploit-protection.md) +* [Enable exploit protection](enable-exploit-protection.md) +* [Configure and audit exploit protection mitigations](customize-exploit-protection.md) +* [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) +* [Troubleshoot exploit protection](troubleshoot-exploit-protection-mitigations.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md index 6d064aed64..8c3bd67aa8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -21,7 +21,7 @@ ms.topic: article **Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) This page describes how to create an application to get programmatic access to Microsoft Defender ATP on behalf of a user. @@ -62,29 +62,29 @@ This page explains how to create an AAD application, get an access token to Micr 4. Allow your Application to access Microsoft Defender ATP and assign it 'Read alerts' permission: - - On your application page, click **API Permissions** > **Add permission** > **APIs my organization uses** > type **WindowsDefenderATP** and click on **WindowsDefenderATP**. + - On your application page, click **API Permissions** > **Add permission** > **APIs my organization uses** > type **WindowsDefenderATP** and click on **WindowsDefenderATP**. - - **Note**: WindowsDefenderATP does not appear in the original list. You need to start writing its name in the text box to see it appear. + - **Note**: WindowsDefenderATP does not appear in the original list. You need to start writing its name in the text box to see it appear. - ![Image of API access and API selection](images/add-permission.png) + ![Image of API access and API selection](images/add-permission.png) - - Choose **Delegated permissions** > **Alert.Read** > Click on **Add permissions** + - Choose **Delegated permissions** > **Alert.Read** > Click on **Add permissions** - ![Image of API access and API selection](images/application-permissions-public-client.png) + ![Image of API access and API selection](images/application-permissions-public-client.png) - - **Important note**: You need to select the relevant permissions. 'Read alerts' is only an example! + - **Important note**: You need to select the relevant permissions. 'Read alerts' is only an example! - For instance, + For instance, - - To [run advanced queries](run-advanced-query-api.md), select 'Run advanced queries' permission - - To [isolate a machine](isolate-machine.md), select 'Isolate machine' permission - - To determine which permission you need, please look at the **Permissions** section in the API you are interested to call. + - To [run advanced queries](run-advanced-query-api.md), select 'Run advanced queries' permission + - To [isolate a machine](isolate-machine.md), select 'Isolate machine' permission + - To determine which permission you need, please look at the **Permissions** section in the API you are interested to call. - - Click **Grant consent** + - Click **Grant consent** - **Note**: Every time you add permission you must click on **Grant consent** for the new permission to take effect. + **Note**: Every time you add permission you must click on **Grant consent** for the new permission to take effect. - ![Image of Grant permissions](images/grant-consent.png) + ![Image of Grant permissions](images/grant-consent.png) 6. Write down your application ID and your tenant ID: @@ -102,42 +102,42 @@ For more details on AAD token, refer to [AAD tutorial](https://docs.microsoft.co - Copy/Paste the below class in your application. - Use **AcquireUserTokenAsync** method with the your application ID, tenant ID, user name and password to acquire a token. - ``` - namespace WindowsDefenderATP - { - using System.Net.Http; - using System.Text; - using System.Threading.Tasks; - using Newtonsoft.Json.Linq; + ```csharp + namespace WindowsDefenderATP + { + using System.Net.Http; + using System.Text; + using System.Threading.Tasks; + using Newtonsoft.Json.Linq; - public static class WindowsDefenderATPUtils - { - private const string Authority = "https://login.windows.net"; + public static class WindowsDefenderATPUtils + { + private const string Authority = "https://login.windows.net"; - private const string WdatpResourceId = "https://api.securitycenter.windows.com"; + private const string WdatpResourceId = "https://api.securitycenter.windows.com"; - public static async Task AcquireUserTokenAsync(string username, string password, string appId, string tenantId) - { - using (var httpClient = new HttpClient()) - { - var urlEncodedBody = $"resource={WdatpResourceId}&client_id={appId}&grant_type=password&username={username}&password={password}"; + public static async Task AcquireUserTokenAsync(string username, string password, string appId, string tenantId) + { + using (var httpClient = new HttpClient()) + { + var urlEncodedBody = $"resource={WdatpResourceId}&client_id={appId}&grant_type=password&username={username}&password={password}"; - var stringContent = new StringContent(urlEncodedBody, Encoding.UTF8, "application/x-www-form-urlencoded"); + var stringContent = new StringContent(urlEncodedBody, Encoding.UTF8, "application/x-www-form-urlencoded"); - using (var response = await httpClient.PostAsync($"{Authority}/{tenantId}/oauth2/token", stringContent).ConfigureAwait(false)) - { - response.EnsureSuccessStatusCode(); + using (var response = await httpClient.PostAsync($"{Authority}/{tenantId}/oauth2/token", stringContent).ConfigureAwait(false)) + { + response.EnsureSuccessStatusCode(); - var json = await response.Content.ReadAsStringAsync().ConfigureAwait(false); + var json = await response.Content.ReadAsStringAsync().ConfigureAwait(false); - var jObject = JObject.Parse(json); + var jObject = JObject.Parse(json); - return jObject["access_token"].Value(); - } - } - } - } - } + return jObject["access_token"].Value(); + } + } + } + } + } ``` ## Validate the token @@ -156,16 +156,17 @@ Sanity check to make sure you got a correct token: - The Expiration time of the token is 1 hour (you can send more then one request with the same token) - Example of sending a request to get a list of alerts **using C#** - ``` - var httpClient = new HttpClient(); - var request = new HttpRequestMessage(HttpMethod.Get, "https://api.securitycenter.windows.com/api/alerts"); + ```csharp + var httpClient = new HttpClient(); - request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token); + var request = new HttpRequestMessage(HttpMethod.Get, "https://api.securitycenter.windows.com/api/alerts"); - var response = httpClient.SendAsync(request).GetAwaiter().GetResult(); + request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token); - // Do something useful with the response + var response = httpClient.SendAsync(request).GetAwaiter().GetResult(); + + // Do something useful with the response ``` ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp.md index 880b4e2b38..79df3f31af 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -21,7 +21,7 @@ ms.topic: article **Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) This page describes how to create an application to get programmatic access to Microsoft Defender ATP without a user. diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md index 58362fcab8..b90c36d11c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -26,9 +26,9 @@ ms.date: 09/24/2018 Full scenario using multiple APIs from Microsoft Defender ATP. In this section we share PowerShell samples to - - Retrieve a token - - Use token to retrieve the latest alerts in Microsoft Defender ATP - - For each alert, if the alert has medium or high priority and is still in progress, check how many times the machine has connected to suspicious URL. +- Retrieve a token +- Use token to retrieve the latest alerts in Microsoft Defender ATP +- For each alert, if the alert has medium or high priority and is still in progress, check how many times the machine has connected to suspicious URL. >**Prerequisite**: You first need to [create an app](apis-intro.md). @@ -117,4 +117,3 @@ $response - [Microsoft Defender ATP APIs](apis-intro.md) - [Advanced Hunting API](run-advanced-query-api.md) - [Advanced Hunting using Python](run-advanced-query-sample-python.md) -- [Schedule Advanced Hunting](run-advanced-query-sample-ms-flow.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list.md index c8029a1428..e45e91bedd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -24,7 +24,7 @@ ms.topic: article ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-supportedapis-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-supportedapis-abovefoldlink) ## End Point URI and Versioning diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md index c166277e71..fbcee47cf2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/fix-unhealthy-sensors.md b/windows/security/threat-protection/microsoft-defender-atp/fix-unhealthy-sensors.md index bd6891a8c2..7d03a370b8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/fix-unhealthy-sensors.md +++ b/windows/security/threat-protection/microsoft-defender-atp/fix-unhealthy-sensors.md @@ -27,7 +27,7 @@ ms.date: 10/23/2017 ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-fixsensor-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-fixsensor-abovefoldlink) Machines that are categorized as misconfigured or inactive can be flagged due to varying causes. This section provides some explanations as to what might have caused a machine to be categorized as inactive or misconfigured. @@ -53,8 +53,8 @@ Do you expect a machine to be in ‘Active’ status? [Open a support ticket](ht ## Misconfigured machines Misconfigured machines can further be classified to: - - Impaired communications - - No sensor data +- Impaired communications +- No sensor data ### Impaired communications This status indicates that there's limited communication between the machine and the service. diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines.md b/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines.md deleted file mode 100644 index 2e00867ddd..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines.md +++ /dev/null @@ -1,122 +0,0 @@ ---- -title: Get IP related machines API -description: Retrieves a collection of machines related to a given IP address. -keywords: apis, graph api, supported apis, get, ip, related, machines -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Get IP related machines API - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Retrieves a collection of machines that communicated with or from a particular IP. - -## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) - -Permission type | Permission | Permission display name -:---|:---|:--- -Application | Machine.Read.All | 'Read all machine profiles' -Application | Machine.ReadWrite.All | 'Read and write all machine information' -Delegated (work or school account) | Machine.Read | 'Read machine information' -Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information' - ->[!Note] -> When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information) ->- Response will include only machines, that the user have access to, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information) - -## HTTP request -``` -GET /api/ips/{ip}/machines -``` - -## Request headers - -Name | Type | Description -:---|:---|:--- -Authorization | String | Bearer {token}. **Required**. - - -## Request body -Empty - -## Response -If successful and IP exists - 200 OK with list of [machine](machine.md) entities in the body. If IP do not exist - 404 Not Found. - - -## Example - -**Request** - -Here is an example of the request. - -[!include[Improve request performance](improve-request-performance.md)] - -``` -GET https://api.securitycenter.windows.com/api/ips/10.209.67.177/machines -``` - -**Response** - -Here is an example of the response. - - -``` -HTTP/1.1 200 OK -Content-type: application/json -{ - "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", - "value": [ - { - "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", - "computerDnsName": "mymachine1.contoso.com", - "firstSeen": "2018-08-02T14:55:03.7791856Z", - "lastSeen": "2018-08-02T14:55:03.7791856Z", - "osPlatform": "Windows10", - "osVersion": "10.0.0.0", - "lastIpAddress": "172.17.230.209", - "lastExternalIpAddress": "167.220.196.71", - "agentVersion": "10.5830.18209.1001", - "osBuild": 18209, - "healthStatus": "Active", - "rbacGroupId": 140, - "riskScore": "Low", - "rbacGroupName": "The-A-Team", - "aadDeviceId": "80fe8ff8-2624-418e-9591-41f0491218f9", - "machineTags": [ "test tag 1", "test tag 2" ] - }, - { - "id": "7292e4b8cb74ff1cc3d8a495eb29dc8858b732f7", - "computerDnsName": "mymachine2.contoso.com", - "firstSeen": "2018-07-09T13:22:45.1250071Z", - "lastSeen": "2018-07-09T13:22:45.1250071Z", - "osPlatform": "Windows10", - "osVersion": "10.0.0.0", - "lastIpAddress": "192.168.12.225", - "lastExternalIpAddress": "79.183.65.82", - "agentVersion": "10.5820.17724.1000", - "osBuild": 17724, - "healthStatus": "Inactive", - "rbacGroupId": 140, - "rbacGroupName": "The-A-Team", - "riskScore": "Low", - "aadDeviceId": null, - "machineTags": [ "test tag 1" ] - } - ] -} -``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-started.md b/windows/security/threat-protection/microsoft-defender-atp/get-started.md deleted file mode 100644 index e9af976de1..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/get-started.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Get started with Microsoft Defender Advanced Threat Protection -ms.reviewer: -description: Learn about the minimum requirements and initial steps you need to take to get started with Microsoft Defender ATP. -keywords: get started, minimum requirements, setup, subscription, features, data storage, privacy, user access -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: mjcaparas -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 11/20/2018 ---- - -# Get started with Microsoft Defender Advanced Threat Protection -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->[!TIP] ->- Learn about the latest enhancements in Microsoft Defender ATP: [What's new in Microsoft Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/). ->- Microsoft Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/). - -Learn about the minimum requirements and initial steps you need to take to get started with Microsoft Defender ATP. - -The following capabilities are available across multiple products that make up the Microsoft Defender ATP platform. - -**Threat & Vulnerability Management**
                        -Effectively identifying, assessing, and remediating endpoint weaknesses is pivotal in running a healthy security program and reducing organizational risk. This infrastructure correlates endpoint detection and response (EDR) insights with endpoint vulnerabilities real-time, thus reducing organizational vulnerability exposure and increasing threat resilience. - -**Attack surface reduction**
                        -The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations. - -**Next generation protection**
                        -To further reinforce the security perimeter of your network, Microsoft Defender ATP uses next generation protection designed to catch all types of emerging threats. - -**Endpoint detection and response**
                        -Endpoint detection and response capabilities are put in place to detect, investigate, and respond to advanced threats that may have made it past the first two security pillars. - -**Auto investigation and remediation**
                        -In conjunction with being able to quickly respond to advanced attacks, Microsoft Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale. - -**Secure score**
                        -Microsoft Defender ATP provides a security posture capability to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security state of your network. - -**Microsoft Threat Experts**
                        -Microsoft Threat Experts is the new managed threat hunting service in Microsoft Defender ATP that provides proactive hunting, prioritization, and additional context and insights that further empower security operations centers (SOCs) to identify and respond to threats quickly and accurately. It provides additional layer of expertise and optics that Microsoft customers can utilize to augment security operation capabilities as part of Microsoft 365. - -**Advanced hunting**
                        -Advanced hunting allows you to hunt for possible threats across your organization using a powerful search and query tool. You can also create custom detection rules based on the queries you created and surface alerts in Microsoft Defender Security Center. - -**Management and APIs**
                        -Integrate Microsoft Defender Advanced Threat Protection into your existing workflows. - -**Microsoft threat protection**
                        -Bring the power of Microsoft Threat Protection to your organization. - -## In this section -Topic | Description -:---|:--- -[Minimum requirements](minimum-requirements.md) | Learn about the requirements for onboarding machines to the platform. -[Validate licensing and complete setup](licensing.md) | Get guidance on how to check that licenses have been provisioned to your organization and how to access the portal for the first time. -[Preview features](preview.md) | Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience. -[Data storage and privacy](data-storage-privacy.md) | Explains the data storage and privacy details related to Microsoft Defender ATP. -[Assign user access to the portal](assign-portal-access.md) | Set permissions to manage who can access the portal. You can set basic permissions or set granular permissions using role-based access control (RBAC). -[Evaluate Microsoft Defender ATP](evaluate-atp.md) | Evaluate the various capabilities in Microsoft Defender ATP and test features out. -[Access the Microsoft Defender Security Center Community Center](community.md) | The Microsoft Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product. diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts.md index 2b5551a0bb..92bc4c7650 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts.md @@ -44,7 +44,7 @@ Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' GET /api/users/{id}/alerts ``` -**Note that the id is not the full UPN, but only the user name. (e.g., to retrieve alerts for user1@contoso.com use /api/users/user1/alerts) ** +**Note that the id is not the full UPN, but only the user name. (e.g., to retrieve alerts for user1@contoso.com use /api/users/user1/alerts)** ## Request headers diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines.md b/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines.md index 341c605bbb..ca042a7e99 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines.md @@ -44,7 +44,7 @@ Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine GET /api/users/{id}/machines ``` -**Note that the id is not the full UPN, but only the user name. (e.g., to retrieve machines for user1@contoso.com use /api/users/user1/machines) ** +**Note that the id is not the full UPN, but only the user name. (e.g., to retrieve machines for user1@contoso.com use /api/users/user1/machines)** ## Request headers diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD.png b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD.png new file mode 100644 index 0000000000..2bd08bd9fa Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD_Menu.png b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD_Menu.png new file mode 100644 index 0000000000..455de5a2ab Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD_Menu.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD_alerts.png b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD_alerts.png new file mode 100644 index 0000000000..895a4973e6 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD_alerts.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD_file.png b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD_file.png new file mode 100644 index 0000000000..ec891e1e3a Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD_file.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD_machines.png b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD_machines.png new file mode 100644 index 0000000000..5d227c08c3 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/MTE_EOD_machines.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/TVM_icon.png b/windows/security/threat-protection/microsoft-defender-atp/images/TVM_icon.png index 41faa16718..b3cb1854b9 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/TVM_icon.png and b/windows/security/threat-protection/microsoft-defender-atp/images/TVM_icon.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/action-center-package-collection.png b/windows/security/threat-protection/microsoft-defender-atp/images/action-center-package-collection.png index fdfa3bde36..a8f70701e2 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/action-center-package-collection.png and b/windows/security/threat-protection/microsoft-defender-atp/images/action-center-package-collection.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/alert-notification.png b/windows/security/threat-protection/microsoft-defender-atp/images/alert-notification.png new file mode 100644 index 0000000000..69836b943c Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/alert-notification.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-0.png b/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-0.png new file mode 100644 index 0000000000..7cbc10748b Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-0.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-1.png b/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-1.png new file mode 100644 index 0000000000..07d00ddf20 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-1.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-2.PNG b/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-2.PNG new file mode 100644 index 0000000000..3afdf8262b Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-2.PNG differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-3.PNG b/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-3.PNG new file mode 100644 index 0000000000..1db4fe594a Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-3.PNG differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-4.PNG b/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-4.PNG new file mode 100644 index 0000000000..857188379d Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-4.PNG differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-5.PNG b/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-5.PNG new file mode 100644 index 0000000000..9c85162428 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/api-flow-5.PNG differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/apply-to-each-value.png b/windows/security/threat-protection/microsoft-defender-atp/images/apply-to-each-value.png new file mode 100644 index 0000000000..2f027e9054 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/apply-to-each-value.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/apply-to-each.png b/windows/security/threat-protection/microsoft-defender-atp/images/apply-to-each.png new file mode 100644 index 0000000000..741770b06a Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/apply-to-each.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/build-flow.png b/windows/security/threat-protection/microsoft-defender-atp/images/build-flow.png new file mode 100644 index 0000000000..615e107f78 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/build-flow.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/condition1.png b/windows/security/threat-protection/microsoft-defender-atp/images/condition1.png new file mode 100644 index 0000000000..fb441257c0 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/condition1.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/condition2.png b/windows/security/threat-protection/microsoft-defender-atp/images/condition2.png new file mode 100644 index 0000000000..e57b9d3fe4 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/condition2.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/condition3.png b/windows/security/threat-protection/microsoft-defender-atp/images/condition3.png new file mode 100644 index 0000000000..25b0fe742a Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/condition3.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/conditions-2.png b/windows/security/threat-protection/microsoft-defender-atp/images/conditions-2.png new file mode 100644 index 0000000000..714a61e399 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/conditions-2.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/data-operations.png b/windows/security/threat-protection/microsoft-defender-atp/images/data-operations.png new file mode 100644 index 0000000000..13d572f10f Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/data-operations.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/flow-apply.png b/windows/security/threat-protection/microsoft-defender-atp/images/flow-apply.png new file mode 100644 index 0000000000..3d274ebf9f Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/flow-apply.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/flow-recurrence.png b/windows/security/threat-protection/microsoft-defender-atp/images/flow-recurrence.png new file mode 100644 index 0000000000..01ad9116f0 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/flow-recurrence.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/flow2.png b/windows/security/threat-protection/microsoft-defender-atp/images/flow2.png new file mode 100644 index 0000000000..647008af7d Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/flow2.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/http-conditions.png b/windows/security/threat-protection/microsoft-defender-atp/images/http-conditions.png new file mode 100644 index 0000000000..68eb6483c1 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/http-conditions.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/http-flow.png b/windows/security/threat-protection/microsoft-defender-atp/images/http-flow.png new file mode 100644 index 0000000000..71e3aa0e9f Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/http-flow.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mte-applicationconfirmation.png b/windows/security/threat-protection/microsoft-defender-atp/images/mte-applicationconfirmation.png new file mode 100644 index 0000000000..2c04ad2fc8 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mte-applicationconfirmation.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mte-apply.png b/windows/security/threat-protection/microsoft-defender-atp/images/mte-apply.png new file mode 100644 index 0000000000..a7096ee4aa Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mte-apply.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mte-collaboratewithmte.png b/windows/security/threat-protection/microsoft-defender-atp/images/mte-collaboratewithmte.png new file mode 100644 index 0000000000..862c5ffbd7 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mte-collaboratewithmte.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-alerts.png b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-alerts.png new file mode 100644 index 0000000000..895a4973e6 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-alerts.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-file.png b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-file.png new file mode 100644 index 0000000000..ec891e1e3a Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-file.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-machines.png b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-machines.png new file mode 100644 index 0000000000..5d227c08c3 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-machines.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-menu.png b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-menu.png new file mode 100644 index 0000000000..455de5a2ab Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod-menu.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod.png b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod.png new file mode 100644 index 0000000000..2bd08bd9fa Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/mte-eod.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/new-flow.png b/windows/security/threat-protection/microsoft-defender-atp/images/new-flow.png new file mode 100644 index 0000000000..7d64c71ac8 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/new-flow.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/parse-json-flow.png b/windows/security/threat-protection/microsoft-defender-atp/images/parse-json-flow.png new file mode 100644 index 0000000000..3a2b7563bf Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/parse-json-flow.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/parse-json-schema.png b/windows/security/threat-protection/microsoft-defender-atp/images/parse-json-schema.png new file mode 100644 index 0000000000..2c6069ab3d Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/parse-json-schema.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/parse-json.png b/windows/security/threat-protection/microsoft-defender-atp/images/parse-json.png new file mode 100644 index 0000000000..6931f21e5a Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/parse-json.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/power-bi-query-results.png b/windows/security/threat-protection/microsoft-defender-atp/images/power-bi-query-results.png deleted file mode 100644 index b94ee3a009..0000000000 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/power-bi-query-results.png and /dev/null differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/recurrence-add.png b/windows/security/threat-protection/microsoft-defender-atp/images/recurrence-add.png new file mode 100644 index 0000000000..43a41fbd3b Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/recurrence-add.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/response-actions.png b/windows/security/threat-protection/microsoft-defender-atp/images/response-actions.png index 87108d3e72..29dbc99425 100644 Binary files a/windows/security/threat-protection/microsoft-defender-atp/images/response-actions.png and b/windows/security/threat-protection/microsoft-defender-atp/images/response-actions.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png b/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png new file mode 100644 index 0000000000..570609f803 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/send-email.png b/windows/security/threat-protection/microsoft-defender-atp/images/send-email.png new file mode 100644 index 0000000000..f4f0bca971 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/send-email.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machine_page_flyout.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machine_page_flyout.png new file mode 100644 index 0000000000..7d83e1545d Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machine_page_flyout.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machines_discoveredvuln.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machines_discoveredvuln.png new file mode 100644 index 0000000000..08e0e2f831 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machines_discoveredvuln.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machineslist.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machineslist.png new file mode 100644 index 0000000000..ea9e800b94 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machineslist.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machinetoinvestigate.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machinetoinvestigate.png new file mode 100644 index 0000000000..864dff2f13 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_machinetoinvestigate.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy.png new file mode 100644 index 0000000000..4b1c91c9e4 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_software.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_software.png new file mode 100644 index 0000000000..6589185f64 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_software.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwarecolon.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwarecolon.png new file mode 100644 index 0000000000..eb0c4314c7 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwarecolon.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwareflyout.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwareflyout.png new file mode 100644 index 0000000000..0b72121e67 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwareflyout.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwareoptions.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwareoptions.png new file mode 100644 index 0000000000..8f61d18462 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_softwareoptions.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vuln.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vuln.png new file mode 100644 index 0000000000..08c0a00cc9 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vuln.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vulnflyout.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vulnflyout.png new file mode 100644 index 0000000000..cae0239957 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vulnflyout.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vulnoptions.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vulnoptions.png new file mode 100644 index 0000000000..cf9f274980 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracy_vulnoptions.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracyflyout.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracyflyout.png new file mode 100644 index 0000000000..9af2ad6945 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracyflyout.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracyoptions.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracyoptions.png new file mode 100644 index 0000000000..09c4876e1d Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_report_inaccuracyoptions.png differ diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm_weaknesses_machinepage.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_weaknesses_machinepage.png new file mode 100644 index 0000000000..5c56b70612 Binary files /dev/null and b/windows/security/threat-protection/microsoft-defender-atp/images/tvm_weaknesses_machinepage.png differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md similarity index 61% rename from windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md rename to windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md index 676188aa12..c46302a04f 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md +++ b/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 04/30/2018 @@ -20,13 +21,11 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) Exploit protection applies helps protect devices from malware that use exploits to spread and infect. It consists of a number of mitigations that can be applied at either the operating system level, or at the individual app level. -It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). - -Many of the features that are part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) are now included in exploit protection. +Many of the features that are part of the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) are now included in exploit protection. You use the Windows Security app or PowerShell to create a set of mitigations (known as a configuration). You can then export this configuration as an XML file and share it with multiple machines on your network so they all have the same set of mitigation settings. @@ -34,7 +33,7 @@ You can also convert and import an existing EMET configuration XML file into an This topic describes how to create a configuration file and deploy it across your network, and how to convert an EMET configuration. -The [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) contains a sample configuration file (name *ProcessMitigation-Selfhost-v4.xml* that you can use to see how the XML structure looks. The sample file also contains settings that have been converted from an EMET configuration. You can open the file in a text editor (such as Notepad) or import it directly into exploit protection and then review the settings in the Windows Security app, as described further in this topic. +The [Evaluation Package](https://aka.ms/mp7z2w) contains a sample configuration file (name *ProcessMitigation-Selfhost-v4.xml* that you can use to see how the XML structure looks. The sample file also contains settings that have been converted from an EMET configuration. You can open the file in a text editor (such as Notepad) or import it directly into exploit protection and then review the settings in the Windows Security app, as described further in this topic. ## Create and export a configuration file @@ -50,14 +49,14 @@ When you have configured exploit protection to your desired state (including bot 2. Click the **App & browser control** tile (or the app icon on the left menu bar) and then click **Exploit protection settings**: - ![Highlight of the Exploit protection settings option in the Windows Security app](images/wdsc-exp-prot.png) - + ![Highlight of the Exploit protection settings option in the Windows Security app](../images/wdsc-exp-prot.png) + 3. At the bottom of the **Exploit protection** section, click **Export settings** and then choose the location and name of the XML file where you want the configuration to be saved. -![Highlight of the Export Settings option](images/wdsc-exp-prot-export.png) +![Highlight of the Export Settings option](../images/wdsc-exp-prot-export.png) ->[!NOTE] ->When you export the settings, all settings for both app-level and system-level mitigations are saved. This means you don't need to export a file from both the **System settings** and **Program settings** sections - either section will export all settings. +> [!NOTE] +> When you export the settings, all settings for both app-level and system-level mitigations are saved. This means you don't need to export a file from both the **System settings** and **Program settings** sections - either section will export all settings. ### Use PowerShell to export a configuration file @@ -65,7 +64,7 @@ When you have configured exploit protection to your desired state (including bot 2. Enter the following cmdlet: ```PowerShell - Get-ProcessMitigation -RegistryConfigFilePath filename.xml + Get-ProcessMitigation -RegistryConfigFilePath filename.xml ``` Change `filename` to any name or location of your choosing. @@ -74,7 +73,7 @@ Example command **Get-ProcessMitigation -RegistryConfigFilePath C:\ExploitConfigfile.xml** > [!IMPORTANT] -> When you deploy the configuration using Group Policy, all machines that will use the configuration must be able to access the configuration file. Ensure you place the file in a shared location. +> When you deploy the configuration using Group Policy, all machines that will use the configuration must be able to access the configuration file. Ensure you place the file in a shared location. ## Import a configuration file @@ -84,12 +83,11 @@ After importing, the settings will be instantly applied and can be reviewed in t ### Use PowerShell to import a configuration file - 1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** 2. Enter the following cmdlet: ```PowerShell - Set-ProcessMitigation -PolicyFilePath filename.xml + Set-ProcessMitigation -PolicyFilePath filename.xml ``` Change `filename` to the location and name of the exploit protection XML file. @@ -97,11 +95,9 @@ Change `filename` to the location and name of the exploit protection XML file. Example command **Set-ProcessMitigation -PolicyFilePath C:\ExploitConfigfile.xml** - ->[!IMPORTANT] +> [!IMPORTANT] > ->Ensure you import a configuration file that is created specifically for exploit protection. You cannot directly import an EMET configuration file, you must convert it first. - +> Ensure you import a configuration file that is created specifically for exploit protection. You cannot directly import an EMET configuration file, you must convert it first. ## Convert an EMET configuration file to an exploit protection configuration file @@ -109,14 +105,13 @@ You can convert an existing EMET configuration file to the new format used by ex You can only do this conversion in PowerShell. ->[!WARNING] +> [!WARNING] > ->You cannot directly convert the default EMET configuration files that are distributed with EMET. These files are intended to help set up EMET for a first-time user. Attempting to directly convert these files into an Exploit protection configuration file will not work. +> You cannot directly convert the default EMET configuration files that are distributed with EMET. These files are intended to help set up EMET for a first-time user. Attempting to directly convert these files into an Exploit protection configuration file will not work. > ->However, if you want to apply the same settings as in the default EMET configuration files, you must first import the default configuration file into EMET, then export the settings to a new file. +> However, if you want to apply the same settings as in the default EMET configuration files, you must first import the default configuration file into EMET, then export the settings to a new file. > ->You can then convert that file using the PowerShell cmdlet described here before importing the settings into Exploit protection. - +> You can then convert that file using the PowerShell cmdlet described here before importing the settings into Exploit protection. 1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator** 2. Enter the following cmdlet: @@ -127,46 +122,45 @@ You can only do this conversion in PowerShell. Change `emetFile` to the name and location of the EMET configuration file, and change `filename` to whichever location and file name you want to use. ->[!IMPORTANT] +> [!IMPORTANT] > ->If you have enabled Mandatory ASLR for any apps in EMET, export the EMET settings to an XML file, and then convert the XML file into an Exploit protection configuration file, you will need to manually edit the converted XML file to ensure the Mandatory ASLR mitigation setting is correctly configured: +> If you have enabled Mandatory ASLR for any apps in EMET, export the EMET settings to an XML file, and then convert the XML file into an Exploit protection configuration file, you will need to manually edit the converted XML file to ensure the Mandatory ASLR mitigation setting is correctly configured: > > 1. Open the PowerShell-converted XML file in a text editor. > 2. Search for `ASLR ForceRelocateImages="false"` and change it to `ASLR ForceRelocateImages="true"` for each app that you want Mandatory ASLR to be enabled. - ## Manage or deploy a configuration You can use Group Policy to deploy the configuration you've created to multiple machines in your network. > [!IMPORTANT] -> When you deploy the configuration using Group Policy, all machines that will use the configuration must be able to access the configuration XML file. Ensure you place the file in a shared location. +> When you deploy the configuration using Group Policy, all machines that will use the configuration must be able to access the configuration XML file. Ensure you place the file in a shared location. ### Use Group Policy to distribute the configuration -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components** > **Windows Defender Exploit Guard** > **Exploit protection**. +3. Expand the tree to **Windows components** > **Windows Defender Exploit Guard** > **Exploit protection**. - ![Screenshot of the group policy setting for exploit protection](images/exp-prot-gp.png) + ![Screenshot of the group policy setting for exploit protection](../images/exp-prot-gp.png) -6. Double-click the **Use a common set of Exploit protection settings** setting and set the option to **Enabled**. +4. Double-click the **Use a common set of Exploit protection settings** setting and set the option to **Enabled**. -7. In the **Options::** section, enter the location and filename of the Exploit protection configuration file that you want to use, such as in the following examples: - - C:\MitigationSettings\Config.XML - - \\\Server\Share\Config.xml - - https://localhost:8080/Config.xml - - C:\ExploitConfigfile.xml +5. In the **Options::** section, enter the location and filename of the Exploit protection configuration file that you want to use, such as in the following examples: -8. Click **OK** and [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). + * C:\MitigationSettings\Config.XML + * \\\Server\Share\Config.xml + * https://localhost:8080/Config.xml + * C:\ExploitConfigfile.xml +6. Click **OK** and [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). ## Related topics -- [Protect devices from exploits](exploit-protection-exploit-guard.md) -- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) -- [Evaluate exploit protection](evaluate-exploit-protection.md) -- [Enable exploit protection](enable-exploit-protection.md) -- [Configure and audit exploit protection mitigations](customize-exploit-protection.md) +* [Protect devices from exploits](exploit-protection.md) +* [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection.md) +* [Evaluate exploit protection](evaluate-exploit-protection.md) +* [Enable exploit protection](enable-exploit-protection.md) +* [Configure and audit exploit protection mitigations](customize-exploit-protection.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/incidents-queue.md b/windows/security/threat-protection/microsoft-defender-atp/incidents-queue.md deleted file mode 100644 index 3defa8692a..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/incidents-queue.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Incidents queue in Microsoft Defender ATP -description: -keywords: incidents, aggregate, investigations, queue, ttp -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dansimp -author: dansimp -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual ---- - -# Incidents in Microsoft Defender ATP -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - - -When a cybersecurity threat is emerging, or a potential attacker is deploying its tactics, techniques/tools, and procedures (TTPs) on the network, Microsoft Defender ATP will quickly trigger alerts and launch matching automatic investigations. - -Microsoft Defender ATP applies correlation analytics and aggregates all related alerts and investigations into an incident. Doing so helps narrate a broader story of an attack, thus providing you with the right visuals (upgraded incident graph) and data representations to understand and deal with complex cross-entity threats to your organization's network. - - -## In this section - -Topic | Description -:---|:--- -[View and organize the Incidents queue](view-incidents-queue.md)| See the list of incidents and learn how to apply filters to limit the list and get a more focused view. -[Manage incidents](manage-incidents.md) | Learn how to manage incidents by assigning it, updating its status, or setting its classification and other actions. -[Investigate incidents](investigate-incidents.md)| See associated alerts, manage the incident, see alert metadata, and visualizations to help you investigate an incident. - - diff --git a/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md b/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md index ee65c7302f..dcc141f161 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -45,8 +45,8 @@ Sensitivity labels classify and help protect sensitive content. Sensitive information types in the Office 365 data loss prevention (DLP) implementation fall under two categories: -- Default -- Custom +- Default +- Custom Default sensitive information types include information such as bank account numbers, social security numbers, or national IDs. For more information, see [What the sensitive information type look for](https://docs.microsoft.com/office365/securitycompliance/what-the-sensitive-information-types-look-for). diff --git a/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md index f7bcff5265..7578bad95e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md @@ -57,9 +57,6 @@ Learn how to use data sensitivity labels to prioritize incident investigation. ![Image of machine timeline with narrowed down search results based on label](images/machine-timeline-labels.png) ->[!NOTE] -> The event side pane now provides additional insight to the WIP and AIP protection status. - >[!TIP] >These data points are also exposed through the ‘FileCreationEvents’ in advanced hunting, allowing advanced queries and schedule detection to take into account sensitivity labels and file protection status. \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md index 11e43b707c..fc412ef07c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md @@ -26,7 +26,7 @@ ms.date: 04/24/2018 ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatealerts-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatealerts-abovefoldlink) Investigate alerts that are affecting your network, understand what they mean, and how to resolve them. diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md index 18d267c4cd..583366232a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md @@ -23,7 +23,7 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatemachines-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatemachines-abovefoldlink) Microsoft Defender ATP supports network connection monitoring from different levels of the network stack. A challenging case is when the network uses a forward proxy as a gateway to the Internet. diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-domain.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-domain.md index 8268c3ce96..e352bb1469 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-domain.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-domain.md @@ -26,7 +26,7 @@ ms.date: 04/24/2018 ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatedomain-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatedomain-abovefoldlink) Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain. diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md index 6cb6750c1c..94d19a39d9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-files.md @@ -26,7 +26,7 @@ ms.date: 04/24/2018 [!include[Prerelease information](prerelease.md)] ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatefiles-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatefiles-abovefoldlink) Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. @@ -52,6 +52,7 @@ Along the top of the profile page, above the file information cards. Actions you - Stop and quarantine - Add/edit indicator - Download file +- Consult a threat expert - Action center For more information on these actions, see [Take response action on a file](respond-file-alerts.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-ip.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-ip.md index 4f3711af17..08fee8aed4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-ip.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-ip.md @@ -24,7 +24,7 @@ ms.date: 04/24/2018 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigateip-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigateip-abovefoldlink) Examine possible communication between your machines and external internet protocol (IP) addresses. diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md index c79fa83c94..75a98adc36 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md @@ -23,7 +23,7 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatemachines-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatemachines-abovefoldlink) Investigate the details of an alert raised on a specific machine to identify other behaviors or events that might be related to the alert or the potential scope of the breach. @@ -60,6 +60,7 @@ Response actions run along the top of a specific machine page and include: - Run antivirus scan - Restrict app execution - Isolate machine +- Consult a threat expert - Action center You can take response actions in the Action center, in a specific machine page, or in a specific file page. diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-user.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-user.md index 4ef33de1cf..ed90aafde4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-user.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-user.md @@ -23,7 +23,7 @@ ms.date: 04/24/2018 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatgeuser-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatgeuser-abovefoldlink) ## Investigate user account entities diff --git a/windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org.md b/windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org.md deleted file mode 100644 index 408e800158..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Is domain seen in org API -description: Use this API to create calls related to checking whether a domain was seen in the organization. -keywords: apis, graph api, supported apis, domain, domain seen -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Was domain seen in org - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Answers whether a domain was seen in the organization. - -## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) - -Permission type | Permission | Permission display name -:---|:---|:--- -Application | Url.Read.All | 'Read URLs' -Delegated (work or school account) | URL.Read.All | 'Read URLs' - ->[!Note] -> When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information) - -## HTTP request -``` -GET /api/domains/{domain} -``` - -## Request headers - -Header | Value -:---|:--- -Authorization | Bearer {token}. **Required**. - - -## Request body -Empty - -## Response -If successful and domain exists - 200 OK. If domain does not exist - 404 Not Found. - -## Example - -**Request** - -Here is an example of the request. - -[!include[Improve request performance](improve-request-performance.md)] - -``` -GET https://api.securitycenter.windows.com/api/domains/example.com -Content-type: application/json -``` - -**Response** - -Here is an example of the response. - - -``` -HTTP/1.1 200 OK -Content-type: application/json -{ - "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Domains/$entity", - "host": "example.com" -} -``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org.md b/windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org.md deleted file mode 100644 index 3239831649..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Is IP seen in org API -description: Answers whether an IP was seen in the organization. -keywords: apis, graph api, supported apis, is, ip, seen, org, organization -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Was IP seen in org - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Answers whether an IP was seen in the organization. - -## Permissions -One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) - -Permission type | Permission | Permission display name -:---|:---|:--- -Application | Ip.Read.All | 'Read IP address profiles' -Delegated (work or school account) | Ip.Read.All | 'Read IP address profiles' - ->[!Note] -> When obtaining a token using user credentials: ->- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information) - -## HTTP request -``` -GET /api/ips/{ip} -``` - -## Request headers - -Name | Type | Description -:---|:---|:--- -Authorization | String | Bearer {token}. **Required**. - - -## Request body -Empty - -## Response -If successful and IP exists - 200 OK. If IP do not exist - 404 Not Found. - - -## Example - -**Request** - -Here is an example of the request. - -``` -GET https://api.securitycenter.windows.com/api/ips/10.209.67.177 -``` - -**Response** - -Here is an example of the response. - -[!include[Improve request performance](improve-request-performance.md)] - - -``` -HTTP/1.1 200 OK -Content-type: application/json -{ - "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Ips/$entity", - "id": "10.209.67.177" -} -``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/isolate-machine.md b/windows/security/threat-protection/microsoft-defender-atp/isolate-machine.md index 095c078b1f..9747f2d0ae 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/isolate-machine.md +++ b/windows/security/threat-protection/microsoft-defender-atp/isolate-machine.md @@ -61,8 +61,8 @@ Comment | String | Comment to associate with the action. **Required**. IsolationType | String | Type of the isolation. Allowed values are: 'Full' or 'Selective'. **IsolationType** controls the type of isolation to perform and can be one of the following: -- Full – Full isolation -- Selective – Restrict only limited set of applications from accessing the network (see [Isolate machines from the network](respond-machine-alerts.md#isolate-machines-from-the-network) for more details) +- Full – Full isolation +- Selective – Restrict only limited set of applications from accessing the network (see [Isolate machines from the network](respond-machine-alerts.md#isolate-machines-from-the-network) for more details) ## Response diff --git a/windows/security/threat-protection/microsoft-defender-atp/licensing.md b/windows/security/threat-protection/microsoft-defender-atp/licensing.md index 105fc8bd52..3b8b796791 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/licensing.md +++ b/windows/security/threat-protection/microsoft-defender-atp/licensing.md @@ -24,7 +24,7 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-validatelicense-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-validatelicense-abovefoldlink) ## Check license state diff --git a/windows/security/threat-protection/microsoft-defender-atp/live-response.md b/windows/security/threat-protection/microsoft-defender-atp/live-response.md index d3ed3224e5..151cc9a4d1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/live-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/live-response.md @@ -22,8 +22,6 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] - Live response is a capability that gives you instantaneous access to a machine using a remote shell connection. This gives you the power to do in-depth investigative work and take immediate response actions to promptly contain identified threats – real-time. diff --git a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md index 6dff3ffaae..c9543f40e7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machine-tags.md @@ -67,7 +67,8 @@ Machines with similar tags can be handy when you need to apply contextual action Use the following registry key entry to add a tag on a machine: - Registry key: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging\` -- Registry key value (string): Group +- Registry key name: `Group` +- Registry key value (REG_SZ): `Name of the tag you want to set` >[!NOTE] >The device tag is part of the machine information report that's generated once a day. As an alternative, you may choose to restart the endpoint that would transfer a new machine information report. diff --git a/windows/security/threat-protection/microsoft-defender-atp/machineactionsnote.md b/windows/security/threat-protection/microsoft-defender-atp/machineactionsnote.md index fe12e8ee4e..eb66c2d069 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machineactionsnote.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machineactionsnote.md @@ -2,7 +2,7 @@ ms.date: 08/28/2017 ms.reviewer: manager: dansimp -ms.author: mjcaparas +ms.author: macapara author: mjcaparas --- >[!Note] diff --git a/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md b/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md index 788a106f59..e526c0bead 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview.md @@ -23,7 +23,7 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-machinesview-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-machinesview-abovefoldlink) The **Machines list** shows a list of the machines in your network where alerts were generated. By default, the queue displays machines with alerts seen in the last 30 days. diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md index 3113e4b4f9..92f89df9a7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-managealerts-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-managealerts-abovefoldlink) Microsoft Defender ATP notifies you of possible malicious events, attributes, and contextual information through alerts. A summary of new alerts is displayed in the **Security operations dashboard**, and you can access all alerts in the **Alerts queue**. @@ -36,7 +36,7 @@ Selecting an alert in either of those places brings up the **Alert management pa You can create a new incident from the alert or link to an existing incident. ## Assign alerts -If an alert is no yet assigned, you can select **Assign to me** to assign the alert to yourself. +If an alert is not yet assigned, you can select **Assign to me** to assign the alert to yourself. ## Suppress alerts diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list.md b/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list.md deleted file mode 100644 index c852df752c..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: Manage allowed/blocked lists -description: Create indicators for a file hash, IP address, URLs or domains that define the detection, prevention, and exclusion of entities. -keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Manage allowed/blocked lists - -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -[!include[Prerelease information](prerelease.md)] - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) - - -Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to. - -On the top navigation you can: -- Import a list -- Add an indicator -- Customize columns to add or remove columns -- Export the entire list in CSV format -- Select the items to show per page -- Navigate between pages -- Apply filters - -## Create an indicator -1. In the navigation pane, select **Settings** > **Allowed/blocked list**. - -2. Select the tab of the type of entity you'd like to create an indicator for. You can choose any of the following entities: - - File hash - - IP address - - URLs/Domains - -3. Click **Add indicator**. - -4. For each attribute specify the following details: - - Indicator - Specify the entity details and define the expiration of the indicator. - - Action - Specify the action to be taken and provide a description. - - Scope - Define the scope of the machine group. - -5. Review the details in the Summary tab, then click **Save**. - - ->[!NOTE] ->Blocking IPs, domains, or URLs is currently available on limited preview only. ->This requires sending your custom list to [network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection) to be enforced which is an option that will be generally available soon. ->As it is not yet generally available, when Automated investigations finds this indicator during an investigation it will use the allowed/block list as the basis of its decision to automatically remediate (blocked list) or skip (allowed list) the entity. - - -## Manage indicators -1. In the navigation pane, select **Settings** > **Allowed/blocked list**. - -2. Select the tab of the entity type you'd like to manage. - -3. Update the details of the indicator and click **Save** or click the **Delete** button if you'd like to remove the entity from the list. - -## Import a list -You can also choose to upload a CSV file that defines the attributes of indicators, the action to be taken, and other details. - -Download the sample CSV to know the supported column attributes. - - -## Related topics -- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list.md) - - - - - diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md deleted file mode 100644 index b30f739163..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Manage automation allowed/blocked lists -description: Create lists that control what items are automatically blocked or allowed during an automatic investigation. -keywords: manage, automation, whitelist, blacklist, block, clean, malicious -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Manage automation allowed/blocked lists - -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - - - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) - -Create a rule to control which entities are automatically incriminated or exonerated during Automated investigations. - -Entities added to the allowed list are considered safe and will not be analyzed during Automated investigations. - -Entities added to the blocked list are considered malicious and will be remediated during Automated investigations. - -You can define the conditions for when entities are identified as malicious or safe based on certain attributes such as hash values or certificates. - -## Create an allowed or blocked list -1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. - -2. Select the tab of the type of entity you'd like to create an exclusion for. Currently, you can add a rule for certificates. - -3. Select **Add allowed/blocked list rule**. - -4. For each attribute specify the exclusion type, details, and their corresponding required values. - -5. Click **Add rule**. - -## Edit a list -1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. - -2. Select the tab of the entity type you'd like to edit the list from. - -3. Update the details of the rule and click **Update rule**. - -## Delete a list -1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. - -2. Select the tab of the entity type you'd like to delete the list from. - -3. Select the list type by clicking the check-box beside the list type. - -4. Click **Delete**. - - -## Related topics -- [Manage automation file uploads](manage-automation-file-uploads.md) -- [Manage indicators](manage-indicators.md) -- [Manage automation folder exclusions](manage-automation-folder-exclusions.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads.md b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads.md index cdf8cabeb1..7268e93b7a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads.md @@ -26,7 +26,7 @@ ms.topic: article ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationefileuploads-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationefileuploads-abovefoldlink) Enable the content analysis capability so that certain files and email attachments can automatically be uploaded to the cloud for additional inspection in Automated investigation. diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions.md b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions.md index 2ff51aee05..e05d6ca55c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions.md @@ -26,7 +26,7 @@ ms.topic: article ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionfolder-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionfolder-abovefoldlink) Automation folder exclusions allow you to specify folders that the Automated investigation will skip. diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-edr.md b/windows/security/threat-protection/microsoft-defender-atp/manage-edr.md index 1dc3f9be1f..2e124ba8aa 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-edr.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-edr.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index dce7f4aaf2..f0cf3d6772 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,4 +1,4 @@ ---- +--- title: Manage indicators ms.reviewer: description: Create indicators for a file hash, IP address, URLs or domains that define the detection, prevention, and exclusion of entities. @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -23,32 +23,121 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!include[Prerelease information](prerelease.md)] + >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) +Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability is available in Microsoft Defender ATP and gives SecOps the ability to set a list of indicators for detection and for blocking (prevention and response). + Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to. -On the top navigation you can: +Currently supported sources are the cloud detection engine of Microsoft Defender ATP, the automated investigation and remediation engine, and the endpoint prevention engine (Windows Defender AV). -- Import a list -- Add an indicator -- Customize columns to add or remove columns -- Export the entire list in CSV format -- Select the items to show per page -- Navigate between pages -- Apply filters +**Cloud detection engine**
                        +The cloud detection engine of Microsoft Defender ATP regularly scans collected data and tries to match the indicators you set. When there is a match, action will be taken according to the settings you specified for the IoC. -## Create an indicator +**Endpoint prevention engine**
                        +The same list of indicators is honored by the prevention agent. Meaning, if Windows Defender AV is the primary AV configured, the matched indicators will be treated according to the settings. For example, if the action is "Alert and Block", Windows Defender AV will prevent file executions (block and remediate) and a corresponding alert will be raised. On the other hand, if the Action is set to "Allow", Windows Defender AV will not detect nor block the file from being run. + +**Automated investigation and remediation engine**
                        +The automated investigation and remediation behave the same. If an indicator is set to "Allow", Automated investigation and remediation will ignore a "bad" verdict for it. If set to "Block", Automated investigation and remediation will treat it as "bad". + + +The current supported actions are: +- Allow +- Alert only +- Alert and block + + +You can create an indicator for: +- Files +- IP addresses +- URLs/domains + +>[!NOTE] +>There is a limit of 5000 indicators per tenant. + + +![Image of indicators settings page](images/rules-indicators.png) + + +## Create indicators for files +You can prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file, you can block it. This operation will prevent it from being read, written, or executed on machines in your organization. + +There are two ways you can create indicators for files: +- By creating an indicator through the settings page +- By creating a contextual indicator using the add indicator button from the file details page + +### Before you begin +It's important to understand the following prerequisites prior to creating indicators for files: +- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). +- The Antimalware client version must be 4.18.1901.x or later. +- Supported on machines on Windows 10, version 1703 or later. +- To start blocking files, you first need to [turn the **Block or allow** feature on](advanced-features.md) in Settings. +- This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time. + +>[!IMPORTANT] +>- The allow or block function cannot be done on files if the file's classification exists on the device's cache prior to the allow or block action +>- Trusted signed files will be treated differently. Microsoft Defender ATP is optimized to handle malicious files. Trying to block trusted signed files, in some cases, may have performance implications. +>- The PE file needs to be in the machine timeline for you to be able to take this action. + + +>[!NOTE] +>There may be a couple of minutes of latency between the time the action is taken and the actual file being blocked. + +### Create an indicator for files from the settings page 1. In the navigation pane, select **Settings** > **Indicators**. -2. Select the tab of the type of entity you'd like to create an indicator for. You can choose any of the following entities: - - File hash - - IP address - - URLs/Domains - -3. Click **Add indicator**. +2. Select the **File hash** tab. -4. For each attribute specify the following details: +3. Select **Add indicator**. + +4. Specify the following details: + - Indicator - Specify the entity details and define the expiration of the indicator. + - Action - Specify the action to be taken and provide a description. + - Scope - Define the scope of the machine group. + +5. Review the details in the Summary tab, then click **Save**. + +### Create a contextual indicator from the file details page +One of the options when taking [response actions on a file](respond-file-alerts.md) is adding an indicator for the file. + +When you add an indicator hash for a file, you can choose to raise an alert and block the file whenever a machine in your organization attempts to run it. + +Files automatically blocked by an indicator won't show up in the files's Action center, but the alerts will still be visible in the Alerts queue. + + +## Create indicators for IPs and URLs/domains (preview) +Microsoft Defender ATP can block what Microsoft deems as malicious IPs/URLs through SmartScreen for Microsoft browsers and Network Protection for non-Microsoft browsers and calls made outside the browser. + +The threat intelligence data set for this has been managed by Microsoft. + +By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs or domains based on your own threat intelligence. You can do this through the settings page or by machine groups if you deem certain groups to be more or less at risk than others. + +### Before you begin +It's important to understand the following prerequisites prior to creating indicators for IPS, URLs or domains: +- URL/IP allow and block relies on the Microsoft Defender ATP component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see [Protect your network](network-protection.md). +- The Antimalware client version must be 4.18.1906.x or later. +- Supported on machines on Windows 10, version 1709 or later. +- Ensure that **Custom network indicators** is enabled in **Microsoft Defender Security Center > Settings > Advanced features**. For more information, see [Advanced features](advanced-features.md). + + +>[!IMPORTANT] +> Only external IPs can be added to the indicator list. Indicators cannot be created for internal IPs. + +>[!NOTE] +>There may be up to 2 hours latency (usually less) between the time the action is taken, and the URL and IP being blocked. + +### Create an indicator for IPs, URLs or domains from the settings page + +1. In the navigation pane, select **Settings** > **Indicators**. + +2. Select the **IP addresses or URLs/Domains** tab. + +3. Select **Add indicator**. + +4. Specify the following details: - Indicator - Specify the entity details and define the expiration of the indicator. - Action - Specify the action to be taken and provide a description. - Scope - Define the scope of the machine group. @@ -56,10 +145,6 @@ On the top navigation you can: 5. Review the details in the Summary tab, then click **Save**. ->[!NOTE] ->Blocking IPs, domains, or URLs is currently available on limited preview only. ->This requires sending your custom list to [network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection) to be enforced which is an option that will be generally available soon. ->As it is not yet generally available, when Automated investigations finds this indicator during an investigation it will use the allowed/block list as the basis of its decision to automatically remediate (blocked list) or skip (allowed list) the entity. ## Manage indicators @@ -69,12 +154,14 @@ On the top navigation you can: 3. Update the details of the indicator and click **Save** or click the **Delete** button if you'd like to remove the entity from the list. -## Import a list +## Import a list of IoCs You can also choose to upload a CSV file that defines the attributes of indicators, the action to be taken, and other details. Download the sample CSV to know the supported column attributes. ## Related topic +- [Create contextual IoC](respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) +- [Use the Microsoft Defender ATP indicators API](ti-indicator.md) +- [Use partner integrated solutions](partner-applications.md) -- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/management-apis.md b/windows/security/threat-protection/microsoft-defender-atp/management-apis.md index 25c32174b9..d6f7f0fecf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/management-apis.md +++ b/windows/security/threat-protection/microsoft-defender-atp/management-apis.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -23,7 +23,7 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-mgt-apis-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-mgt-apis-abovefoldlink) Microsoft Defender ATP supports a wide variety of options to ensure that customers can easily adopt the platform. @@ -52,7 +52,6 @@ An important aspect of machine management is the ability to analyze the environm Topic | Description :---|:--- Understand threat intelligence concepts | Learn about alert definitions, indicators of compromise, and other threat intelligence concepts. -Supported Microsoft Defender ATP APIs | Learn more about the individual supported entities where you can run API calls to and details such as HTTP request values, request headers and expected responses. Managed security service provider | Get a quick overview on managed security service provider support. @@ -61,7 +60,7 @@ Managed security service provider | Get a quick overview on managed security ser ## Related topics - [Onboard machines](onboard-configure.md) - [Enable the custom threat intelligence application](enable-custom-ti.md) -- [Microsoft Defender ATP Public API](use-apis.md) +- [Microsoft Defender ATP Public API](apis-intro.md) - [Pull alerts to your SIEM tools](configure-siem.md) - [Create and build Power BI reports using Microsoft Defender ATP data](powerbi-reports.md) - [Role-based access control](rbac.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config.md index 5f0af03683..b5bb4b00fd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md index 352d6289b9..d7197b2574 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md index 70561d13b0..da64a631d7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md @@ -19,9 +19,9 @@ ms.topic: conceptual # Microsoft Defender Advanced Threat Protection ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-main-abovefoldlink) +> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-main-abovefoldlink) > ->For more info about Windows 10 Enterprise Edition features and functionality, see [Windows 10 Enterprise edition](https://www.microsoft.com/WindowsForBusiness/buy). +> For more info about Windows 10 Enterprise Edition features and functionality, see [Windows 10 Enterprise edition](https://www.microsoft.com/WindowsForBusiness/buy). Microsoft Defender Advanced Threat Protection is a platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats. @@ -66,9 +66,9 @@ Microsoft Defender ATP uses the following combination of technology built into W
                        ->[!TIP] ->- Learn about the latest enhancements in Microsoft Defender ATP: [What's new in Microsoft Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/). ->- Microsoft Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/). +> [!TIP] +> - Learn about the latest enhancements in Microsoft Defender ATP: [What's new in Microsoft Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/). +> - Microsoft Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).                         @@ -78,7 +78,7 @@ This built-in capability uses a game-changing risk-based approach to the discove **[Attack surface reduction](overview-attack-surface-reduction.md)**
                        -The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations. +The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitation. @@ -99,7 +99,7 @@ In conjunction with being able to quickly respond to advanced attacks, Microsoft **[Secure score](overview-secure-score.md)**
                        ->[!NOTE] +> [!NOTE] > Secure score is now part of [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) as [Configuration score](configuration-score.md). The secure score page will be available for a few weeks. View the [Secure score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score) page. Microsoft Defender ATP includes a secure score to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security of your organization. @@ -127,7 +127,7 @@ To help you maximize the effectiveness of the security platform, you can configu Topic | Description :---|:--- [Overview](overview.md) | Understand the concepts behind the capabilities in Microsoft Defender ATP so you take full advantage of the complete threat protection platform. -[Get started](get-started.md) | Learn about the requirements of the platform and the initial steps you need to take to get started with Microsoft Defender ATP. +[Minimum requirements](minimum-requirements.md) | Learn about the requirements of the platform and the initial steps you need to take to get started with Microsoft Defender ATP. [Configure and manage capabilities](onboard.md)| Configure and manage the individual capabilities in Microsoft Defender ATP. [Troubleshoot Microsoft Defender ATP](troubleshoot-mdatp.md) | Learn how to address issues that you might encounter while using the platform. diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md index bb96ea1b7e..71b44a53e7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts.md @@ -1,15 +1,15 @@ --- title: Microsoft Threat Experts ms.reviewer: -description: Microsoft Threat Experts is the new managed threat hunting service in Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) that provides proactive hunting, prioritization, and additional context and insights that further empower security operations centers (SOCs) to identify and respond to threats quickly and accurately. It provides additional layer of expertise and optics that Microsoft customers can utilize to augment security operation capabilities as part of Microsoft 365. -keywords: managed threat hunting service, managed threat hunting, MTE, Microsoft Threat Experts +description: Microsoft Threat Experts is the new managed detection and response (MDR) service in Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) that provides proactive hunting, prioritization, and additional context and insights that further empower security operations centers (SOCs) to identify and respond to threats quickly and accurately. It provides additional layer of expertise and optics that Microsoft customers can utilize to augment security operation capabilities as part of Microsoft 365. +keywords: managed threat hunting service, managed threat hunting, managed detection and response (MDR) service, MTE, Microsoft Threat Experts search.product: Windows 10 search.appverid: met150 ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -24,8 +24,7 @@ ms.topic: conceptual [!include[Prerelease information](prerelease.md)] - -Microsoft Threat Experts is a managed hunting service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don’t get missed. +Microsoft Threat Experts is a managed detection and response (MDR) service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don’t get missed. This new capability provides expert-driven insights and data through targeted attack notification and access to experts on demand. @@ -36,9 +35,9 @@ Microsoft Threat Experts provides proactive hunting for the most important threa - Identifying the most important risks, helping SOCs maximize time and energy - Scope of compromise and as much context as can be quickly delivered to enable fast SOC response. -## Collaborate with experts, on demand +## Collaborate with experts, on demand >[!NOTE] ->The Microsoft Threat Experts' experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. +>The Microsoft Threat Experts' experts-on-demand capability is still in preview. You can only use the experts-on-demand capability if you have applied for preview and your application has been approved. Customers can engage our security experts directly from within Microsoft Defender Security Center for timely and accurate response. Experts provide insights needed to better understand the complex threats affecting your organization, from alert inquiries, potentially compromised machines, root cause of a suspicious network connection, to additional threat intelligence regarding ongoing advanced persistent threat campaigns. With this capability, you can: @@ -47,6 +46,19 @@ Customers can engage our security experts directly from within Microsoft Defende - Determine risk and protection regarding threat actors, campaigns, or emerging attacker techniques - Seamlessly transition to Microsoft Incident Response (IR) or other third-party Incident Response services when necessary +The option to **Consult a threat expert** is available in several places in the portal so you can engage with experts in the context of your investigation: + +- **Help and support menu**
                        +![Screenshot of MTE-EOD menu option](images/mte-eod-menu.png) + +- **Machine page actions menu**
                        +![Screenshot of MTE-EOD machine page action menu option](images/mte-eod-machines.png) + +- **Alerts page actions menu**
                        +![Screenshot of MTE-EOD alert page action menu option](images/mte-eod-alerts.png) + +- **File page actions menu**
                        +![Screenshot of MTE-EOD file page action menu option](images/mte-eod-file.png) ## Related topic - [Configure Microsoft Threat Experts capabilities](configure-microsoft-threat-experts.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md index ba54f650be..bf702f03ac 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md +++ b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md @@ -24,7 +24,7 @@ ms.topic: conceptual There are some minimum requirements for onboarding machines to the service. Learn about the licensing, hardware and software requirements, and other configuration settings to onboard devices to the service. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-minreqs-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-minreqs-abovefoldlink) >[!TIP] @@ -38,7 +38,7 @@ Microsoft Defender Advanced Threat Protection requires one of the following Micr - Windows 10 Education E5 - Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5 -For more information on the array of features in Windows 10 editions, see [Compare Windows 10 editions](https://www.microsoft.com/en-us/windowsforbusiness/compare). +For more information on the array of features in Windows 10 editions, see [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare). For a detailed comparison table of Windows 10 commercial edition comparison, see the [comparison PDF](https://go.microsoft.com/fwlink/p/?linkid=2069559). diff --git a/windows/security/threat-protection/microsoft-defender-atp/mssp-support.md b/windows/security/threat-protection/microsoft-defender-atp/mssp-support.md index 35519d3909..c9a4eb35da 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mssp-support.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mssp-support.md @@ -22,7 +22,7 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-mssp-support-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-mssp-support-abovefoldlink) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md similarity index 80% rename from windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md rename to windows/security/threat-protection/microsoft-defender-atp/network-protection.md index e4fccb655d..eb4b64456b 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: levinec ms.author: ellevin ms.date: 04/30/2019 @@ -20,40 +21,40 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Network protection helps reduce the attack surface of your devices from Internet-based events. It prevents employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. +Network protection helps reduce the attack surface of your devices from Internet-based events. It prevents employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet. It expands the scope of [Windows Defender SmartScreen](../windows-defender-smartscreen/windows-defender-smartscreen-overview.md) to block all outbound HTTP(s) traffic that attempts to connect to low-reputation sources (based on the domain or hostname). Network protection is supported beginning with Windows 10, version 1709. ->[!TIP] ->You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. +> [!TIP] +> You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. Network protection works best with [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). When network protection blocks a connection, a notification will be displayed from the Action Center. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors. -You can also use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how Network protection would impact your organization if it were enabled. +You can also use [audit mode](audit-windows-defender.md) to evaluate how Network protection would impact your organization if it were enabled. ## Requirements Network protection requires Windows 10 Pro, Enterprise E3, E5 and Windows Defender AV real-time protection. Windows 10 version | Windows Defender Antivirus -- | - +-|- Windows 10 version 1709 or later | [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) and [cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) must be enabled ## Review network protection events in the Microsoft Defender ATP Security Center -Microsoft Defender ATP provides detailed reporting into events and blocks as part of its [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). +Microsoft Defender ATP provides detailed reporting into events and blocks as part of its [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). -You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender-exploit-guard.md), you can use Advanced hunting to see how network protection settings would affect your environment if they were enabled. +You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use Advanced hunting to see how network protection settings would affect your environment if they were enabled. -Here is an example query +Here is an example query -``` +```PowerShell MiscEvents | where ActionType in ('ExploitGuardNetworkProtectionAudited','ExploitGuardNetworkProtectionBlocked') ``` @@ -62,7 +63,7 @@ MiscEvents You can review the Windows event log to see events that are created when network protection blocks (or audits) access to a malicious IP or domain: -1. [Copy the XML directly](event-views-exploit-guard.md). +1. [Copy the XML directly](event-views.md). 2. Click **OK**. @@ -71,12 +72,10 @@ You can review the Windows event log to see events that are created when network Event ID | Description -|- 5007 | Event when settings are changed - 1125 | Event when network protection fires in audit mode - 1126 | Event when network protection fires in block mode + 1125 | Event when network protection fires in audit mode + 1126 | Event when network protection fires in block mode - ## Related topics +## Related topics -Topic | Description ----|--- [Evaluate network protection](evaluate-network-protection.md) | Undertake a quick scenario that demonstrate how the feature works, and what events would typically be created. [Enable network protection](enable-network-protection.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage network protection in your network. diff --git a/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md b/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md index 66a4fdedf6..06e453c687 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md @@ -27,18 +27,18 @@ ms.topic: conceptual - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-offboardmachines-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-offboardmachines-abovefoldlink) Follow the corresponding instructions depending on your preferred deployment method. ## Offboard Windows 10 machines - - [Offboard machines using a local script](configure-endpoints-script.md#offboard-machines-using-a-local-script) - - [Offboard machines using Group Policy](configure-endpoints-gp.md#offboard-machines-using-group-policy) - - [Offboard machines using System Center Configuration Manager](configure-endpoints-sccm.md#offboard-machines-using-system-center-configuration-manager) - - [Offboard machines using Mobile Device Management tools](configure-endpoints-mdm.md#offboard-and-monitor-machines-using-mobile-device-management-tools) +- [Offboard machines using a local script](configure-endpoints-script.md#offboard-machines-using-a-local-script) +- [Offboard machines using Group Policy](configure-endpoints-gp.md#offboard-machines-using-group-policy) +- [Offboard machines using System Center Configuration Manager](configure-endpoints-sccm.md#offboard-machines-using-system-center-configuration-manager) +- [Offboard machines using Mobile Device Management tools](configure-endpoints-mdm.md#offboard-and-monitor-machines-using-mobile-device-management-tools) ## Offboard Servers - - [Offboard servers](configure-server-endpoints.md#offboard-servers) +- [Offboard servers](configure-server-endpoints.md#offboard-servers) ## Offboard non-Windows machines - - [Offboard non-Windows machines](configure-endpoints-non-windows.md#offboard-non-windows-machines) +- [Offboard non-Windows machines](configure-endpoints-non-windows.md#offboard-non-windows-machines) diff --git a/windows/security/threat-protection/microsoft-defender-atp/oldTOC.md b/windows/security/threat-protection/microsoft-defender-atp/oldTOC.txt similarity index 95% rename from windows/security/threat-protection/microsoft-defender-atp/oldTOC.md rename to windows/security/threat-protection/microsoft-defender-atp/oldTOC.txt index 35d03646ca..9dd1998f62 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/oldTOC.md +++ b/windows/security/threat-protection/microsoft-defender-atp/oldTOC.txt @@ -27,10 +27,10 @@ #### [Application control]() ##### [Windows Defender Application Guard](../windows-defender-application-control/windows-defender-application-control.md) -#### [Exploit protection](../windows-defender-exploit-guard/exploit-protection-exploit-guard.md) -#### [Network protection](../windows-defender-exploit-guard/network-protection-exploit-guard.md) -#### [Controlled folder access](../windows-defender-exploit-guard/controlled-folders-exploit-guard.md) -#### [Attack surface reduction](../windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) +#### [Exploit protection](../windows-defender-exploit-guard/exploit-protection.md) +#### [Network protection](../windows-defender-exploit-guard/network-protection.md) +#### [Controlled folder access](../windows-defender-exploit-guard/controlled-folders.md) +#### [Attack surface reduction](../windows-defender-exploit-guard/attack-surface-reduction.md) #### [Network firewall](../windows-firewall/windows-firewall-with-advanced-security.md) @@ -196,8 +196,8 @@ #### [Network protection](../windows-defender-exploit-guard/enable-network-protection.md) #### [Controlled folder access]() -##### [Enable controlled folder access](../windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md) -##### [Customize controlled folder access](../windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md) +##### [Enable controlled folder access](../windows-defender-exploit-guard/enable-controlled-folders.md) +##### [Customize controlled folder access](../windows-defender-exploit-guard/customize-controlled-folders.md) #### [Attack surface reduction controls]() ##### [Enable attack surface reduction rules](../windows-defender-exploit-guard/enable-attack-surface-reduction.md) @@ -392,7 +392,6 @@ ####### [Get domain related alerts](get-domain-related-alerts.md) ####### [Get domain related machines](get-domain-related-machines.md) ####### [Get domain statistics](get-domain-statistics.md) -####### [Is domain seen in organization](is-domain-seen-in-org.md) ###### [File]() ####### [Methods and properties](files.md) @@ -403,9 +402,7 @@ ###### [IP]() ####### [Get IP related alerts](get-ip-related-alerts.md) -####### [Get IP related machines](get-ip-related-machines.md) ####### [Get IP statistics](get-ip-statistics.md) -####### [Is IP seen in organization](is-ip-seen-org.md) ###### [User]() ####### [Methods](user.md) @@ -413,15 +410,10 @@ ####### [Get user related machines](get-user-related-machines.md) ##### [How to use APIs - Samples]() -###### [Advanced Hunting API]() -####### [Schedule advanced Hunting using Microsoft Flow](run-advanced-query-sample-ms-flow.md) -####### [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) -####### [Advanced Hunting using Python](run-advanced-query-sample-python.md) -####### [Create custom Power BI reports](run-advanced-query-sample-power-bi-app-token.md) - -###### [Multiple APIs]() -####### [PowerShell](exposed-apis-full-sample-powershell.md) - +###### [Microsoft Flow](api-microsoft-flow.md) +###### [Power BI](api-power-bi.md) +###### [Advanced Hunting using Python](run-advanced-query-sample-python.md) +###### [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) ###### [Using OData Queries](exposed-apis-odata-samples.md) #### [API for custom alerts]() @@ -433,13 +425,13 @@ ##### [Experiment with custom threat intelligence alerts](experiment-custom-ti.md) ##### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti.md) -#### [Pull alerts to your SIEM tools]() -##### [Learn about different ways to pull alerts](configure-siem.md) +#### [Pull Detections to your SIEM tools]() +##### [Learn about different ways to pull Detections](configure-siem.md) ##### [Enable SIEM integration](enable-siem-integration.md) -##### [Configure Splunk to pull alerts](configure-splunk.md) -##### [Configure HP ArcSight to pull alerts](configure-arcsight.md) -##### [Microsoft Defender ATP SIEM alert API fields](api-portal-mapping.md) -##### [Pull alerts using SIEM REST API](pull-alerts-using-rest-api.md) +##### [Configure Splunk to pull Detections](configure-splunk.md) +##### [Configure HP ArcSight to pull Detections](configure-arcsight.md) +##### [Microsoft Defender ATP Detection fields](api-portal-mapping.md) +##### [Pull Detections using SIEM REST API](pull-alerts-using-rest-api.md) ##### [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) #### [Reporting]() diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md b/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md index e6720fb5ed..52819cd05d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md @@ -24,7 +24,7 @@ ms.topic: conceptual [!include[Prerelease information](prerelease.md)] ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) You'll need to go the onboarding section of the Microsoft Defender ATP portal to onboard any of the supported devices. Depending on the device, you'll be guided with appropriate steps and provided management and deployment tool options suitable for the device. @@ -46,7 +46,7 @@ Topic | Description [Configure proxy and Internet settings](configure-proxy-internet.md)| Enable communication with the Microsoft Defender ATP cloud service by configuring the proxy and Internet connectivity settings. [Troubleshoot onboarding issues](troubleshoot-onboarding.md) | Learn about resolving issues that might arise during onboarding. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel.md b/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel.md index 1d8fa91df1..48502bca90 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel.md @@ -28,7 +28,7 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-downlevel-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-downlevel-abovefoldlink) Microsoft Defender ATP extends support to include down-level operating systems, providing advanced attack detection and investigation capabilities on supported Windows versions. @@ -64,7 +64,7 @@ Review the following details to verify minimum system requirements: - Install the [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/help/3080149/update-for-customer-experience-and-diagnostic-telemetry) -- Install either [.NET framework 4.5](https://www.microsoft.com/en-us/download/details.aspx?id=30653) (or later) or [KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework) +- Install either [.NET framework 4.5](https://www.microsoft.com/download/details.aspx?id=30653) (or later) or [KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework) >[!NOTE] >Only applicable for Windows 7 SP1 Enterprise and Windows 7 SP1 Pro. @@ -112,7 +112,7 @@ Agent Resource | Ports ## Offboard client endpoints To offboard, you can uninstall the MMA agent from the endpoint or detach it from reporting to your Microsoft Defender ATP workspace. After offboarding the agent, the endpoint will no longer send sensor data to Microsoft Defender ATP. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-downlevele-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-downlevele-belowfoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines.md b/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines.md index e520f70a7f..ff5e1ed7d9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboard.md b/windows/security/threat-protection/microsoft-defender-atp/onboard.md index f28db7412f..0d041b05e3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboard.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -33,8 +33,8 @@ Topic | Description [Configure next generation protection](../windows-defender-antivirus/configure-windows-defender-antivirus-features.md) | Configure next generation protection to catch all types of emerging threats. [Configure Secure score dashboard security controls](secure-score-dashboard.md) | Configure the security controls in Secure score to increase the security posture of your organization. [Configure Microsoft Threat Experts capabilities](configure-microsoft-threat-experts.md) | Configure and manage how you would like to get cybersecurity threat intelligence from Microsoft Threat Experts. -Configure Microsoft Threat Protection integration| Configure other solutions that integrate with Microsoft Defender ATP. -Management and API support| Pull alerts to your SIEM or use APIs to create custom alerts. Create and build Power BI reports. +[Configure Microsoft Threat Protection integration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration)| Configure other solutions that integrate with Microsoft Defender ATP. +[Management and API support](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/management-apis)| Pull alerts to your SIEM or use APIs to create custom alerts. Create and build Power BI reports. [Configure Microsoft Defender Security Center settings](preferences-setup.md) | Configure portal related settings such as general settings, advanced features, enable the preview experience and others. diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding-notification.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding-notification.md new file mode 100644 index 0000000000..ce96f68340 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding-notification.md @@ -0,0 +1,199 @@ +--- +title: Create an onboarding or offboarding notification rule +description: Get a notification when a local onboarding or offboarding script is used. +keywords: onboarding, offboarding, local, script, notification, rule +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Create a notification rule when a local onboarding or offboarding script is used + +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +Create a notification rule so that when a local onboarding or offboardiing script is used, you'll be notified. + +## Before you begin +You'll need to have access to: + - Microsoft Flow (Flow Plan 1 at a minimum). For more information, see [Flow pricing page](https://flow.microsoft.com/pricing/). + - Azure Table or SharePoint List or Library / SQL DB + +## Create the notification flow + +1. In [flow.microsoft.com](https://flow.microsoft.com/). + +2. Navigate to **My flows > New > Scheduled - from blank**. + + ![Image of flow](images/new-flow.png) + + +3. Build a scheduled flow. + 1. Enter a flow name. + 2. Specify the start and time. + 3. Specify the frequency. For example, every 5 minutes. + + ![Image of the notification flow](images/build-flow.png) + +4. Select the + button to add a new action. The new action will be an HTTP request to the Microsoft Defender ATP security center machine(s) API. You can also replace it with the out-of-the-box "WDATP Connector" (action: "Machines - Get list of machines"). + + ![Image of recurrence and add action](images/recurrence-add.png) + + +5. Enter the following HTTP fields: + + - Method: "GET" as a value to get the list of machines. + - URI: Enter `https://api.securitycenter.windows.com/api/machines`. + - Authentication: Select "Active Directory OAuth". + - Tenant: Sign-in to http://portal.azure.com and navigate to **Azure Active Directory > App Registrations** and get the Tenant ID value. + - Audience: `https://securitycenter.onmicrosoft.com/windowsatpservice\` + - Client ID: Sign-in to http://portal.azure.com and navigate to **Azure Active Directory > App Registrations** and get the Client ID value. + - Credential Type: Select "Secret". + - Secret: Sign-in to http://portal.azure.com and navigate tnd navigate to **Azure Active Directory > App Registrations** and get the Tenant ID value. + + ![Image of the HTTP conditions](images/http-conditions.png) + + +6. Add a new step by selecting **Add new action** then search for **Data Operations** and select +**Parse JSON**. + + ![Image of data operations](images/data-operations.png) + +7. Add Body in the **Content** field. + + ![Image of parse JSON](images/parse-json.png) + +8. Select the **Use sample payload to generate schema** link. + + ![Image of parse json with payload](images/parse-json-schema.png) + +9. Copy and paste the following JSON snippet: + + ``` + { + "type": "object", + "properties": { + "@@odata.context": { + "type": "string" + }, + "value": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "computerDnsName": { + "type": "string" + }, + "firstSeen": { + "type": "string" + }, + "lastSeen": { + "type": "string" + }, + "osPlatform": { + "type": "string" + }, + "osVersion": {}, + "lastIpAddress": { + "type": "string" + }, + "lastExternalIpAddress": { + "type": "string" + }, + "agentVersion": { + "type": "string" + }, + "osBuild": { + "type": "integer" + }, + "healthStatus": { + "type": "string" + }, + "riskScore": { + "type": "string" + }, + "exposureScore": { + "type": "string" + }, + "aadDeviceId": {}, + "machineTags": { + "type": "array" + } + }, + "required": [ + "id", + "computerDnsName", + "firstSeen", + "lastSeen", + "osPlatform", + "osVersion", + "lastIpAddress", + "lastExternalIpAddress", + "agentVersion", + "osBuild", + "healthStatus", + "rbacGroupId", + "rbacGroupName", + "riskScore", + "exposureScore", + "aadDeviceId", + "machineTags" + ] + } + } + } + } + + ``` + +10. Extract the values from the JSON call and check if the onboarded machine(s) is / are already registered at the SharePoint list as an example: +- If yes, no notification will be triggered +- If no, will register the new onboarded machine(s) in the SharePoint list and a notification will be sent to the Microsoft Defender ATP admin + + ![Image of apply to each](images/flow-apply.png) + + ![Image of apply to each with get items](images/apply-to-each.png) + +11. Under **Condition**, add the following expression: "length(body('Get_items')?['value'])" and set the condition to equal to 0. + + ![Image of apply to each condition](images/apply-to-each-value.png) + ![Image of condition](images/conditions-2.png) + ![Image of condition](images/condition3.png) + ![Image of send email](images/send-email.png) + +## Alert notification +The following image is an example of an email notification. + +![Image of email notification](images/alert-notification.png) + + +## Tips + +- You can filter here using lastSeen only: + - Every 60 min: + - Take all machines last seen in the past 7 days. + +- For each machine: + - If last seen property is on the one hour interval of [-7 days, -7days + 60 minutes ] -> Alert for offboarding possibility. + - If first seen is on the past hour -> Alert for onboarding. + +In this solution you will not have duplicate alerts: +There are tenants that have numerous machines. Getting all those machines might be very expensive and might require paging. + +You can split it to two queries: +1. For offboarding take only this interval using the OData $filter and only notify if the conditions are met. +2. Take all machines last seen in the past hour and check first seen property for them (if the first seen property is on the past hour, the last seen must be there too). + diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction.md index 5de1f9d993..eeaaedc402 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction.md @@ -2,15 +2,15 @@ title: Overview of attack surface reduction ms.reviewer: description: Learn about the attack surface reduction capability in Microsoft Defender ATP -keywords: +keywords: asr, attack surface reduction, microsoft defender atp, microsoft defender, antivirus, av, windows defender search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas -author: mjcaparas +ms.author: deniseb +author: denisebmsft ms.localizationpriority: medium manager: dansimp audience: ITPro @@ -21,17 +21,16 @@ ms.topic: conceptual # Overview of attack surface reduction **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Attack surface reduction capabilities in Microsoft Defender ATP helps protect the devices and applications in your organization from new and emerging threats. - -| Capability | Description | -|------------|-------------| -| [Hardware-based isolation](../windows-defender-application-guard/wd-app-guard-overview.md) | Protects and maintains the integrity of the system as it starts and while it's running, and validates system integrity through local and remote attestation. In addition, container isolation for Microsoft Edge helps protect host operating system from malicious websites. | -| [Application control](../windows-defender-application-control/windows-defender-application-control.md) | Moves away from the traditional application trust model where all applications are assumed trustworthy by default to one where applications must earn trust in order to run. | -| [Exploit protection](../windows-defender-exploit-guard/exploit-protection-exploit-guard.md) | Applies exploit mitigation techniques to apps your organization uses, both individually and to all apps. Works with third-party antivirus solutions and Windows Defender Antivirus (Windows Defender AV) | -| [Network protection](../windows-defender-exploit-guard/network-protection-exploit-guard.md) | Extends the malware and social engineering protection offered by Windows Defender SmartScreen in Microsoft Edge to cover network traffic and connectivity on your organization's devices. Requires Windows Defender AV. | -| [Controlled folder access](../windows-defender-exploit-guard/controlled-folders-exploit-guard.md) | Helps protect files in key system folders from changes made by malicious and suspicious apps, including file-encrypting ransomware malware. Requires Windows Defender AV. | -| [Attack surface reduction](../windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) | reduce the attack surface of your applications with intelligent rules that stop the vectors used by Office-, script- and mail-based malware. Requires Windows Defender AV. | -| [Network firewall](../windows-firewall/windows-firewall-with-advanced-security.md) | Host-based, two-way network traffic filtering that blocks unauthorized network traffic flowing into or out of the local device. | +Reduce your attack surfaces by minimizing the places where your organization is vulnerable to cyberthreats and attacks. Use the following resources to configure protection for the devices and applications in your organization. +Article | Description +-|- +[Hardware-based isolation](../windows-defender-application-guard/wd-app-guard-overview.md) | Protect and maintain the integrity of a system as it starts and while it's running. Validate system integrity through local and remote attestation. And, use container isolation for Microsoft Edge to help guard against malicious websites. +[Application control](../windows-defender-application-control/windows-defender-application-control.md) | Use application control so that your applications must earn trust in order to run. +[Exploit protection](./exploit-protection.md) |Help protect operating systems and apps your organization uses from being exploited. Exploit protection also works with third-party antivirus solutions. +[Network protection](./network-protection.md) |Extend protection to your network traffic and connectivity on your organization's devices. (Requires Windows Defender Antivirus) | +[Controlled folder access](./controlled-folders.md) | Help prevent malicious or suspicious apps (including file-encrypting ransomware malware) from making changes to files in your key system folders (Requires Windows Defender Antivirus) +[Attack surface reduction](./attack-surface-reduction.md) |Reduce vulnerabilities (attack surfaces) in your applications with intelligent rules that help stop malware. (Requires Windows Defender Antivirus) +[Network firewall](../windows-firewall/windows-firewall-with-advanced-security.md) |Prevent unauthorized traffic from flowing to or from your organization's devices with two-way network traffic filtering. diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md index d9d1de552d..9579771415 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md b/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md index 9065093f4d..8343dc2003 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation.md b/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation.md index 94b82c67e2..344d125399 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation.md @@ -13,7 +13,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.author: mjcaparas +ms.author: macapara ms.date: 09/07/2018 --- diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score.md b/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score.md index ccc8855e33..f08e397a67 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score.md @@ -21,8 +21,8 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->[!NOTE] -> Secure score is now part of [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) as [Configuration score](configuration-score.md). The secure score page will be available for a few weeks. View the [Secure score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score) page. +>[!NOTE] +> Secure score is now part of [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) as [Configuration score](configuration-score.md). The secure score page will be available for a few weeks. The Secure score dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines. @@ -40,17 +40,17 @@ The **Secure score dashboard** displays a snapshot of: ![Secure score dashboard](images/new-secure-score-dashboard.png) ## Microsoft secure score -The Microsoft secure score tile is reflective of the sum of all the Microsoft Defender security controls that are configured according to the recommended baseline and Office 365 controls. It allows you to drill down into each portal for further analysis. You can also improve this score by taking the steps in configuring each of the security controls in the optimal settings. +The Microsoft secure score tile is reflective of the sum of all the security controls that are configured according to the recommended Windows baseline and Office 365 controls. It allows you to drill down into each portal for further analysis. You can also improve this score by taking the steps in configuring each of the security controls in the optimal settings. ![Image of Microsoft secure score tile](images/mss.png) -Each Windows Defender security control contributes 100 points to the score. The total number is reflective of the score potential and calculated by multiplying the number of supported security controls (Windows Defender security controls pillars) by the maximum points that each pillar contributes (maximum of 100 points for each pillar). +Each Microsoft security control contributes 100 points to the score. The total number is reflective of the score potential and calculated by multiplying the number of supported Microsoft security controls (security controls pillars) by the maximum points that each pillar contributes (maximum of 100 points for each pillar). The Office 365 Secure Score looks at your settings and activities and compares them to a baseline established by Microsoft. For more information, see [Introducing the Office 365 Secure Score](https://support.office.com/article/introducing-the-office-365-secure-score-c9e7160f-2c34-4bd0-a548-5ddcc862eaef#howtoaccess). -In the example image, the total points for the Windows security controls and Office 365 add up to 602 points. +In the example image, the total points for the security controls and Office 365 add up to 602 points. -You can set the baselines for calculating the score of Windows Defender security controls on the Secure score dashboard through the **Settings**. For more information, see [Enable Secure score security controls](enable-secure-score.md). +You can set the baselines for calculating the security control scores on the Secure score dashboard through the **Settings**. For more information, see [Enable Secure score security controls](enable-secure-score.md). ## Secure score over time You can track the progression of your organizational security posture over time using this tile. It displays the overall score in a historical trend line enabling you to see how taking the recommended actions increase your overall security posture. @@ -79,11 +79,11 @@ Within the tile, you can click on each control to see the recommended optimizati Clicking the link under the **Misconfigured machines** column opens up the **Machines list** with filters applied to show only the list of machines where the recommendation is applicable. You can export the list in Excel to create a target collection and apply relevant policies using a management solution of your choice. -## Related topic +## Related topic - [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) - [Exposure score](tvm-exposure-score.md) -- [Configuration score](configuration-score.md) +- [Configuration score](configuration-score.md) - [Security recommendations](tvm-security-recommendation.md) - [Remediation](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview.md b/windows/security/threat-protection/microsoft-defender-atp/overview.md index b2d8409667..e649152e6b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md index 89fd91c5ae..8dea2272e6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp diff --git a/windows/security/threat-protection/microsoft-defender-atp/portal-overview.md b/windows/security/threat-protection/microsoft-defender-atp/portal-overview.md index 84cf299759..a9df33b283 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/portal-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/portal-overview.md @@ -24,7 +24,7 @@ ms.topic: conceptual ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) Enterprise security teams can use Microsoft Defender Security Center to monitor and assist in responding to alerts of potential advanced persistent threat (APT) activity or data breaches. diff --git a/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md b/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md index 53cae96485..c11e8a4597 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md +++ b/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md @@ -22,12 +22,14 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->[!Note] +>[!NOTE] > Currently this API is supported only for AppOnly context requests. (See [Get access with application context](exposed-apis-create-app-webapp.md) for more information) - Submits or Updates new [Indicator](ti-indicator.md) entity. +>[!NOTE] +>There is a limit of 5000 indicators per tenant. ## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Get started](apis-intro.md) @@ -116,3 +118,6 @@ Content-type: application/json } ``` + +## Related topic +- [Manage indicators](manage-indicators.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports.md b/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports.md index ea8a219a7d..e5488e3ca6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports.md +++ b/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports.md @@ -28,7 +28,7 @@ ms.topic: article > [!TIP] > Go to **Advanced features** in the **Settings** page to turn on the preview features. > -> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-powerbireports-abovefoldlink) +> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-powerbireports-abovefoldlink) Understand the security status of your organization, including the status of machines, alerts, and investigations using the Microsoft Defender ATP reporting feature that integrates with Power BI. @@ -202,7 +202,7 @@ In general, if you know of a specific threat name, CVE, or KB, you can identify ## Related topic -- [**Beta** Create custom Power BI reports](run-advanced-query-sample-power-bi-app-token.md) +- [Create custom Power BI reports](api-power-bi.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/powershell-example-code.md b/windows/security/threat-protection/microsoft-defender-atp/powershell-example-code.md index f61fc0625f..f6b61b0834 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/powershell-example-code.md +++ b/windows/security/threat-protection/microsoft-defender-atp/powershell-example-code.md @@ -172,7 +172,7 @@ $ioc = -Method Post -Headers $headers -Body ($iocPayload | ConvertTo-Json) ``` ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-psexample-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-psexample-belowfoldlink) ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/preferences-setup.md b/windows/security/threat-protection/microsoft-defender-atp/preferences-setup.md index 8fe6ed0a0c..8254b7e5b3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preferences-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preferences-setup.md @@ -16,12 +16,13 @@ audience: ITPro ms.collection: M365-security-compliance ms.topic: article --- + # Configure Microsoft Defender Security Center settings **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-prefsettings-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-prefsettings-abovefoldlink) Use the **Settings** menu to modify general settings, advanced features, enable the preview experience, email notifications, and the custom threat intelligence feature. @@ -34,4 +35,3 @@ Permissions | Manage portal access using RBAC as well as machine groups. APIs | Enable the threat intel and SIEM integration. Rules | Configure suppressions rules and automation settings. Machine management | Onboard and offboard machines. - diff --git a/windows/security/threat-protection/microsoft-defender-atp/prerelease.md b/windows/security/threat-protection/microsoft-defender-atp/prerelease.md index a5949f146b..01d6034c12 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/prerelease.md +++ b/windows/security/threat-protection/microsoft-defender-atp/prerelease.md @@ -2,7 +2,7 @@ ms.date: 08/28/2017 ms.reviewer: manager: dansimp -ms.author: mjcaparas +ms.author: macapara author: mjcaparas --- diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview-settings.md b/windows/security/threat-protection/microsoft-defender-atp/preview-settings.md index b92d9d416a..148fcc631d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview-settings.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview-settings.md @@ -21,7 +21,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-previewsettings-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-previewsettings-abovefoldlink) Turn on the preview experience setting to be among the first to try upcoming features. diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index a18bcddf2c..5d0cf9a4f2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -42,15 +42,14 @@ Turn on the preview experience setting to be among the first to try upcoming fea ## Preview features The following features are included in the preview release: -- [Evaluation lab](evaluation-lab.md)
                        The Microsoft Defender ATP evaluation lab is designed to eliminate the complexities of machine and environment configuration so that you can - focus on evaluating the capabilities of the platform, running simulations, and seeing the prevention, detection, and remediation features in action. +- [Tamper Protection settings in Intune](../windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md#turn-tamper-protection-on-or-off-for-your-organization-with-intune)
                        You can now turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune). -- [Windows Server 2008 R2 SP1](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints#windows-server-2008-r2-sp1--windows-server-2012-r2-and-windows-server-2016)
                        You can now onboard Windows Server 2008 R2 SP1. +- [Microsoft Threat Experts - Experts on Demand](microsoft-threat-experts.md)
                        You now have the option to consult with Microsoft Threat Experts from several places in the portal to help you in the context of your investigation. + +- [Indicators for IP addresses, URLs/Domains](manage-indicators.md)
                        You can now allow or block URLs/domains using your own threat intelligence. - [Microsoft Defender ATP for Mac](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac)
                        Microsoft Defender ATP for Mac brings the next-generation protection, and endpoint detection and response coverage to Mac devices. Core components of the unified endpoint security platform will now be available for Mac devices. -- [Live response](live-response.md)
                        Get instantaneous access to a machine using a remote shell connection. Do in-depth investigative work and take immediate response actions to promptly contain identified threats – real-time. - - [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
                        A new built-in capability that uses a risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations. - [Machine health and compliance report](machine-reports.md) The machine health and compliance report provides high-level information about the devices in your organization. @@ -71,4 +70,4 @@ Information protection is an integral part of Microsoft 365 Enterprise suite, pr - [Power BI reports using Microsoft Defender ATP data](powerbi-reports.md)
                        Microsoft Defender ATP makes it easy to create a Power BI dashboard by providing an option straight from the portal. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-preview-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-preview-belowfoldlink) diff --git a/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md b/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md index abf6c2fb00..4be1886be4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md @@ -1,7 +1,7 @@ --- -title: Pull Microsoft Defender ATP alerts using REST API -description: Pull alerts from Microsoft Defender ATP REST API. -keywords: alerts, pull alerts, rest api, request, response +title: Pull Microsoft Defender ATP detections using REST API +description: Pull detections from Microsoft Defender ATP REST API. +keywords: detections, pull detections, rest api, request, response search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -17,16 +17,20 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Pull Microsoft Defender ATP alerts using SIEM REST API +# Pull Microsoft Defender ATP detections using SIEM REST API **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-pullalerts-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-pullalerts-abovefoldlink) -Microsoft Defender ATP supports the OAuth 2.0 protocol to pull alerts from the portal. +>[!Note] +>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections +>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Machine and its related Alert details. + +Microsoft Defender ATP supports the OAuth 2.0 protocol to pull detections from the API. In general, the OAuth 2.0 protocol supports four types of flows: - Authorization grant flow @@ -36,19 +40,19 @@ In general, the OAuth 2.0 protocol supports four types of flows: For more information about the OAuth specifications, see the [OAuth Website](http://www.oauth.net). -Microsoft Defender ATP supports the _Authorization grant flow_ and _Client credential flow_ to obtain access to generate alerts from the portal, with Azure Active Directory (AAD) as the authorization server. +Microsoft Defender ATP supports the _Authorization grant flow_ and _Client credential flow_ to obtain access to pull detections, with Azure Active Directory (AAD) as the authorization server. The _Authorization grant flow_ uses user credentials to get an authorization code, which is then used to obtain an access token. The _Client credential flow_ uses client credentials to authenticate against the Microsoft Defender ATP endpoint URL. This flow is suitable for scenarios when an OAuth client creates requests to an API that doesn't require user credentials. -Use the following method in the Microsoft Defender ATP API to pull alerts in JSON format. +Use the following method in the Microsoft Defender ATP API to pull detections in JSON format. >[!NOTE] >Microsoft Defender Security Center merges similar alert detections into a single alert. This API pulls alert detections in its raw form based on the query parameters you set, enabling you to apply your own grouping and filtering. ## Before you begin -- Before calling the Microsoft Defender ATP endpoint to pull alerts, you'll need to enable the SIEM integration application in Azure Active Directory (AAD). For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md). +- Before calling the Microsoft Defender ATP endpoint to pull detections, you'll need to enable the SIEM integration application in Azure Active Directory (AAD). For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md). - Take note of the following values in your Azure application registration. You need these values to configure the OAuth flow in your service or daemon app: - Application ID (unique to your application) @@ -59,7 +63,7 @@ Use the following method in the Microsoft Defender ATP API to pull alerts in JSO ## Get an access token Before creating calls to the endpoint, you'll need to get an access token. -You'll use the access token to access the protected resource, which are alerts in Microsoft Defender ATP. +You'll use the access token to access the protected resource, which are detections in Microsoft Defender ATP. To get an access token, you'll need to do a POST request to the token issuing endpoint. Here is a sample request: @@ -105,23 +109,23 @@ Use optional query parameters to specify and control the amount of data returned Name | Value| Description :---|:---|:--- -DateTime?sinceTimeUtc | string | Defines the lower time bound alerts are retrieved from, based on field:
                        `LastProcessedTimeUtc`
                        The time range will be: from sinceTimeUtc time to current time.

                        **NOTE**: When not specified, all alerts generated in the last two hours are retrieved. -DateTime?untilTimeUtc | string | Defines the upper time bound alerts are retrieved.
                        The time range will be: from `sinceTimeUtc` time to `untilTimeUtc` time.

                        **NOTE**: When not specified, the default value will be the current time. -string ago | string | Pulls alerts in the following time range: from `(current_time - ago)` time to `current_time` time.

                        Value should be set according to **ISO 8601** duration format
                        E.g. `ago=PT10M` will pull alerts received in the last 10 minutes. -int?limit | int | Defines the number of alerts to be retrieved. Most recent alerts will be retrieved based on the number defined.

                        **NOTE**: When not specified, all alerts available in the time range will be retrieved. -machinegroups | String | Specifies machine groups to pull alerts from.

                        **NOTE**: When not specified, alerts from all machine groups will be retrieved.

                        Example:

                        ```https://wdatp-alertexporter-eu.securitycenter.windows.com/api/Alerts/?machinegroups=UKMachines&machinegroups=FranceMachines``` +sinceTimeUtc | DateTime | Defines the lower time bound alerts are retrieved from, based on field:
                        `LastProcessedTimeUtc`
                        The time range will be: from sinceTimeUtc time to current time.

                        **NOTE**: When not specified, all alerts generated in the last two hours are retrieved. +untilTimeUtc | DateTime | Defines the upper time bound alerts are retrieved.
                        The time range will be: from `sinceTimeUtc` time to `untilTimeUtc` time.

                        **NOTE**: When not specified, the default value will be the current time. +ago | string | Pulls alerts in the following time range: from `(current_time - ago)` time to `current_time` time.

                        Value should be set according to **ISO 8601** duration format
                        E.g. `ago=PT10M` will pull alerts received in the last 10 minutes. +limit | int | Defines the number of alerts to be retrieved. Most recent alerts will be retrieved based on the number defined.

                        **NOTE**: When not specified, all alerts available in the time range will be retrieved. +machinegroups | string | Specifies machine groups to pull alerts from.

                        **NOTE**: When not specified, alerts from all machine groups will be retrieved.

                        Example:

                        ```https://wdatp-alertexporter-eu.securitycenter.windows.com/api/Alerts/?machinegroups=UKMachines&machinegroups=FranceMachines``` DeviceCreatedMachineTags | string | Single machine tag from the registry. CloudCreatedMachineTags | string | Machine tags that were created in Microsoft Defender Security Center. ### Request example -The following example demonstrates how to retrieve all the alerts in your organization. +The following example demonstrates how to retrieve all the detections in your organization. ```syntax GET https://wdatp-alertexporter-eu.windows.com/api/alerts Authorization: Bearer ``` -The following example demonstrates a request to get the last 20 alerts since 2016-09-12 00:00:00. +The following example demonstrates a request to get the last 20 detections since 2016-09-12 00:00:00. ```syntax GET https://wdatp-alertexporter-eu.windows.com/api/alerts?limit=20&sinceTimeUtc=2016-09-12T00:00:00.000 @@ -178,14 +182,14 @@ AuthenticationContext context = new AuthenticationContext(string.Format("https:/ ClientCredential clientCredentials = new ClientCredential(clientId, clientSecret); AuthenticationResult authenticationResult = context.AcquireToken(resource, clientCredentials); ``` -### Use token to connect to the alerts endpoint +### Use token to connect to the detections endpoint ``` HttpClient httpClient = new HttpClient(); httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(authenticationResult.AccessTokenType, authenticationResult.AccessToken); HttpResponseMessage response = httpClient.GetAsync("https://wdatp-alertexporter-eu.windows.com/api/alert").GetAwaiter().GetResult(); -string alertsJson = response.Content.ReadAsStringAsync().Result; -Console.WriteLine("Got alert list: {0}", alertsJson); +string detectionsJson = response.Content.ReadAsStringAsync().Result; +Console.WriteLine("Got detections list: {0}", detectionsJson); ``` @@ -203,7 +207,7 @@ HTTP error code | Description ## Related topics - [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) -- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md) -- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md) -- [Microsoft Defender ATP alert API fields](api-portal-mapping.md) +- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) +- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) +- [Microsoft Defender ATP Detection fields](api-portal-mapping.md) - [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/python-example-code.md b/windows/security/threat-protection/microsoft-defender-atp/python-example-code.md index 58a9f19fcf..b43a956f6e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/python-example-code.md +++ b/windows/security/threat-protection/microsoft-defender-atp/python-example-code.md @@ -176,7 +176,7 @@ with requests.Session() as session: ``` ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-pyexample-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-pyexample-belowfoldlink) ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-event-hub.md b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-event-hub.md index 6dfcdb8e95..eb9229c327 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-event-hub.md +++ b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-event-hub.md @@ -23,7 +23,7 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) +Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) ## Before you begin: diff --git a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md index d969ecb9ab..9af5941965 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md +++ b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export-storage.md @@ -23,7 +23,7 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) +Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) ## Before you begin: diff --git a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export.md b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export.md index 3da3cdc512..fa657fb30d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/raw-data-export.md +++ b/windows/security/threat-protection/microsoft-defender-atp/raw-data-export.md @@ -23,7 +23,7 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) +- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink) ## Stream Advanced Hunting events to Event Hubs and/or Azure storage account. diff --git a/windows/security/threat-protection/microsoft-defender-atp/rbac.md b/windows/security/threat-protection/microsoft-defender-atp/rbac.md index 2264afd86c..8fe8e896cd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/rbac.md +++ b/windows/security/threat-protection/microsoft-defender-atp/rbac.md @@ -23,7 +23,7 @@ ms.topic: article - Office 365 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-rbac-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-rbac-abovefoldlink) Using role-based access control (RBAC), you can create roles and groups within your security operations team to grant appropriate access to the portal. Based on the roles and groups you create, you have fine-grained control over what users with access to the portal can see and do. diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md index 230e57d75e..22be565559 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md @@ -25,7 +25,7 @@ ms.topic: article [!include[Prerelease information](prerelease.md)] ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-responddile-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-responddile-abovefoldlink) Quickly respond to detected attacks by stopping and quarantining files or blocking a file. After taking action on files, you can check activity details in the Action center. @@ -36,10 +36,23 @@ Response actions run along the top of the file page, and include: - Stop and Quarantine File - Add Indicator - Download file +- Consult a threat expert - Action center You can also submit files for deep analysis, to run the file in a secure cloud sandbox. When the analysis is complete, you'll get a detailed report that provides information about the behavior of the file. You can submit files for deep analysis and read past reports by selecting the **Deep analysis** tab. It's located below the file information cards. +Some actions require certain permissions. The following table describes what action certain permissions can take on portable executable (PE) and non-PE files: + +Permission | PE files | Non-PE files +:---|:---|:--- +View data | X | X +Alerts investigation | ☑ | X +Live response basic | X | X +Live response advanced | ☑ |☑ + +For more information on roles, see [Create and manage roles for role-based access control](user-roles.md). + + ## Stop and quarantine files in your network You can contain an attack in your organization by stopping the malicious process and quarantining the file where it was observed. @@ -63,7 +76,7 @@ This action takes effect on machines with Windows 10, version 1703 or later, whe 1. Select the file you want to stop and quarantine. You can select a file from any of the following views or use the Search box: - **Alerts** - click the corresponding links from the Description or Details in the Artifact timeline - - **Search box** - select File from the drop–down menu and enter the file name + - **Search box** - select **File** from the drop–down menu and enter the file name 2. Go to the top bar and select **Stop and Quarantine File**. @@ -98,7 +111,7 @@ You can roll back and remove a file from quarantine if you’ve determined that 1. Open an elevated command–line prompt on the machine: - a. Go to **Start** and type cmd. + a. Go to **Start** and type _cmd_. b. Right–click **Command prompt** and select **Run as administrator**. @@ -157,6 +170,26 @@ When you select this action, a fly-out will appear. From the fly-out, you can re If a file is not already stored by Microsoft Defender ATP, you cannot download it. Instead, you will see a **Collect file** button in the same location. If a file has not been seen in the organization in the past 30 days, **Collect file** will be disabled. +## Consult a threat expert + +You can consult a Microsoft threat expert for more insights regarding a potentially compromised machine or already compromised ones. Microsoft Threat Experts can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights not just regarding a potentially compromised machine, but also to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, or a threat intelligence context that you see on your portal dashboard. + +See [Consult a Microsoft Threat Expert](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts#consult-a-microsoft-threat-expert-about-suspicious-cybersecurity-activities-in-your-organization) for details. + +## Check activity details in Action center + +The **Action center** provides information on actions that were taken on a machine or file. You’ll be able to view the following details: + +- Investigation package collection +- Antivirus scan +- App restriction +- Machine isolation + +All other related details are also shown, for example, submission date/time, submitting user, and if the action succeeded or failed. + +![Image of action center with information](images/action-center-details.png) + + ## Deep analysis Cyber security investigations are typically triggered by an alert. Alerts are related to one or more observed files that are often new or unknown. Clicking a file takes you to the file view where you can see the file's metadata. To enrich the data related to the file, you can submit the file for deep analysis. diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md index 5bb659b44e..60e3dbd5ac 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts.md @@ -22,7 +22,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-respondmachine-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-respondmachine-abovefoldlink) Quickly respond to detected attacks by isolating machines or collecting an investigation package. After taking action on machines, you can check activity details on the Action center. @@ -35,6 +35,7 @@ Response actions run along the top of a specific machine page and include: - Run antivirus scan - Restrict app execution - Isolate machine +- Consult a threat expert - Action center ![Image of response actions](images/response-actions.png) @@ -96,7 +97,7 @@ The package contains the following folders: |:---|:---------| |Autoruns | Contains a set of files that each represent the content of the registry of a known auto start entry point (ASEP) to help identify attacker’s persistency on the machine.

                        NOTE: If the registry key is not found, the file will contain the following message: “ERROR: The system was unable to find the specified registry key or value.” | |Installed programs | This .CSV file contains the list of installed programs that can help identify what is currently installed on the machine. For more information, see [Win32_Product class](https://go.microsoft.com/fwlink/?linkid=841509). | -|Network connections | This folder contains a set of data points related to the connectivity information which can help in identifying connectivity to suspicious URLs, attacker’s command and control (C&C) infrastructure, any lateral movement, or remote connections.

                        - ActiveNetConnections.txt – Displays protocol statistics and current TCP/IP network connections. Provides the ability to look for suspicious connectivity made by a process.

                        - Arp.txt – Displays the current address resolution protocol (ARP) cache tables for all interfaces.

                        ARP cache can reveal additional hosts on a network that have been compromised or suspicious systems on the network that night have been used to run an internal attack.

                        - DnsCache.txt - Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. This can help in identifying suspicious connections.

                        - IpConfig.txt – Displays the full TCP/IP configuration for all adapters. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections.

                        - FirewassExecutionLog.txt and pfirewall.log | +|Network connections | This folder contains a set of data points related to the connectivity information which can help in identifying connectivity to suspicious URLs, attacker’s command and control (C&C) infrastructure, any lateral movement, or remote connections.

                        - ActiveNetConnections.txt – Displays protocol statistics and current TCP/IP network connections. Provides the ability to look for suspicious connectivity made by a process.

                        - Arp.txt – Displays the current address resolution protocol (ARP) cache tables for all interfaces.

                        ARP cache can reveal additional hosts on a network that have been compromised or suspicious systems on the network that night have been used to run an internal attack.

                        - DnsCache.txt - Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. This can help in identifying suspicious connections.

                        - IpConfig.txt – Displays the full TCP/IP configuration for all adapters. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections.

                        - FirewassExecutionLog.txt and pfirewall.log | | Prefetch files| Windows Prefetch files are designed to speed up the application startup process. It can be used to track all the files recently used in the system and find traces for applications that might have been deleted but can still be found in the prefetch file list.

                        - Prefetch folder – Contains a copy of the prefetch files from `%SystemRoot%\Prefetch`. NOTE: It is suggested to download a prefetch file viewer to view the prefetch files.

                        - PrefetchFilesList.txt – Contains the list of all the copied files which can be used to track if there were any copy failures to the prefetch folder. | | Processes| Contains a .CSV file listing the running processes which provides the ability to identify current processes running on the machine. This can be useful when identifying a suspicious process and its state. | | Scheduled tasks| Contains a .CSV file listing the scheduled tasks which can be used to identify routines performed automatically on a chosen machine to look for suspicious code which was set to run automatically. | @@ -173,6 +174,13 @@ When a machine is being isolated, the following notification is displayed to inf ![Image of no network connection](images/atp-notification-isolate.png) +## Consult a threat expert + +You can consult a Microsoft threat expert for more insights regarding a potentially compromised machine or already compromised ones. Microsoft Threat Experts can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights not just regarding a potentially compromised machine, but also to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, or a threat intelligence context that you see on your portal dashboard. + +See [Consult a Microsoft Threat Expert](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts#consult-a-microsoft-threat-expert-about-suspicious-cybersecurity-activities-in-your-organization) for details. + + ## Check activity details in Action center The **Action center** provides information on actions that were taken on a machine or file. You’ll be able to view the following details: @@ -188,3 +196,4 @@ All other related details are also shown, for example, submission date/time, sub ## Related topic - [Take response actions on a file](respond-file-alerts.md) +- [Report inaccuracy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy) diff --git a/windows/security/threat-protection/microsoft-defender-atp/response-actions.md b/windows/security/threat-protection/microsoft-defender-atp/response-actions.md deleted file mode 100644 index 36b3d69003..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/response-actions.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Take response actions on files and machines in Microsoft Defender ATP -description: Take response actions on files and machines by stopping and quarantining files, blocking a file, isolating machines, or collecting an investigation package. -keywords: respond, stop and quarantine, block file, deep analysis, isolate machine, collect investigation package, action center -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Take response actions in Microsoft Defender ATP - -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - - - - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-responseactions-abovefoldlink) - -You can take response actions on machines and files to quickly respond to detected attacks so that you can contain or reduce and prevent further damage caused by malicious attackers in your organization. - ->[!NOTE] -> The machine related response actions are only available for machines on Windows 10 (version 1703 or higher), Windows Server, version 1803 and Windows Server 2019. - -## In this section -Topic | Description -:---|:--- -[Take response actions on a machine](respond-machine-alerts.md)| Isolate machines or collect an investigation package. -[Take response actions on a file](respond-file-alerts.md)| Stop and quarantine files or block a file from your network. diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md index eba85f1a0f..457a33f85a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -147,4 +147,3 @@ If the 'roles' section in the token does not include the necessary permission: - [Microsoft Defender ATP APIs](apis-intro.md) - [Advanced Hunting from Portal](advanced-hunting.md) - [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) -- [Schedule Advanced Hunting](run-advanced-query-sample-ms-flow.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-ms-flow.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-ms-flow.md deleted file mode 100644 index 409f485d23..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-ms-flow.md +++ /dev/null @@ -1,92 +0,0 @@ ---- -title: Advanced Hunting API -ms.reviewer: -description: Use this API to run advanced queries -keywords: apis, supported apis, advanced hunting, query -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: mjcaparas -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Schedule Advanced Hunting using Microsoft Flow -**Applies to:** -- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) - -[!include[Prerelease information](prerelease.md)] - -Schedule advanced query. - -## Before you begin -You first need to [create an app](apis-intro.md). - -## Use case - -A common scenario is scheduling an advanced query and using the results for follow up actions and processing. -In this section we share sample for this purpose using [Microsoft Flow](https://flow.microsoft.com/) (or [Logic Apps](https://azure.microsoft.com/services/logic-apps/)). - -## Define a flow to run query and parse results - -Use the following basic flow as an example. - -1. Define the trigger – Recurrence by time. - -2. Add an action: Select HTTP. - - ![Image of MsFlow choose an action](images/ms-flow-choose-action.png) - - - Set method to be POST - - Uri is https://api.securitycenter.windows.com/api/advancedqueries/run or one of the region specific locations - - US: https://api-us.securitycenter.windows.com/api/advancedqueries/run - - Europe: https://api-eu.securitycenter.windows.com/api/advancedqueries/run - - United Kingdom: https://api-uk.securitycenter.windows.com/api/advancedqueries/run - - Add the Header: Content-Type application/json - - In the body write your query surrounded by single quotation mark (') - - In the Advanced options select Authentication to be Active Directory OAuth - - Set the Tenant with proper AAD Tenant Id - - Audience is https://api.securitycenter.windows.com - - Client ID is your application ID - - Credential Type should be Secret - - Secret is the application secret generated in the Azure Active directory. - - ![Image of MsFlow define action](images/ms-flow-define-action.png) - -3. You can use the "Parse JSON" action to get the schema of data – just "use sample payload to generate schema" and copy an output from of the expected result. - - ![Image of MsFlow parse json](images/ms-flow-parse-json.png) - -## Expand the flow to use the query results - -The following section shows how to use the parsed results to insert them in SQL database. - -This is an example only, you can use other actions supported by Microsoft Flow. - -- Add an 'Apply to each' action -- Select the Results json (which was an output of the last parse action) -- Add an 'Insert row' action – you will need to supply the connection details -- Select the table you want to update and define the mapping between the WD-ATP output to the SQL. Note it is possible to manipulate the data inside the flow. In the example I changed the type of the EventTime. - -![Image of insert into DB](images/ms-flow-insert-db.png) - -The output in the SQL DB is getting updates and can be used for correlation with other data sources. You can now read from your table: - -![Image of select from DB](images/ms-flow-read-db.png) - -## Full flow definition - -You can find below the full definition - -![Image of E2E flow](images/ms-flow-e2e.png) - -## Related topic -- [Microsoft Defender ATP APIs](apis-intro.md) -- [Advanced Hunting API](run-advanced-query-api.md) -- [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-app-token.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-app-token.md deleted file mode 100644 index 65e723e229..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-app-token.md +++ /dev/null @@ -1,138 +0,0 @@ ---- -title: Advanced Hunting API -ms.reviewer: -description: Use this API to run advanced queries -keywords: apis, supported apis, advanced hunting, query -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: mjcaparas -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Create custom reports using Power BI (app authentication) - -Run advanced queries and show results in Microsoft Power BI. Please read about [Advanced Hunting API](run-advanced-query-api.md) before. - -In this section we share Power BI query sample to run a query using **application token**. - -If you want to use **user token** instead please refer to [this](run-advanced-query-sample-power-bi-user-token.md) tutorial. - ->**Prerequisite**: You first need to [create an app](exposed-apis-create-app-webapp.md). - -## Run a query - -- Open Microsoft Power BI - -- Click **Get Data** > **Blank Query** - - ![Image of create blank query](images/power-bi-create-blank-query.png) - -- Click **Advanced Editor** - - ![Image of open advanced editor](images/power-bi-open-advanced-editor.png) - -- Copy the below and paste it in the editor, after you update the values of TenantId, AppId, AppSecret, Query - - ``` - let - - TenantId = "00000000-0000-0000-0000-000000000000", // Paste your own tenant ID here - AppId = "11111111-1111-1111-1111-111111111111", // Paste your own app ID here - AppSecret = "22222222-2222-2222-2222-222222222222", // Paste your own app secret here - Query = "MachineInfo | where EventTime > ago(7d) | summarize EventCount=count(), LastSeen=max(EventTime) by MachineId", // Paste your own query here - - ResourceAppIdUrl = "https://api.securitycenter.windows.com", - OAuthUrl = Text.Combine({"https://login.windows.net/", TenantId, "/oauth2/token"}, ""), - - Resource = Text.Combine({"resource", Uri.EscapeDataString(ResourceAppIdUrl)}, "="), - ClientId = Text.Combine({"client_id", AppId}, "="), - ClientSecret = Text.Combine({"client_secret", Uri.EscapeDataString(AppSecret)}, "="), - GrantType = Text.Combine({"grant_type", "client_credentials"}, "="), - - Body = Text.Combine({Resource, ClientId, ClientSecret, GrantType}, "&"), - - AuthResponse= Json.Document(Web.Contents(OAuthUrl, [Content=Text.ToBinary(Body)])), - AccessToken= AuthResponse[access_token], - Bearer = Text.Combine({"Bearer", AccessToken}, " "), - - AdvancedHuntingUrl = "https://api.securitycenter.windows.com/api/advancedqueries/run", - - Response = Json.Document(Web.Contents( - AdvancedHuntingUrl, - [ - Headers = [#"Content-Type"="application/json", #"Accept"="application/json", #"Authorization"=Bearer], - Content=Json.FromValue([#"Query"=Query]) - ] - )), - - TypeMap = #table( - { "Type", "PowerBiType" }, - { - { "Double", Double.Type }, - { "Int64", Int64.Type }, - { "Int32", Int32.Type }, - { "Int16", Int16.Type }, - { "UInt64", Number.Type }, - { "UInt32", Number.Type }, - { "UInt16", Number.Type }, - { "Byte", Byte.Type }, - { "Single", Single.Type }, - { "Decimal", Decimal.Type }, - { "TimeSpan", Duration.Type }, - { "DateTime", DateTimeZone.Type }, - { "String", Text.Type }, - { "Boolean", Logical.Type }, - { "SByte", Logical.Type }, - { "Guid", Text.Type } - }), - - Schema = Table.FromRecords(Response[Schema]), - TypedSchema = Table.Join(Table.SelectColumns(Schema, {"Name", "Type"}), {"Type"}, TypeMap , {"Type"}), - Results = Response[Results], - Rows = Table.FromRecords(Results, Schema[Name]), - Table = Table.TransformColumnTypes(Rows, Table.ToList(TypedSchema, (c) => {c{0}, c{2}})) - - in Table - - ``` - -- Click **Done** - - ![Image of create advanced query](images/power-bi-create-advanced-query.png) - -- Click **Edit Credentials** - - ![Image of edit credentials](images/power-bi-edit-credentials.png) - -- Select **Anonymous** and click **Connect** - - ![Image of set credentials](images/power-bi-set-credentials-anonymous.png) - -- Repeat the previous step for the second URL - -- Click **Continue** - - ![Image of edit data privacy](images/power-bi-edit-data-privacy.png) - -- Select the privacy level you want and click **Save** - - ![Image of set data privacy](images/power-bi-set-data-privacy.png) - -- View the results of your query - - ![Image of query results](images/power-bi-query-results.png) - -## Related topic -- [Create custom Power BI reports with user authentication](run-advanced-query-sample-power-bi-user-token.md) -- [Microsoft Defender ATP APIs](apis-intro.md) -- [Advanced Hunting API](run-advanced-query-api.md) -- [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) -- [Schedule Advanced Hunting](run-advanced-query-sample-ms-flow.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md index bd86e1319d..a5c71022b4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -117,4 +117,3 @@ $results | ConvertTo-Json | Set-Content file1.json - [Microsoft Defender ATP APIs](apis-intro.md) - [Advanced Hunting API](run-advanced-query-api.md) - [Advanced Hunting using Python](run-advanced-query-sample-python.md) -- [Schedule Advanced Hunting](run-advanced-query-sample-ms-flow.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md index bcceb8902e..69056ed0d0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md @@ -8,7 +8,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -146,5 +146,4 @@ outputFile.close() ## Related topic - [Microsoft Defender ATP APIs](apis-intro.md) - [Advanced Hunting API](run-advanced-query-api.md) -- [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) -- [Schedule Advanced Hunting](run-advanced-query-sample-ms-flow.md) +- [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-detection-test.md b/windows/security/threat-protection/microsoft-defender-atp/run-detection-test.md index d9a36f6795..2251ec4e49 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-detection-test.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-detection-test.md @@ -17,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Run a detection test on a newly onboarded Microsoft Defender ATP machine +# Run a detection test on a newly onboarded Microsoft Defender ATP machine **Applies to:** - Supported Windows 10 versions diff --git a/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard.md b/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard.md index b0ae432a26..75423bc86d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard.md @@ -18,109 +18,118 @@ ms.topic: conceptual --- # Configure the security controls in Secure score -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->[!NOTE] -> Secure score is now part of [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) as [Configuration score](configuration-score.md). The secure score page will be available for a few weeks. View the [Secure score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score) page. +**Applies to:** + +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +> [!NOTE] +> Secure score is now part of [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) as [Configuration score](configuration-score.md). The secure score page will be available for a few weeks. View the [Secure score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score) page. Each security control lists recommendations that you can take to increase the security posture of your organization. ### Endpoint detection and response (EDR) optimization -A well-configured machine complies to a minimum baseline configuration setting. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for your Endpoint detection and response tool. ->[!IMPORTANT] ->This feature is available for machines on Windows 10, version 1607 or later. +A well-configured machine complies to the minimum baseline configuration setting. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for your Endpoint detection and response tool. -#### Minimum baseline configuration setting for EDR: -- Microsoft Defender ATP sensor is on -- Data collection is working correctly -- Communication to Microsoft Defender ATP service is not impaired +> [!IMPORTANT] +> This feature is available for machines on Windows 10, version 1607 or later. + +#### Minimum baseline configuration setting for EDR + +* Microsoft Defender ATP sensor is on +* Data collection is working correctly +* Communication to Microsoft Defender ATP service is not impaired + +##### Recommended actions -##### Recommended actions: You can take the following actions to increase the overall security score of your organization: -- Turn on sensor -- Fix sensor data collection -- Fix impaired communications -For more information, see [Fix unhealthy sensors](fix-unhealthy-sensors.md). +* Turn on sensor +* Fix sensor data collection +* Fix impaired communications -### Microsoft Defender Antivirus (Microsoft Defender AV) optimization -A well-configured machine complies to a minimum baseline configuration setting. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for Microsoft Defender AV. +For more information, see [Fix unhealthy sensors](fix-unhealthy-sensors.md). ->[!IMPORTANT] ->This feature is available for machines on Windows 10, version 1607 or later. +### Windows Defender Antivirus (Windows Defender AV) optimization +A well-configured machine complies to the minimum baseline configuration setting. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for Windows Defender AV. -#### Minimum baseline configuration setting for Microsoft Defender AV: -Machines are considered "well configured" for Microsoft Defender AV if the following requirements are met: +> [!IMPORTANT] +> This feature is available for machines on Windows 10, version 1607 or later. -- Microsoft Defender AV is reporting correctly -- Microsoft Defender AV is turned on +#### Minimum baseline configuration setting for Windows Defender AV: +A well-configured machine for Windows Defender AV meets the following requirements: + +- Windows Defender AV is reporting correctly +- Windows Defender AV is turned on - Security intelligence is up-to-date - Real-time protection is on - Potentially Unwanted Application (PUA) protection is enabled -##### Recommended actions: You can take the following actions to increase the overall security score of your organization: >[!NOTE] -> For the Microsoft Defender Antivirus properties to show, you'll need to ensure that the Microsoft Defender Antivirus Cloud-based protection is properly configured on the machine. +> For the Windows Defender Antivirus properties to show, you'll need to ensure that the Windows Defender Antivirus Cloud-based protection is properly configured on the machine. - Fix antivirus reporting - - This recommendation is displayed when the Microsoft Defender Antivirus is not properly configured to report its health state. For more information on fixing the reporting, see [Configure and validate network connections](../windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md). + - This recommendation is displayed when the Windows Defender Antivirus is not properly configured to report its health state. For more information on fixing the reporting, see [Configure and validate network connections](../windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md). - Turn on antivirus - Update antivirus Security intelligence - Turn on real-time protection - Turn on PUA protection -For more information, see [Configure Microsoft Defender Antivirus](../windows-defender-antivirus/configure-windows-defender-antivirus-features.md). - +For more information, see [Configure Windows Defender Antivirus](../windows-defender-antivirus/configure-windows-defender-antivirus-features.md). ### OS security updates optimization + This tile shows you the number of machines that require the latest security updates. It also shows machines that are running on the latest Windows Insider preview build and serves as a reminder to ensure that users should run the latest builds. - ->[!IMPORTANT] ->This feature is available for machines on Windows 10, version 1607 or later. + +> [!IMPORTANT] +> This feature is available for machines on Windows 10, version 1607 or later. You can take the following actions to increase the overall security score of your organization: -- Install the latest security updates -- Fix sensor data collection - - The Microsoft Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. It's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealthy-sensors.md). + +* Install the latest security updates +* Fix sensor data collection + * The Microsoft Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. It's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealthy-sensors.md). For more information, see [Windows Update Troubleshooter](https://support.microsoft.com/help/4027322/windows-windows-update-troubleshooter). +### Windows Defender Exploit Guard (Windows Defender EG) optimization + -### Microsoft Defender Exploit Guard (Microsoft Defender EG) optimization -A well-configured machine complies to a minimum baseline configuration setting. This tile shows you a list of actions to apply on machines to meet the minimum baseline configuration setting for Microsoft Defender EG. When endpoints are configured according to the baseline the Microsoft Defender EG events shows on the Microsoft Defender ATP Machine timeline. +A well-configured machine complies to the minimum baseline configuration setting. This tile shows you a list of actions to apply on machines to meet the minimum baseline configuration setting for Microsoft Defender EG. When endpoints are configured according to the baseline the Microsoft Defender EG events shows on the Microsoft Defender ATP Machine timeline. +> [!IMPORTANT] +> This security control is only applicable for machines with Windows 10, version 1709 or later. ->[!IMPORTANT] ->This security control is only applicable for machines with Windows 10, version 1709 or later. +#### Minimum baseline configuration setting for Windows Defender EG -#### Minimum baseline configuration setting for Microsoft Defender EG: Machines are considered "well configured" for Microsoft Defender EG if the following requirements are met: -- System level protection settings are configured correctly -- Attack Surface Reduction rules are configured correctly -- Controlled Folder Access setting is configured correctly +* System level protection settings are configured correctly +* Attack Surface Reduction rules are configured correctly +* Controlled Folder Access setting is configured correctly + +##### System level protection -##### System level protection: The following system level configuration settings must be set to **On or Force On**: -1. Control Flow Guard +1. Control Flow Guard 2. Data Execution Prevention (DEP) 3. Randomize memory allocations (Bottom-up ASLR) 4. Validate exception chains (SEHOP) 5. Validate heap integrity ->[!NOTE] ->The setting **Force randomization for images (Mandatory ASLR)** is currently excluded from the baseline. ->Consider configuring **Force randomization for images (Mandatory ASLR)** to **On or Force On** for better protection. +> [!NOTE] +> The setting **Force randomization for images (Mandatory ASLR)** is currently excluded from the baseline. +> Consider configuring **Force randomization for images (Mandatory ASLR)** to **On or Force On** for better protection. + +##### Attack Surface Reduction (ASR) rules -##### Attack Surface Reduction (ASR) rules: The following ASR rules must be configured to **Block mode**: -Rule description | GUIDs +Rule description | GUIDs -|- Block executable content from email client and webmail | BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 Block Office applications from creating child processes | D4F940AB-401B-4EFC-AADC-AD5F3C50688A @@ -129,172 +138,179 @@ Impede JavaScript and VBScript to launch executables | D3E037E1-3EB8-44C8-A917-5 Block execution of potentially obfuscated scripts | 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC Block Win32 imports from Macro code in Office | 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B - - ->[!NOTE] ->The setting **Block Office applications from injecting into other processes** with GUID 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 is excluded from the baseline. ->Consider enabling this rule in **Audit** or **Block mode** for better protection. - +> [!NOTE] +> The setting **Block Office applications from injecting into other processes** with GUID 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 is excluded from the baseline. +> Consider enabling this rule in **Audit** or **Block mode** for better protection. ##### Controlled Folder Access + The Controlled Folder Access setting must be configured to **Audit mode** or **Enabled**. ->[!NOTE] +> [!NOTE] > Audit mode, allows you to see audit events in the Microsoft Defender ATP Machine timeline however it does not block suspicious applications. ->Consider enabling Controlled Folder Access for better protection. +> Consider enabling Controlled Folder Access for better protection. + +##### Recommended actions -##### Recommended actions: You can take the following actions to increase the overall security score of your organization: + - Turn on all system-level Exploit Protection settings - Set all ASR rules to enabled or audit mode - Turn on Controlled Folder Access -- Turn on Microsoft Defender Antivirus on compatible machines +- Turn on Windows Defender Antivirus on compatible machines -For more information, see [Microsoft Defender Exploit Guard](../windows-defender-exploit-guard/windows-defender-exploit-guard.md). +### Windows Defender Application Guard (Windows Defender AG) optimization +A well-configured machine complies to the minimum baseline configuration setting. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for Windows Defender AG. When endpoints are configured according to the baseline, Windows Defender AG events shows on the Microsoft Defender ATP Machine timeline. -### Microsoft Defender Application Guard (Microsoft Defender AG) optimization -A well-configured machine complies to a minimum baseline configuration setting. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for Microsoft Defender AG. When endpoints are configured according to the baseline, Microsoft Defender AG events shows on the Microsoft Defender ATP Machine timeline. +A well-configured machine complies to a minimum baseline configuration setting. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for Microsoft Defender AG. When endpoints are configured according to the baseline, Microsoft Defender AG events shows on the Microsoft Defender ATP Machine timeline. ->[!IMPORTANT] ->This security control is only applicable for machines with Windows 10, version 1709 or later. +> [!IMPORTANT] +> This security control is only applicable for machines with Windows 10, version 1709 or later. -#### Minimum baseline configuration setting for Microsoft Defender AG: -Machines are considered "well configured" for Microsoft Defender AG if the following requirements are met: +#### Minimum baseline configuration setting for Windows Defender AG: +A well-configured machine for Windows Defender AG meets the following requirements: - Hardware and software prerequisites are met -- Microsoft Defender AG is turned on compatible machines +- Windows Defender AG is turned on compatible machines - Managed mode is turned on -##### Recommended actions: You can take the following actions to increase the overall security score of your organization: -- Ensure hardware and software prerequisites are met - - >[!NOTE] - >This improvement item does not contribute to the security score in itself because it's not a prerequisite for Microsoft Defender AG. It gives an indication of a potential reason why Microsoft Defender AG is not turned on. -- Turn on Microsoft Defender AG on compatible machines -- Turn on managed mode +* Ensure hardware and software prerequisites are met + + > [!NOTE] + > This improvement item does not contribute to the security score in itself because it's not a prerequisite for Microsoft Defender AG. It gives an indication of a potential reason why Microsoft Defender AG is not turned on. + +* Turn on Microsoft Defender AG on compatible machines +* Turn on managed mode For more information, see [Microsoft Defender Application Guard overview](../windows-defender-application-guard/wd-app-guard-overview.md). +### Windows Defender SmartScreen optimization -### Microsoft Defender SmartScreen optimization A well-configured machine complies to a minimum baseline configuration setting. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for Microsoft Defender SmartScreen. ->[!WARNING] +> [!WARNING] > Data collected by Microsoft Defender SmartScreen might be stored and processed outside of the storage location you have selected for your Microsoft Defender ATP data. +> [!IMPORTANT] +> This security control is only applicable for machines with Windows 10, version 1709 or later. ->[!IMPORTANT] ->This security control is only applicable for machines with Windows 10, version 1709 or later. +#### Minimum baseline configuration setting for Windows Defender SmartScreen: -#### Minimum baseline configuration setting for Microsoft Defender SmartScreen: The following settings must be configured with the following settings: -- Check apps and files: **Warn** or **Block** -- SmartScreen for Microsoft Edge: **Warn** or **Block** -- SmartScreen for Microsoft store apps: **Warn** or **Off** +* Check apps and files: **Warn** or **Block** +* SmartScreen for Microsoft Edge: **Warn** or **Block** +* SmartScreen for Microsoft store apps: **Warn** or **Off** You can take the following actions to increase the overall security score of your organization: + - Set **Check app and files** to **Warn** or **Block** - Set **SmartScreen for Microsoft Edge** to **Warn** or **Block** - Set **SmartScreen for Microsoft store apps** to **Warn** or **Off** +For more information, see [Windows Defender SmartScreen](../windows-defender-smartscreen/windows-defender-smartscreen-overview.md). + +* Set **Check app and files** to **Warn** or **Block** +* Set **SmartScreen for Microsoft Edge** to **Warn** or **Block** +* Set **SmartScreen for Microsoft store apps** to **Warn** or **Off** + For more information, see [Microsoft Defender SmartScreen](../windows-defender-smartscreen/windows-defender-smartscreen-overview.md). +### Windows Defender Firewall optimization +A well-configured machine must have Microsoft Defender Firewall turned on and enabled for all profiles so that inbound connections are blocked by default. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for Microsoft Defender Firewall. -### Microsoft Defender Firewall optimization -A well-configured machine must have Microsoft Defender Firewall turned on and enabled for all profiles so that inbound connections are blocked by default. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for Microsoft Defender Firewall. +> [!IMPORTANT] +> This security control is only applicable for machines with Windows 10, version 1709 or later. ->[!IMPORTANT] ->This security control is only applicable for machines with Windows 10, version 1709 or later. +#### Minimum baseline configuration setting for Windows Defender Firewall -#### Minimum baseline configuration setting for Microsoft Defender Firewall +* Microsoft Defender Firewall is turned on for all network connections +* Secure domain profile by enabling Microsoft Defender Firewall and ensure that Inbound connections are set to Blocked +* Secure private profile by enabling Microsoft Defender Firewall and ensure that Inbound connections are set to Blocked +* Secure public profile is configured by enabling Microsoft Defender Firewall and ensure that Inbound connections are set to Blocked -- Microsoft Defender Firewall is turned on for all network connections -- Secure domain profile by enabling Microsoft Defender Firewall and ensure that Inbound connections are set to Blocked -- Secure private profile by enabling Microsoft Defender Firewall and ensure that Inbound connections are set to Blocked -- Secure public profile is configured by enabling Microsoft Defender Firewall and ensure that Inbound connections are set to Blocked +For more information on Windows Defender Firewall settings, see [Planning settings for a basic firewall policy](https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy). -For more information on Microsoft Defender Firewall settings, see [Planning settings for a basic firewall policy](https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy). +> [!NOTE] +> If Windows Defender Firewall is not your primary firewall, consider excluding it from the security score calculations and make sure that your third-party firewall is configured in a securely. ->[!NOTE] -> If Microsoft Defender Firewall is not your primary firewall, consider excluding it from the security score calculations and make sure that your third-party firewall is configured in a securely. +##### Recommended actions - -##### Recommended actions: You can take the following actions to increase the overall security score of your organization: -- Turn on firewall -- Secure domain profile -- Secure private profile -- Secure public profile -- Verify secure configuration of third-party firewall -- Fix sensor data collection - - The Microsoft Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. It's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealthy-sensors.md). -For more information, see [Microsoft Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security). +* Turn on firewall +* Secure domain profile +* Secure private profile +* Secure public profile +* Verify secure configuration of third-party firewall +* Fix sensor data collection + * The Microsoft Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. It's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealthy-sensors.md). + +For more information, see [Windows Defender Firewall with Advanced Security](https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security). ### BitLocker optimization -A well-configured machine complies to the minimum baseline configuration setting. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for BitLocker. ->[!IMPORTANT] ->This security control is only applicable for machines with Windows 10, version 1803 or later. +A well-configured machine complies to the minimum baseline configuration setting. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for BitLocker. + +> [!IMPORTANT] +> This security control is only applicable for machines with Windows 10, version 1803 or later. #### Minimum baseline configuration setting for BitLocker -- Ensure all supported drives are encrypted -- Ensure that all suspended protection on drives resume protection -- Ensure that drives are compatible +* Ensure all supported drives are encrypted +* Ensure that all suspended protection on drives resume protection +* Ensure that drives are compatible + +##### Recommended actions -##### Recommended actions: You can take the following actions to increase the overall security score of your organization: -- Encrypt all supported drives -- Resume protection on all drives -- Ensure drive compatibility -- Fix sensor data collection - - The Microsoft Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. It's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealthy-sensors.md). + +* Encrypt all supported drives +* Resume protection on all drives +* Ensure drive compatibility +* Fix sensor data collection + * The Microsoft Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. It's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealthy-sensors.md). For more information, see [Bitlocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview). -### Microsoft Defender Credential Guard optimization -A well-configured machine complies to the minimum baseline configuration setting. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for Microsoft Defender Credential Guard. +### Windows Defender Credential Guard optimization +A well-configured machine complies to the minimum baseline configuration setting. This tile shows you a list of actions to apply on endpoints to meet the minimum baseline configuration setting for Windows Defender Credential Guard. ->[!IMPORTANT] ->This security control is only applicable for machines with Windows 10, version 1709 or later. +> [!IMPORTANT] +> This security control is only applicable for machines with Windows 10, version 1709 or later. -#### Minimum baseline configuration setting for Microsoft Defender Credential Guard: -Well-configured machines for Microsoft Defender Credential Guard meets the following requirements: +#### Minimum baseline configuration setting for Windows Defender Credential Guard: +Well-configured machines for Windows Defender Credential Guard meets the following requirements: - Hardware and software prerequisites are met -- Microsoft Defender Credential Guard is turned on compatible machines +- Windows Defender Credential Guard is turned on compatible machines +##### Recommended actions -##### Recommended actions: You can take the following actions to increase the overall security score of your organization: -- Ensure hardware and software prerequisites are met -- Turn on Credential Guard -- Fix sensor data collection - - The Microsoft Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. It's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealthy-sensors.md). +* Ensure hardware and software prerequisites are met +* Turn on Credential Guard +* Fix sensor data collection + * The Microsoft Defender ATP service relies on sensor data collection to determine the security state of a machine. The service will not be able to determine the security state of machines that are not reporting sensor data properly. It's important to ensure that sensor data collection is working properly. For more information, see [Fix unhealthy sensors](fix-unhealthy-sensors.md). -For more information, see [Manage Microsoft Defender Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage). +For more information, see [Manage Windows Defender Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage). ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-sadashboard-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-sadashboard-belowfoldlink) ## Related topics -- [Overview of Secure score](overview-secure-score.md) -- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) -- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) -- [Configuration score](configuration-score.md) -- [Security recommendations](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) - - - +* [Overview of Secure score](overview-secure-score.md) +* [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) +* [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) +* [Exposure score](tvm-exposure-score.md) +* [Configuration score](configuration-score.md) +* [Security recommendations](tvm-security-recommendation.md) +* [Remediation](tvm-remediation.md) +* [Software inventory](tvm-software-inventory.md) +* [Weaknesses](tvm-weaknesses.md) +* [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard.md b/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard.md index f7c9eff384..498aa87ab1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard.md +++ b/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard.md @@ -22,7 +22,7 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-secopsdashboard-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-secopsdashboard-abovefoldlink) The **Security operations dashboard** is where the endpoint detection and response capabilities are surfaced. It provides a high level overview of where detections were seen and highlights where response actions are needed. @@ -75,7 +75,7 @@ The **Sensor health** tile provides information on the individual machine’s ab ![Sensor health tile](images/atp-tile-sensor-health.png) There are two status indicators that provide information on the number of machines that are not reporting properly to the service: -- **Misconfigured** – These machines might partially be reporting sensor data to the Microsoft Defender ATP service and might have configuration errors that need to be corrected. +- **Misconfigured** – These machines might partially be reporting sensor data to the Microsoft Defender ATP service and might have configuration errors that need to be corrected. - **Inactive** - Machines that have stopped reporting to the Microsoft Defender ATP service for more than seven days in the past month. @@ -116,7 +116,7 @@ The tile shows you a list of user accounts with the most active alerts and the n Click the user account to see details about the user account. For more information see [Investigate a user account](investigate-user.md). ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-secopsdashboard-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-secopsdashboard-belowfoldlink) ## Related topics - [Understand the Microsoft Defender Advanced Threat Protection portal](use.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/service-status.md b/windows/security/threat-protection/microsoft-defender-atp/service-status.md index afa8a14d4f..d325456ebe 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/service-status.md +++ b/windows/security/threat-protection/microsoft-defender-atp/service-status.md @@ -24,7 +24,7 @@ ms.topic: article ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-servicestatus-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-servicestatus-abovefoldlink) The **Service health** provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues. If there are issues, you'll see details related to the issue such as when the issue was detected, what the preliminary root cause is, and the expected resolution time. diff --git a/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis.md b/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis.md index c77fa63c0f..6c8f2cc9a9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis.md +++ b/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis.md @@ -23,7 +23,7 @@ ms.topic: conceptual - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-supported-response-apis-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-supported-response-apis-abovefoldlink) Learn about the supported response related API calls you can run and details such as the required request headers, and expected response from the calls. diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index 499d34f2f0..fb697ba2a7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -1,156 +1,156 @@ ---- -title: Threat & Vulnerability Management scenarios -description: Learn how to use Threat & Vulnerability Management in the context of scenarios that Security Administrators encounter when you collaborate with IT Administrators and SecOps as you protect your organization from cybersecurity threats. -keywords: mdatp-tvm scenarios, mdatp, tvm, tvm scenarios, reduce threat & vulnerability exposure, reduce threat and vulnerability, improve security configuration, increase configuration score, increase threat & vulnerability configuration score, configuration score, exposure score, security controls -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dolmont -author: DulceMontemayor -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Threat & Vulnerability Management scenarios -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -## Before you begin -Ensure that your machines: -- Are onboarded to Microsoft Defender Advanced Threat Protection -- Run with Windows 10 1709 (Fall Creators Update) or later - ->[!NOTE] ->Threat & Vulnerability Management can also scan machines that run on Windows 7 and Windows Server 2019 operating systems and detects vulnerabilities addressed in patch Tuesday. - -- Have the following mandatory updates installed: -- (1) RS3 customers | [KB4493441](https://support.microsoft.com/en-us/help/4493441/windows-10-update-kb4493441) -- (2) RS4 customers | [KB4493464](https://support.microsoft.com/en-us/help/4493464) -- Are onboarded to Microsoft Intune and System Center Configuration Manager (SCCM). If you are use SCCM, update your console to the latest May version 1905 -- Have at least one security recommendation that can be viewed in the machine page -- Are tagged or marked as co-managed - - -## Reduce your threat and vulnerability exposure -Threat & Vulnerability Management introduces a new exposure score metric, which visually represents how exposed your machines are to imminent threats. - -The exposure score is continuously calculated on each device in the organization and influenced by the following factors: -- Weaknesses, such as vulnerabilities discovered on the device -- External and internal threats such as public exploit code and security alerts -- Likelihood of the device to get breached given its current security posture -- Value of the device to the organization given its role and content - -The exposure score is broken down into the following levels: -- 0–29: low exposure score -- 30–69: medium exposure score -- 70–100: high exposure score - -You can remediate the issues based on prioritized security recommendations to reduce the exposure score. Each software has weaknesses that are transformed into recommendations and prioritized based on risk to the organization. - -To lower down your threat and vulnerability exposure: - -1. Review the **Top security recommendations** from your **Threat & Vulnerability Management dashboard**, and select the first item on the list. The **Security recommendation** page opens. - - >>![Top security recommendations](images/tvm_security_recommendations.png) - - >[!NOTE] - > There are two types of recommendations: - > - Security update which refers to recommendations that require a package installation - > - Configuration change which refers to recommendations that require a registry or GPO modification - > Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight ![Threat insight](images/tvm_bug_icon.png) icon and possible active alert ![Possible active alert](images/tvm_alert_icon.png) icon. - -2. The **Security recommendations** page shows the list of items to remediate. Select the security recommendation that you need to investigate. When you select a recommendation from the list, a fly-out panel will display a description of what you need to remediate, number of vulnerabilities, associated exploits in machines, number of exposed machines and their machine names, business impact, and a list of CVEs. Click **Open software page** option from the flyout panel. ![Details in security recommendations page](images/tvm_security_recommendations_page.png) - -3. Click **Installed machines** and select the affected machine from the list to open the flyout panel with the relevant machine details, exposure and risk levels, alert and incident activities. ![Details in software page ](images/tvm_software_page_details.png) - -4. Click **Open machine page** to connect to the machine and apply the selected recommendation. See [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) for details. ![Details in machine page](images/tvm_machine_page_details.png) - -5. Allow a few hours for the changes to propagate in the system. - -6. Review the machine **Security recommendation** tab again. The recommendation you've chosen to remediate is removed from the security recommendation list, and the exposure score decreases. - -## Improve your security configuration ->[!NOTE] -> Secure score is now part of Threat & Vulnerability Management as [configuration score](configuration-score.md). The secure score page is available for a few weeks. View the [secure score](https://securitycenter.windows.com/securescore) page. - -You can improve your security configuration when you remediate issues from the security recommendations list. As you do so, your configuration score improves, which means your organization becomes more resilient against cybersecurity threats and vulnerabilities. - -1. From the Configuration score widget, select **Security controls**. The **Security recommendations** page opens and shows the list of issues related to security controls. - - >![Configuration score widget](images/tvm_config_score.png) - -2. Select the first item on the list. The flyout panel will open with a description of the security controls issue, a short description of the potential risk, insights, configuration ID, exposed machines, and business impact. Click **Remediation options**. - ![Security controls related security recommendations](images/tvm_security_controls.png) - -3. Read the description to understand the context of the issue and what to do next. Select a due date, add notes, and select **Export all remediation activity data to CSV** so you can attach it to the email that you can send to your IT Administrator for follow-up. - - >![Request remediation](images/tvm_request_remediation.png). - - >You will see a confirmation message that the remediation task has been created. - >![Remediation task creation confirmation](images/tvm_remediation_task_created.png) - -4. Save your CSV file. - ![Save csv file](images/tvm_save_csv_file.png) - -5. Send a follow-up email to your IT Administrator and allow the time that you have allotted for the remediation to propagate in the system. - -6. Review the machine **Configuration score** widget again. The number of the security controls issues will decrease. When you click **Security controls** to go back to the **Security recommendations** page, the item that you have addressed will not be listed there anymore, and your configuration score should increase. - -## Request a remediation ->[!NOTE] ->To use this capability, enable your Microsoft Intune connections. Navigate to **Settings** > **General** > **Advanced features**. Scroll down and look for **Microsoft Intune connection**. By default, the toggle is turned off. Turn your **Microsoft Intune connection** toggle on. - -The Threat & Vulnerability Management capability in Microsoft Defender ATP bridges the gap between Security and IT Administrators through the remediation request workflow. - -Security Administrators like you can request for the IT Administrator to remediate a vulnerability from the **Security recommendation** pages to Intune. - -1. Click a security recommendation you would like to request remediation for, and then click **Remediation options**. - -2. Select **Open a ticket in Intune (for AAD joined devices)**, select a due date, and add optional notes for the IT Administrator. Click **Submit request**. - -3. Notify your IT Administrator about the new request and have them log into Intune to approve or reject the request and start a package deployment. - -4. Go to the **Remediation** page to view the status of your remediation request. - -See [Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP](https://docs.microsoft.com/intune/atp-manage-vulnerabilities) for details. - ->[!NOTE] ->If your request involves remediating more than 10,000 machines, we can only send 10,000 machines for remediation to Intune. - -## File for exception -With Threat & Vulnerability Management, you can create exceptions for recommendations, as an alternative to a remediation request. - -There are many reasons why organizations create exceptions for a recommendation. For example, if there's a business justification that prevents the company from applying the recommendation, the existence of a compensating or alternative control that provides as much protection than the recommendation would, a false positive, among other reasons. - -Exceptions can be created for both *Security update* and *Configuration change* recommendations. - -When an exception is created for a recommendation, the recommendation is no longer active. The recommendation state changes to **Exception**, and it no longer shows up in the security recommendations list. - - -1. Navigate to the **Security recommendations** page under the **Threat & Vulnerability Management** section menu. - -2. Click the top-most recommendation. A flyout panel opens with the recommendation details. - -3. Click **Exception options**. - -4. Select your justification for the exception you need to file instead of remediating the security recommendation in question. Fill out the justification context, then set the exception duration. - -5. Click **Submit**. A confirmation message at the top of the page indicates that the exception has been created. - -6. Navigate to the **Remediation** page under the **Threat & Vulnerability Management** menu and click the **Exceptions** tab to view all your exceptions (current and past). - -## Related topics -- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) -- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) -- [Configuration score](configuration-score.md) -- [Security recommendations](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) +--- +title: Threat & Vulnerability Management scenarios +description: Learn how to use Threat & Vulnerability Management in the context of scenarios that Security Administrators encounter when you collaborate with IT Administrators and SecOps as you protect your organization from cybersecurity threats. +keywords: mdatp-tvm scenarios, mdatp, tvm, tvm scenarios, reduce threat & vulnerability exposure, reduce threat and vulnerability, improve security configuration, increase configuration score, increase threat & vulnerability configuration score, configuration score, exposure score, security controls +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +# Threat & Vulnerability Management scenarios +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +## Before you begin +Ensure that your machines: +- Are onboarded to Microsoft Defender Advanced Threat Protection +- Run with Windows 10 1709 (Fall Creators Update) or later + +>[!NOTE] +>Threat & Vulnerability Management can also scan machines that run on Windows 7 and Windows Server 2019 operating systems and detects vulnerabilities addressed in patch Tuesday. + +- Have the following mandatory updates installed: +- (1) RS3 customers | [KB4493441](https://support.microsoft.com/en-us/help/4493441/windows-10-update-kb4493441) +- (2) RS4 customers | [KB4493464](https://support.microsoft.com/en-us/help/4493464) +- Are onboarded to Microsoft Intune and System Center Configuration Manager (SCCM). If you are use SCCM, update your console to the latest May version 1905 +- Have at least one security recommendation that can be viewed in the machine page +- Are tagged or marked as co-managed + + +## Reduce your threat and vulnerability exposure +Threat & Vulnerability Management introduces a new exposure score metric, which visually represents how exposed your machines are to imminent threats. + +The exposure score is continuously calculated on each device in the organization and influenced by the following factors: +- Weaknesses, such as vulnerabilities discovered on the device +- External and internal threats such as public exploit code and security alerts +- Likelihood of the device to get breached given its current security posture +- Value of the device to the organization given its role and content + +The exposure score is broken down into the following levels: +- 0–29: low exposure score +- 30–69: medium exposure score +- 70–100: high exposure score + +You can remediate the issues based on prioritized security recommendations to reduce the exposure score. Each software has weaknesses that are transformed into recommendations and prioritized based on risk to the organization. + +To lower down your threat and vulnerability exposure: + +1. Review the **Top security recommendations** from your **Threat & Vulnerability Management dashboard**, and select the first item on the list. The **Security recommendation** page opens. + + >>![Top security recommendations](images/tvm_security_recommendations.png) + + >[!NOTE] + > There are two types of recommendations: + > - Security update which refers to recommendations that require a package installation + > - Configuration change which refers to recommendations that require a registry or GPO modification + > Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight ![Threat insight](images/tvm_bug_icon.png) icon and possible active alert ![Possible active alert](images/tvm_alert_icon.png) icon. + +2. The **Security recommendations** page shows the list of items to remediate. Select the security recommendation that you need to investigate. When you select a recommendation from the list, a fly-out panel will display a description of what you need to remediate, number of vulnerabilities, associated exploits in machines, number of exposed machines and their machine names, business impact, and a list of CVEs. Click **Open software page** option from the flyout panel. ![Details in security recommendations page](images/tvm_security_recommendations_page.png) + +3. Click **Installed machines** and select the affected machine from the list to open the flyout panel with the relevant machine details, exposure and risk levels, alert and incident activities. ![Details in software page ](images/tvm_software_page_details.png) + +4. Click **Open machine page** to connect to the machine and apply the selected recommendation. See [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) for details. ![Details in machine page](images/tvm_machine_page_details.png) + +5. Allow a few hours for the changes to propagate in the system. + +6. Review the machine **Security recommendation** tab again. The recommendation you've chosen to remediate is removed from the security recommendation list, and the exposure score decreases. + +## Improve your security configuration +>[!NOTE] +> Secure score is now part of Threat & Vulnerability Management as [configuration score](configuration-score.md). The secure score page is available for a few weeks. View the [secure score](https://securitycenter.windows.com/securescore) page. + +You can improve your security configuration when you remediate issues from the security recommendations list. As you do so, your configuration score improves, which means your organization becomes more resilient against cybersecurity threats and vulnerabilities. + +1. From the Configuration score widget, select **Security controls**. The **Security recommendations** page opens and shows the list of issues related to security controls. + + >![Configuration score widget](images/tvm_config_score.png) + +2. Select the first item on the list. The flyout panel will open with a description of the security controls issue, a short description of the potential risk, insights, configuration ID, exposed machines, and business impact. Click **Remediation options**. + ![Security controls related security recommendations](images/tvm_security_controls.png) + +3. Read the description to understand the context of the issue and what to do next. Select a due date, add notes, and select **Export all remediation activity data to CSV** so you can attach it to the email that you can send to your IT Administrator for follow-up. + + >![Request remediation](images/tvm_request_remediation.png). + + >You will see a confirmation message that the remediation task has been created. + >![Remediation task creation confirmation](images/tvm_remediation_task_created.png) + +4. Save your CSV file. + ![Save csv file](images/tvm_save_csv_file.png) + +5. Send a follow-up email to your IT Administrator and allow the time that you have allotted for the remediation to propagate in the system. + +6. Review the machine **Configuration score** widget again. The number of the security controls issues will decrease. When you click **Security controls** to go back to the **Security recommendations** page, the item that you have addressed will not be listed there anymore, and your configuration score should increase. + +## Request a remediation +>[!NOTE] +>To use this capability, enable your Microsoft Intune connections. Navigate to **Settings** > **General** > **Advanced features**. Scroll down and look for **Microsoft Intune connection**. By default, the toggle is turned off. Turn your **Microsoft Intune connection** toggle on. + +The Threat & Vulnerability Management capability in Microsoft Defender ATP bridges the gap between Security and IT Administrators through the remediation request workflow. + +Security Administrators like you can request for the IT Administrator to remediate a vulnerability from the **Security recommendation** pages to Intune. + +1. Click a security recommendation you would like to request remediation for, and then click **Remediation options**. + +2. Select **Open a ticket in Intune (for AAD joined devices)**, select a due date, and add optional notes for the IT Administrator. Click **Submit request**. + +3. Notify your IT Administrator about the new request and have them log into Intune to approve or reject the request and start a package deployment. + +4. Go to the **Remediation** page to view the status of your remediation request. + +See [Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP](https://docs.microsoft.com/intune/atp-manage-vulnerabilities) for details. + +>[!NOTE] +>If your request involves remediating more than 10,000 machines, we can only send 10,000 machines for remediation to Intune. + +## File for exception +With Threat & Vulnerability Management, you can create exceptions for recommendations, as an alternative to a remediation request. + +There are many reasons why organizations create exceptions for a recommendation. For example, if there's a business justification that prevents the company from applying the recommendation, the existence of a compensating or alternative control that provides as much protection than the recommendation would, a false positive, among other reasons. + +Exceptions can be created for both *Security update* and *Configuration change* recommendations. + +When an exception is created for a recommendation, the recommendation is no longer active. The recommendation state changes to **Exception**, and it no longer shows up in the security recommendations list. + + +1. Navigate to the **Security recommendations** page under the **Threat & Vulnerability Management** section menu. + +2. Click the top-most recommendation. A flyout panel opens with the recommendation details. + +3. Click **Exception options**. + +4. Select your justification for the exception you need to file instead of remediating the security recommendation in question. Fill out the justification context, then set the exception duration. + +5. Click **Submit**. A confirmation message at the top of the page indicates that the exception has been created. + +6. Navigate to the **Remediation** page under the **Threat & Vulnerability Management** menu and click the **Exceptions** tab to view all your exceptions (current and past). + +## Related topics +- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) +- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) +- [Exposure score](tvm-exposure-score.md) +- [Configuration score](configuration-score.md) +- [Security recommendations](tvm-security-recommendation.md) +- [Remediation](tvm-remediation.md) +- [Software inventory](tvm-software-inventory.md) +- [Weaknesses](tvm-weaknesses.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-indicator-concepts.md b/windows/security/threat-protection/microsoft-defender-atp/threat-indicator-concepts.md index 7b758a94bc..e0ba7d55f6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-indicator-concepts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-indicator-concepts.md @@ -24,7 +24,7 @@ ms.topic: conceptual ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-threatindicator-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-threatindicator-abovefoldlink) Advanced cybersecurity attacks comprise of multiple complex malicious events, attributes, and contextual information. Identifying and deciding which of these activities qualify as suspicious can be a challenging task. Your knowledge of known attributes and abnormal activities specific to your industry is fundamental in knowing when to call an observed behavior as suspicious. @@ -44,9 +44,9 @@ In the context of Microsoft Defender ATP, alert definitions are containers for I Each IOC defines the concrete detection logic based on its type and value as well as its action, which determines how it is matched. It is bound to a specific alert definition that defines how a detection is displayed as an alert on the Microsoft Defender ATP console. Here is an example of an IOC: - - Type: Sha1 - - Value: 92cfceb39d57d914ed8b14d0e37643de0797ae56 - - Action: Equals +- Type: Sha1 +- Value: 92cfceb39d57d914ed8b14d0e37643de0797ae56 +- Action: Equals IOCs have a many-to-one relationship with alert definitions such that an alert definition can have many IOCs that correspond to it. diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration.md b/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration.md index e620a05684..c99a26affb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration.md @@ -9,7 +9,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: mjcaparas +ms.author: macapara author: mjcaparas ms.localizationpriority: medium manager: dansimp @@ -18,7 +18,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Microsoft Threat Protection +# Microsoft Defender ATP in Microsoft Threat Protection **Applies to:** @@ -51,8 +51,11 @@ Microsoft Cloud App Security leverages Microsoft Defender ATP endpoint signals t ## Office 365 Advanced Threat Protection (Office 365 ATP) [Office 365 ATP](https://docs.microsoft.com/office365/securitycompliance/office-365-atp) helps protect your organization from malware in email messages or files through ATP Safe Links, ATP Safe Attachments, advanced Anti-Phishing, and spoof intelligence capabilities. The integration between Office 365 ATP and Microsoft Defender ATP enables security analysts to go upstream to investigate the entry point of an attack. Through threat intelligence sharing, attacks can be contained and blocked. +>[!NOTE] +> Office 365 ATP data is displayed for events within the last 30 days. For alerts, Office 365 ATP data is displayed based on first activity time. After that, the data is no longer available in Office 365 ATP. + ## Skype for Business -The Skype for Business integration provides s a way for analysts to communicate with a potentially compromised user or device owner through ao simple button from the portal. +The Skype for Business integration provides a way for analysts to communicate with a potentially compromised user or device owner through a simple button from the portal. diff --git a/windows/security/threat-protection/microsoft-defender-atp/ti-indicator.md b/windows/security/threat-protection/microsoft-defender-atp/ti-indicator.md index 4d110a041b..1c38ae5395 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/ti-indicator.md +++ b/windows/security/threat-protection/microsoft-defender-atp/ti-indicator.md @@ -28,7 +28,9 @@ Method|Return Type |Description [Submit Indicator](post-ti-indicator.md) | [Indicator](ti-indicator.md) | Submits [Indicator](ti-indicator.md) entity. [Delete Indicator](delete-ti-indicator-by-id.md) | No Content | Deletes [Indicator](ti-indicator.md) entity. -- See the corresponding [page](https://securitycenter.windows.com/preferences2/custom_ti_indicators/files) in the portal: +- See the corresponding [page](https://securitycenter.windows.com/preferences2/custom_ti_indicators/files) in the portal. + +For more information on creating indicators, see [Manage indicators](manage-indicators.md). # Properties Property | Type | Description diff --git a/windows/security/threat-protection/microsoft-defender-atp/time-settings.md b/windows/security/threat-protection/microsoft-defender-atp/time-settings.md index 7f6c773756..97484fcfe2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/time-settings.md +++ b/windows/security/threat-protection/microsoft-defender-atp/time-settings.md @@ -24,7 +24,7 @@ ms.topic: article ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-settings-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-settings-abovefoldlink) Use the **Time zone** menu ![Time zone settings icon](images/atp-time-zone.png) to configure the time zone and view license information. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md similarity index 80% rename from windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md rename to windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md index 373d0c8387..dc8f75b9f2 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: dansimp ms.author: dansimp ms.date: 03/27/2019 @@ -20,44 +21,44 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -When you use [attack surface reduction rules](attack-surface-reduction-exploit-guard.md) you may encounter issues, such as: +When you use [attack surface reduction rules](attack-surface-reduction.md) you may encounter issues, such as: -- A rule blocks a file, process, or performs some other action that it should not (false positive) -- A rule does not work as described, or does not block a file or process that it should (false negative) +* A rule blocks a file, process, or performs some other action that it should not (false positive) +* A rule does not work as described, or does not block a file or process that it should (false negative) There are four steps to troubleshooting these problems: 1. Confirm prerequisites 2. Use audit mode to test the rule 3. Add exclusions for the specified rule (for false positives) -3. Submit support logs +4. Submit support logs ## Confirm prerequisites Attack surface reduction rules will only work on devices with the following conditions: ->[!div class="checklist"] -> - Endpoints are running Windows 10 Enterprise, version 1709 (also known as the Fall Creators Update). -> - Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md). -> - [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled. -> - Audit mode is not enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md). +> [!div class="checklist"] +> * Endpoints are running Windows 10 Enterprise, version 1709 (also known as the Fall Creators Update). +> * Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md). +> * [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled. +> * Audit mode is not enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md). If these pre-requisites have all been met, proceed to the next step to test the rule in audit mode. ## Use audit mode to test the rule -You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm attack surface reduction rules are generally working for pre-configured scenarios and processes on a device, or you can use audit mode, which enables rules for reporting only. +You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm attack surface reduction rules are generally working for pre-configured scenarios and processes on a device, or you can use audit mode, which enables rules for reporting only. Follow these instructions in [Use the demo tool to see how attack surface reduction rules work](evaluate-attack-surface-reduction.md) to test the specific rule you are encountering problems with. 1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to **Audit mode** (value: **2**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md). Audit mode allows the rule to report the file or process, but will still allow it to run. 2. Perform the activity that is causing an issue (for example, open or execute the file or process that should be blocked but is being allowed). -3. [Review the attack surface reductio rule event logs](attack-surface-reduction-exploit-guard.md) to see if the rule would have blocked the file or process if the rule had been set to **Enabled**. +3. [Review the attack surface reductio rule event logs](attack-surface-reduction.md) to see if the rule would have blocked the file or process if the rule had been set to **Enabled**. > ->If a rule is not blocking a file or process that you are expecting it should block, first check if audit mode is enabled. +>If a rule is not blocking a file or process that you are expecting it should block, first check if audit mode is enabled. > >Audit mode may have been enabled for testing another feature, or by an automated PowerShell script, and may not have been disabled after the tests were completed. @@ -78,25 +79,28 @@ To add an exclusion, see [Customize Attack surface reduction](customize-attack-s ## Report a false positive or false negative -Use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/en-us/wdsi/filesubmission) to report a false negative or false positive for network protection. With an E5 subscription, you can also [provide a link to any associated alert](../microsoft-defender-atp/alerts-queue.md). +Use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/wdsi/filesubmission) to report a false negative or false positive for network protection. With an E5 subscription, you can also [provide a link to any associated alert](../microsoft-defender-atp/alerts-queue.md). ## Collect diagnostic data for file submissions -When you report a problem with attack surface reduction rules, you are asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues. +When you report a problem with attack surface reduction rules, you are asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues. 1. Open an elevated command prompt and change to the Windows Defender directory: + ```console cd c:\program files\windows defender ``` + 2. Run this command to generate the diagnostic logs: + ```console mpcmdrun -getfiles ``` -3. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form. + +3. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form. ## Related topics -- [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md) -- [Enable attack surface reduction rules](enable-attack-surface-reduction.md) -- [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) - +* [Attack surface reduction rules](attack-surface-reduction.md) +* [Enable attack surface reduction rules](enable-attack-surface-reduction.md) +* [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-custom-ti.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-custom-ti.md index 159081aa19..217b980381 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-custom-ti.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-custom-ti.md @@ -48,7 +48,7 @@ If your client secret expires or if you've misplaced the copy provided when you 7. Copy the value and save it in a safe place. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshootcustomti-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshootcustomti-belowfoldlink) ## Related topics diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations.md similarity index 79% rename from windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md rename to windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations.md index 63963825e3..ae216de7bb 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: dansimp ms.author: dansimp ms.date: 08/09/2018 @@ -20,7 +21,7 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) When you create a set of exploit protection mitigations (known as a configuration), you might find that the configuration export and import process does not remove all unwanted mitigations. @@ -46,7 +47,7 @@ You can manually remove unwanted mitigations in Windows Security, or you can use Write-Host "Removing MitigationAuditOptions for: " $Name Remove-ItemProperty -Path $Key.PSPath -Name "MitigationAuditOptions" -ErrorAction Stop; } - + # Remove the FilterFullPath value if there is nothing else if (($Key.SubKeyCount -eq 0) -and ($Key.ValueCount -eq 1) -and ($Key.GetValue("FilterFullPath"))) { Remove-ItemProperty -Path $Key.PSPath -Name "FilterFullPath" -ErrorAction Stop; @@ -58,19 +59,19 @@ You can manually remove unwanted mitigations in Windows Security, or you can use Remove-Item -Path $Key.PSPath -ErrorAction Stop } } - Catch { - Write-Host "ERROR:" $_.Exception.Message "- at ($MitigationItemName)" + Catch { + Write-Host "ERROR:" $_.Exception.Message "- at ($MitigationItemName)" } } # Delete all ExploitGuard ProcessMitigations function Remove-All-ProcessMitigations { if (!(Test-IsAdmin)) { - throw "ERROR: No Administrator-Privileges detected!"; return + throw "ERROR: No Administrator-Privileges detected!"; return } Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" | ForEach-Object { - $MitigationItem = $_; + $MitigationItem = $_; $MitigationItemName = $MitigationItem.PSChildName Try { @@ -85,7 +86,7 @@ You can manually remove unwanted mitigations in Windows Security, or you can use Write-Host "Removing FullPathEntry: " $Name Remove-ProcessMitigations $FullPathItem $Name } - + # If there are no subkeys now, we can delete the "UseFilter" value if ($MitigationItem.SubKeyCount -eq 0) { Remove-ItemProperty -Path $MitigationItem.PSPath -Name "UseFilter" -ErrorAction Stop @@ -97,8 +98,8 @@ You can manually remove unwanted mitigations in Windows Security, or you can use Remove-Item -Path $MitigationItem.PSPath -ErrorAction Stop } } - Catch { - Write-Host "ERROR:" $_.Exception.Message "- at ($MitigationItemName)" + Catch { + Write-Host "ERROR:" $_.Exception.Message "- at ($MitigationItemName)" } } } @@ -106,18 +107,18 @@ You can manually remove unwanted mitigations in Windows Security, or you can use # Delete all ExploitGuard System-wide Mitigations function Remove-All-SystemMitigations { - if (!(Test-IsAdmin)) { - throw "ERROR: No Administrator-Privileges detected!"; return + if (!(Test-IsAdmin)) { + throw "ERROR: No Administrator-Privileges detected!"; return } - + $Kernel = Get-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\kernel" - Try { - if ($Kernel.GetValue("MitigationOptions")) + Try { + if ($Kernel.GetValue("MitigationOptions")) { Write-Host "Removing System MitigationOptions" Remove-ItemProperty -Path $Kernel.PSPath -Name "MitigationOptions" -ErrorAction Stop; } - if ($Kernel.GetValue("MitigationAuditOptions")) + if ($Kernel.GetValue("MitigationAuditOptions")) { Write-Host "Removing System MitigationAuditOptions" Remove-ItemProperty -Path $Kernel.PSPath -Name "MitigationAuditOptions" -ErrorAction Stop; } @@ -132,30 +133,30 @@ You can manually remove unwanted mitigations in Windows Security, or you can use 2. Create and import an XML configuration file with the following default mitigations, as described in Import, export, and deploy Exploit Protection configurations: - ```xml + ```xml - - - - - - - - - - + + + + + + + + + + - + - - + + - - - - - + + + + + @@ -180,9 +181,9 @@ You can manually remove unwanted mitigations in Windows Security, or you can use - - - + + + @@ -195,9 +196,9 @@ If you haven’t already, it's a good idea to download and use the [Windows Secu ## Related topics -- [Protect devices from exploits](exploit-protection-exploit-guard.md) -- [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) -- [Evaluate exploit protection](evaluate-exploit-protection.md) -- [Enable exploit protection](enable-exploit-protection.md) -- [Configure and audit exploit protection mitigations](customize-exploit-protection.md) -- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) +* [Protect devices from exploits](exploit-protection.md) +* [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection.md) +* [Evaluate exploit protection](evaluate-exploit-protection.md) +* [Enable exploit protection](enable-exploit-protection.md) +* [Configure and audit exploit protection mitigations](customize-exploit-protection.md) +* [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp.md index 3cd0504b1f..a8109f849e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp.md @@ -62,7 +62,7 @@ The following date and time formats are currently not supported: **Use of comma to indicate thousand**
                        Support of use of comma as a separator in numbers are not supported. Regions where a number is separated with a comma to indicate a thousand, will only see the use of a dot as a separator. For example, 15,5K is displayed as 15.5K. ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshoot-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshoot-belowfoldlink) ## Microsoft Defender ATP tenant was automatically created in Europe When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created. The Microsoft Defender ATP data is stored in Europe by default. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md similarity index 69% rename from windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md rename to windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md index cfd19843a9..af397987a0 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: dansimp ms.author: dansimp ms.date: 03/27/2019 @@ -20,48 +21,50 @@ manager: dansimp **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -- IT administrators +* IT administrators -When you use [Network protection](network-protection-exploit-guard.md) you may encounter issues, such as: +When you use [Network protection](network-protection.md) you may encounter issues, such as: -- Network protection blocks a website that is safe (false positive) -- Network protection fails to block a suspicious or known malicious website (false negative) +* Network protection blocks a website that is safe (false positive) +* Network protection fails to block a suspicious or known malicious website (false negative) There are four steps to troubleshooting these problems: 1. Confirm prerequisites 2. Use audit mode to test the rule 3. Add exclusions for the specified rule (for false positives) -3. Submit support logs +4. Submit support logs ## Confirm prerequisites Network protection will only work on devices with the following conditions: >[!div class="checklist"] -> - Endpoints are running Windows 10 Enterprise edition, version 1709 or higher (also known as the Fall Creators Update). -> - Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md). -> - [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled. -> - [Cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) is enabled. -> - Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**). +> * Endpoints are running Windows 10 Enterprise edition, version 1709 or higher (also known as the Fall Creators Update). +> * Endpoints are using Windows Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Windows Defender AV to disable itself](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md). +> * [Real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) is enabled. +> * [Cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) is enabled. +> * Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**). +## Use audit mode -## Use audit mode - -You can enable network protection in audit mode and then visit a website that we've created to demo the feature. All website connections will be allowed by network protection but an event will be logged to indicate any connection that would have been blocked if network protection was enabled. +You can enable network protection in audit mode and then visit a website that we've created to demo the feature. All website connections will be allowed by network protection but an event will be logged to indicate any connection that would have been blocked if network protection was enabled. 1. Set network protection to **Audit mode**. - ```powershell + + ```PowerShell Set-MpPreference -EnableNetworkProtection AuditMode ``` -2. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don't want to block). -3. [Review the network protection event logs](network-protection-exploit-guard.md#review-network-protection-events-in-windows-event-viewer) to see if the feature would have blocked the connection if it had been set to **Enabled**. + +1. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don't want to block). + +1. [Review the network protection event logs](network-protection.md#review-network-protection-events-in-windows-event-viewer) to see if the feature would have blocked the connection if it had been set to **Enabled**. > >If network protection is not blocking a connection that you are expecting it should block, enable the feature. -```powershell +```PowerShell Set-MpPreference -EnableNetworkProtection Enabled ``` @@ -75,21 +78,24 @@ To whitelist the website that is being blocked (false positive), add its URL to ## Collect diagnostic data for file submissions -When you report a problem with network protection, you are asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues. +When you report a problem with network protection, you are asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues. 1. Open an elevated command prompt and change to the Windows Defender directory: - ``` + + ```PowerShell cd c:\program files\windows defender ``` -2. Run this command to generate the diagnostic logs: - ``` + +1. Run this command to generate the diagnostic logs: + + ```PowerShell mpcmdrun -getfiles ``` -3. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form. + +1. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form. ## Related topics -- [Windows Defender Exploit Guard](windows-defender-exploit-guard.md) -- [Network protection](network-protection-exploit-guard.md) -- [Evaluate network protection](evaluate-network-protection.md) -- [Enable network protection](enable-network-protection.md) +* [Network protection](network-protection.md) +* [Evaluate network protection](evaluate-network-protection.md) +* [Enable network protection](enable-network-protection.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages.md index 078fc9543d..f27f90ae22 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages.md @@ -24,7 +24,7 @@ ms.topic: troubleshooting - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troublshootonboarding-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troublshootonboarding-abovefoldlink) This page provides detailed steps to troubleshoot issues that might occur when setting up your Microsoft Defender ATP service. diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md index f981d9c12a..24b7d6924e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding.md @@ -25,20 +25,22 @@ ms.topic: troubleshooting - Windows Server 2016 - You might need to troubleshoot the Microsoft Defender ATP onboarding process if you encounter issues. This page provides detailed steps to troubleshoot onboarding issues that might occur when deploying with one of the deployment tools and common errors that might occur on the machines. + +## Troubleshoot issues with onboarding tools + If you have completed the onboarding process and don't see machines in the [Machines list](investigate-machines.md) after an hour, it might indicate an onboarding or connectivity problem. -## Troubleshoot onboarding when deploying with Group Policy +### Troubleshoot onboarding when deploying with Group Policy Deployment with Group Policy is done by running the onboarding script on the machines. The Group Policy console does not indicate if the deployment has succeeded or not. If you have completed the onboarding process and don't see machines in the [Machines list](investigate-machines.md) after an hour, you can check the output of the script on the machines. For more information, see [Troubleshoot onboarding when deploying with a script](#troubleshoot-onboarding-when-deploying-with-a-script). If the script completes successfully, see [Troubleshoot onboarding issues on the machines](#troubleshoot-onboarding-issues-on-the-machine) for additional errors that might occur. -## Troubleshoot onboarding issues when deploying with System Center Configuration Manager +### Troubleshoot onboarding issues when deploying with System Center Configuration Manager When onboarding machines using the following versions of System Center Configuration Manager: - System Center 2012 Configuration Manager - System Center 2012 R2 Configuration Manager @@ -52,7 +54,7 @@ If the deployment fails, you can check the output of the script on the machines. If the onboarding completed successfully but the machines are not showing up in the **Machines list** after an hour, see [Troubleshoot onboarding issues on the machine](#troubleshoot-onboarding-issues-on-the-machine) for additional errors that might occur. -## Troubleshoot onboarding when deploying with a script +### Troubleshoot onboarding when deploying with a script **Check the result of the script on the machine**: 1. Click **Start**, type **Event Viewer**, and press **Enter**. @@ -76,7 +78,7 @@ Event ID | Error Type | Resolution steps 40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors using Event viewer](event-error-codes.md). 65 | Insufficient privileges| Run the script again with administrator privileges. -## Troubleshoot onboarding issues using Microsoft Intune +### Troubleshoot onboarding issues using Microsoft Intune You can use Microsoft Intune to check error codes and attempt to troubleshoot the cause of the issue. If you have configured policies in Intune and they are not propagated on machines, you might need to configure automatic MDM enrollment. @@ -296,14 +298,14 @@ You might also need to check the following: ## Licensing requirements Microsoft Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers: - - Windows 10 Enterprise E5 - - Windows 10 Education E5 - - Microsoft 365 Enterprise E5 which includes Windows 10 Enterprise E5 +- Windows 10 Enterprise E5 +- Windows 10 Education E5 +- Microsoft 365 Enterprise E5 which includes Windows 10 Enterprise E5 -For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us/Licensing/product-licensing/windows10.aspx#tab=2). +For more information, see [Windows 10 Licensing](https://www.microsoft.com/Licensing/product-licensing/windows10.aspx#tab=2). ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshootonboarding-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshootonboarding-belowfoldlink) ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview.md deleted file mode 100644 index 0cf451828c..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Troubleshoot Microsoft Defender Advanced Threat Protection capabilities -description: Find solutions to issues on sensor state, service issues, or other Microsoft Defender ATP capabilities -keywords: troubleshoot, sensor, state, service, issues, attack surface reduction, next generation protection -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: troubleshooting ---- - -# Troubleshoot Microsoft Defender Advanced Threat Protection - -Troubleshoot issues that might arise as you use Microsoft Defender ATP capabilities. - -## In this section -Topic | Description -:---|:--- -Troubleshoot sensor state | Find solutions for issues related to the Microsoft Defender ATP sensor -Troubleshoot service issues | Fix issues related to the Microsoft Defender Advanced Threat service -Troubleshoot attack surface reduction | Fix issues related to network protection and attack surface reduction rules -Troubleshoot next generation protection | If you encounter a problem with antivirus, you can search the tables in this topic to find a matching issue and potential solution - diff --git a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem.md b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem.md index c45bc362d2..858ebde2ec 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem.md +++ b/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem.md @@ -25,7 +25,7 @@ ms.topic: troubleshooting -You might need to troubleshoot issues while pulling alerts in your SIEM tools. +You might need to troubleshoot issues while pulling detections in your SIEM tools. This page provides detailed steps to troubleshoot issues you might encounter. @@ -76,11 +76,11 @@ If you encounter an error when trying to enable the SIEM connector application, ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshootsiem-belowfoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshootsiem-belowfoldlink) ## Related topics - [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md) -- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight.md) -- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk.md) -- [Microsoft Defender ATP alert API fields](api-portal-mapping.md) -- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api.md) +- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md) +- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md) +- [Microsoft Defender ATP Detection fields](api-portal-mapping.md) +- [Pull Microsoft Defender ATP detections using REST API](pull-alerts-using-rest-api.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md index f6488ecbd0..8eebb66298 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md @@ -1,48 +1,48 @@ ---- -title: Exposure score -description: Your exposure level reflects how vulnerable your organization is to cybersecurity threats. Apply the Threat & Vulnerability Management security recommendations to keep your exposure level low. -keywords: exposure score, mdatp exposure score, mdatp tvm exposure score, organization exposure score, tvm organization exposure score -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dolmont -author: DulceMontemayor -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 06/30/2019 ---- -# Exposure score -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Your exposure score reflects how vulnerable your organization is to cybersecurity threats. Low exposure score means your machines are less vulnerable from exploitation. - -The widget also gives you a high-level view of your exposure score trend over time. Any spikes in the chart gives you a visual indication of a high cybersecurity threat exposure that you can investigate further. - -![Exposure score widget](images/tvm_exp_score.png) - -## How it works - -Several factors affect your organization exposure score: -- Weakness discovered on the device -- Likelihood of a device getting breached -- Value of the device to the organization -- Relevant alert discovered on the device - -Reduce the exposure score by addressing what needs to be remediated based on the prioritized security recommendations. See [Security recommendations](tvm-security-recommendation.md) for details. - -## Related topics -- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) -- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) -- [Configuration score](configuration-score.md) -- [Security recommendations](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) +--- +title: Exposure score +description: Your exposure level reflects how vulnerable your organization is to cybersecurity threats. Apply the Threat & Vulnerability Management security recommendations to keep your exposure level low. +keywords: exposure score, mdatp exposure score, mdatp tvm exposure score, organization exposure score, tvm organization exposure score +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.date: 06/30/2019 +--- +# Exposure score +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +Your exposure score reflects how vulnerable your organization is to cybersecurity threats. Low exposure score means your machines are less vulnerable from exploitation. + +The widget also gives you a high-level view of your exposure score trend over time. Any spikes in the chart gives you a visual indication of a high cybersecurity threat exposure that you can investigate further. + +![Exposure score widget](images/tvm_exp_score.png) + +## How it works + +Several factors affect your organization exposure score: +- Weakness discovered on the device +- Likelihood of a device getting breached +- Value of the device to the organization +- Relevant alert discovered on the device + +Reduce the exposure score by addressing what needs to be remediated based on the prioritized security recommendations. See [Security recommendations](tvm-security-recommendation.md) for details. + +## Related topics +- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) +- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) +- [Configuration score](configuration-score.md) +- [Security recommendations](tvm-security-recommendation.md) +- [Remediation](tvm-remediation.md) +- [Software inventory](tvm-software-inventory.md) +- [Weaknesses](tvm-weaknesses.md) +- [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md index 6e208209cb..674d4b0309 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md @@ -1,66 +1,66 @@ ---- -title: Remediation -description: You can lower down your organization's exposure from vulnerabilities and increase your security configuration by remediating the security recommendations. Threat & Vulnerability Management bridges the gap between security administration and IT administration during remediation process. It does so by creating a security task or ticket through integration with Microsoft Intune and Microsoft System Center Configuration Manager (SCCM). -keywords: microsoft defender atp tvm remediation, mdatp tvm, threat & vulnerability management, threat & vulnerability management remediation, tvm remediation intune, tvm remediation sccm -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dolmont -author: DulceMontemayor -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 04/11/2019 ---- -# Remediation -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->[!NOTE] ->To use this capability, enable your Microsoft Intune connections. Navigate to **Settings** > **General** > **Advanced features**. Scroll down and look for **Microsoft Intune connection**. By default, the toggle is turned off. Turn your **Microsoft Intune connection** toggle on. - -After your organization's cybersecurity weaknesses are identified and mapped to actionable security recommendations, you can start creating security tasks through the integration with Microsoft Intune where remediation tickets are created. - -You can lower down your organization's exposure from vulnerabilities and increase your security configuration by remediating the security recommendations. - -## Navigate through your remediation options -You'll see your remediation options when you select one of the security recommendation blocks from your **Top security recommendations** widget in the dashboard. -1. From the flyout panel, you'll see the security recommendation details including your next steps. Click **Remediation options**. -2. In the **Remediation options** page, select **Open a ticket in Intune (for AAD joined devices)**. - ->[!NOTE] ->If your request involves remediating more than 10,000 machines, we will only send 10,000 machines for remediation to Intune. - -3. Select a remediation due date. -4. Add notes to give your IT administrator a context of your remediation request. For example, you can indicate urgency of the remediation request to avoid potential exposure to a recent exploit activity, or if the request is a part of compliance. - -If you want to check how the ticket shows up in Intune, see [Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP](https://docs.microsoft.com/intune/atp-manage-vulnerabilities) for details. - -## How it works - -When you submit a remediation request from Threat & Vulnerability Management, it kicks-off a remediation activity. - -It creates a security task which will be tracked in Threat & Vulnerability Management **Remediation** page, and it also creates a remediation ticket in Microsoft Intune. - -You also have the option to export all remediation activity data to CSV for records, reporting purposes, or if you want to notify your IT administration counterpart that a remediation ticket has been submitted. - -The dashboard will show that status of your top remediation activities. Click any of the entries and it will take you to the **Remediation** page. You can mark the remediation activity as completed after the IT administration team remediates the task. - -However, if the security recommendation stemmed from a false positive report, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The exceptions you've filed will also show up in the **Remediation** page, in the **Exceptions** tab. - -## Related topics -- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) -- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) -- [Configuration score](configuration-score.md) -- [Security recommendation](tvm-security-recommendation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) - - +--- +title: Remediation +description: You can lower down your organization's exposure from vulnerabilities and increase your security configuration by remediating the security recommendations. Threat & Vulnerability Management bridges the gap between security administration and IT administration during remediation process. It does so by creating a security task or ticket through integration with Microsoft Intune and Microsoft System Center Configuration Manager (SCCM). +keywords: microsoft defender atp tvm remediation, mdatp tvm, threat & vulnerability management, threat & vulnerability management remediation, tvm remediation intune, tvm remediation sccm +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.date: 04/11/2019 +--- +# Remediation +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>[!NOTE] +>To use this capability, enable your Microsoft Intune connections. Navigate to **Settings** > **General** > **Advanced features**. Scroll down and look for **Microsoft Intune connection**. By default, the toggle is turned off. Turn your **Microsoft Intune connection** toggle on. + +After your organization's cybersecurity weaknesses are identified and mapped to actionable security recommendations, you can start creating security tasks through the integration with Microsoft Intune where remediation tickets are created. + +You can lower down your organization's exposure from vulnerabilities and increase your security configuration by remediating the security recommendations. + +## Navigate through your remediation options +You'll see your remediation options when you select one of the security recommendation blocks from your **Top security recommendations** widget in the dashboard. +1. From the flyout panel, you'll see the security recommendation details including your next steps. Click **Remediation options**. +2. In the **Remediation options** page, select **Open a ticket in Intune (for AAD joined devices)**. + +>[!NOTE] +>If your request involves remediating more than 10,000 machines, we will only send 10,000 machines for remediation to Intune. + +3. Select a remediation due date. +4. Add notes to give your IT administrator a context of your remediation request. For example, you can indicate urgency of the remediation request to avoid potential exposure to a recent exploit activity, or if the request is a part of compliance. + +If you want to check how the ticket shows up in Intune, see [Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP](https://docs.microsoft.com/intune/atp-manage-vulnerabilities) for details. + +## How it works + +When you submit a remediation request from Threat & Vulnerability Management, it kicks-off a remediation activity. + +It creates a security task which will be tracked in Threat & Vulnerability Management **Remediation** page, and it also creates a remediation ticket in Microsoft Intune. + +You also have the option to export all remediation activity data to CSV for records, reporting purposes, or if you want to notify your IT administration counterpart that a remediation ticket has been submitted. + +The dashboard will show that status of your top remediation activities. Click any of the entries and it will take you to the **Remediation** page. You can mark the remediation activity as completed after the IT administration team remediates the task. + +However, if the security recommendation stemmed from a false positive report, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The exceptions you've filed will also show up in the **Remediation** page, in the **Exceptions** tab. + +## Related topics +- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) +- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) +- [Exposure score](tvm-exposure-score.md) +- [Configuration score](configuration-score.md) +- [Security recommendation](tvm-security-recommendation.md) +- [Software inventory](tvm-software-inventory.md) +- [Weaknesses](tvm-weaknesses.md) +- [Scenarios](threat-and-vuln-mgt-scenarios.md) + + diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md index a866f2ef4f..cb1913abcb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md @@ -1,66 +1,92 @@ ---- -title: Security recommendation -description: The weaknesses identified in the environment are mapped to actionable security recommendations and prioritized by their impact on the organizational exposure score. -keywords: threat and vulnerability management, mdatp tvm security recommendation, cybersecurity recommendation, actionable security recommendation -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dolmont -author: DulceMontemayor -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 04/11/2019 ---- -# Security recommendation -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -The cybersecurity weaknesses identified in your organization are mapped to actionable security recommendations and prioritized by their impact on the security recommendation list. Prioritized recommendation helps shorten the mean time to mitigate or remediate vulnerabilities and drive compliance. - -Each security recommendation includes an actionable remediation recommendation which can be pushed into the IT task queue through a built-in integration with Microsoft Intune and SCCM. It is also dynamic in the sense that when the threat landscape changes, the recommendation also changes as it continuously collect information from your environment. - -## The basis of the security recommendation -Each machine in the organization is scored based on three important factors: threat, likelihood to be breached, and value, to help customers to focus on the right things at the right time. - -- Threat - Characteristics of the vulnerabilities and exploits in your organizations' devices and breach history. Based on these factors, the security recommendations shows the correponding links to active alerts, ongoing threat campaigns, and their corresponding threat analytic reports. - -- Breach likelihood - Your organization's security posture and resilience against threats - -- Business value - Your organization's assets, critical processes, and intellectual properties - - -## Navigate through your security recommendations -You can access the security recommendation from the Microsoft Defender ATP Threat & Vulnerability Management menu, dashboard, software page, and machine page, to give you the context that you need as you require it. - -There are security recommendations for application, operating system, network, accounts, and security controls. - -In a given day as a Security Administrator, you can take a look at the dashboard to see your exposure score side-by-side with your configuration score. The goal is to lower down your organization's exposure from vulnerabilities, and increase your organization's security configuration to be more resilient against cybersecurity threat attacks. The top security recommendations list can help you achieve that goal. - -The top security recommendations lists down the improvement opportunities prioritized based on the three important factors mentioned in the previous section - threat, likelihood to be breached, and value. - -You can click on each one of them and see the details, the description, the potential risk if you don't act on or remediate it, insights, how many exposed devices are associated with the security recommendation, vulnerabilities, and other threats. - -From that page, you can do any of the following depending on what you need to do: - -- Open software page - Drill down and open the software page to get more context of the software details, prevalence in the organization, weaknesses discovered, version distribution, and charts so you can see the exposure trend over time. - -- Choose from remediation options - Submit a remediation request to open a ticket in Microsoft Intune for your IT Administrator to pick up and address. - -- Choose from exception options - Submit an exception, provide justification, and set exception duration if you can't remediate the issue just yet due to specific business reasons, compensation controls, or if it is a false positive. - - -## Related topics -- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) -- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) -- [Configuration score](configuration-score.md) -- [Remediation](tvm-remediation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) +--- +title: Security recommendation +description: The weaknesses identified in the environment are mapped to actionable security recommendations and prioritized by their impact on the organizational exposure score. +keywords: threat and vulnerability management, mdatp tvm security recommendation, cybersecurity recommendation, actionable security recommendation +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.date: 04/11/2019 +--- +# Security recommendation +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +The cybersecurity weaknesses identified in your organization are mapped to actionable security recommendations and prioritized by their impact on the security recommendation list. Prioritized recommendation helps shorten the mean time to mitigate or remediate vulnerabilities and drive compliance. + +Each security recommendation includes an actionable remediation recommendation which can be pushed into the IT task queue through a built-in integration with Microsoft Intune and Microsoft System Center Configuration Manager (SCCM). It is also dynamic in the sense that when the threat landscape changes, the recommendation also changes as it continuously collect information from your environment. + +## The basis of the security recommendation +Each machine in the organization is scored based on three important factors: threat, likelihood to be breached, and value, to help customers to focus on the right things at the right time. + +- Threat - Characteristics of the vulnerabilities and exploits in your organizations' devices and breach history. Based on these factors, the security recommendations shows the corresponding links to active alerts, ongoing threat campaigns, and their corresponding threat analytic reports. + +- Breach likelihood - Your organization's security posture and resilience against threats + +- Business value - Your organization's assets, critical processes, and intellectual properties + + +## Navigate through your security recommendations + +You can access the security recommendation from the Microsoft Defender ATP Threat & Vulnerability Management menu, dashboard, software page, and machine page, to give you the context that you need, as you require it. + +There are security recommendations for application, operating system, network, accounts, and security controls. + +In a given day as a Security Administrator, you can take a look at the dashboard to see your exposure score side-by-side with your configuration score. The goal is to lower down your organization's exposure from vulnerabilities, and increase your organization's security configuration to be more resilient against cybersecurity threat attacks. The top security recommendations list can help you achieve that goal. + +The top security recommendations lists down the improvement opportunities prioritized based on the three important factors mentioned in the previous section - threat, likelihood to be breached, and value. + +You can click on each one of them and see the details, the description, the potential risk if you don't act on or remediate it, insights, how many exposed devices are associated with the security recommendation, vulnerabilities, and other threats. + +From that page, you can do any of the following depending on what you need to do: + +- Open software page - Drill down and open the software page to get more context of the software details, prevalence in the organization, weaknesses discovered, version distribution, and charts so you can see the exposure trend over time. + +- Choose from remediation options - Submit a remediation request to open a ticket in Microsoft Intune for your IT Administrator to pick up and address. + +- Choose from exception options - Submit an exception, provide justification, and set exception duration if you can't remediate the issue just yet due to specific business reasons, compensation controls, or if it is a false positive. + +## Report inaccuracy + +You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated security recommendation information in the machine page. + +1. Select the **Security recommendation** tab. + +2. Click **:** beside the security recommendation that you want to report about, then select **Report inaccuracy**. +![Screenshot of Report inaccuracy control from the machine page under the Security recommendation column](images/tvm_report_inaccuracy.png) +
                        A flyout pane opens.
                        +![Screenshot of Report inaccuracy flyout pane](images/tvm_report_inaccuracyflyout.png) + +3. From the flyout pane, select the inaccuracy category from the drop-down menu. +
                        ![Screenshot of Report inaccuracy categories drop-down menu](images/tvm_report_inaccuracyoptions.png)
                        + +4. Include your email address so Microsoft can send you feedback regarding the inaccuracy you reported. + +5. Include your machine name for investigation context. + +>[!NOTE] +> You can also provide details regarding the inaccuracy you reported in the **Tell us more (optional)** field to give the threat and vulnerability management investigators context. + +6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context. + + + + +## Related topics +- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) +- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) +- [Exposure score](tvm-exposure-score.md) +- [Configuration score](configuration-score.md) +- [Remediation](tvm-remediation.md) +- [Software inventory](tvm-software-inventory.md) +- [Weaknesses](tvm-weaknesses.md) +- [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md index 6954b3f5d6..a7ff6812ce 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md @@ -1,44 +1,68 @@ ---- -title: Software inventory -description: Microsoft Defender ATP Threat & Vulnerability management's discovery capability shows in the software inventory page. You can see the name of the product, vendor, the latest version it is in, and the number of weaknesses and vulnerabilities detected. -keywords: microsoft defender atp, microsoft defender atp software inventory, mdatp threat & vulnerability management, mdatp threat & vulnerability management software inventory, mdatp tvm software inventory, tvm software inventory -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dolmont -author: DulceMontemayor -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 04/11/2019 ---- -# Software inventory -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Microsoft Defender ATP Threat & Vulnerability management's discovery capability shows in the **Software inventory** page. The software inventory includes the name of the product or vendor, the latest version it is in, and the number of weaknesses and vulnerabilities detected with it. - -## Navigate through your software inventory -1. Select **Software inventory** from the Threat & Vulnerability management navigation menu. -2. In the **Software inventory** page, select the application that you want to investigate and a flyout panel opens up with the software details, vendor information, prevalence in the organization, exposed machines, threat context, and its impact to your organization's exposure score. -3. In the flyout panel, select **Open software page** to dive deeper into your software inventory. You will see how many weaknesses are discovered with the application, devices exposed, installed machines, version distribution, and the corresponding security recommendations for the weaknesses and vulnerabilities identified. - -## How it works -In the field of discovery, we are leveraging the same set of signals in Microsoft Defender ATP's endpoint detection and response that's responsible for detection, for vulnerability assessment. - -Since it is real-time, in a matter of minutes, you will see vulnerability information as they get discovered. The engine automatically grabs information from multiple security feeds. In fact, you'll will see if a particular application is connected to a live campaign. It also provides a link to a Threat Analytics report soon as it's available. - -## Related topics -- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) -- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) -- [Configuration score](configuration-score.md) -- [Security recommendation](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) -- [Weaknesses](tvm-weaknesses.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) +--- +title: Software inventory +description: Microsoft Defender ATP Threat & Vulnerability management's discovery capability shows in the software inventory page. You can see the name of the product, vendor, the latest version it is in, and the number of weaknesses and vulnerabilities detected. +keywords: microsoft defender atp, microsoft defender atp software inventory, mdatp threat & vulnerability management, mdatp threat & vulnerability management software inventory, mdatp tvm software inventory, tvm software inventory +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.date: 04/11/2019 +--- +# Software inventory +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +Microsoft Defender ATP Threat & Vulnerability management's discovery capability shows in the **Software inventory** page. The software inventory includes the name of the product or vendor, the latest version it is in, and the number of weaknesses and vulnerabilities detected with it. + +## Navigate through your software inventory +1. Select **Software inventory** from the Threat & Vulnerability management navigation menu. +2. In the **Software inventory** page, select the application that you want to investigate and a flyout panel opens up with the software details, vendor information, prevalence in the organization, exposed machines, threat context, and its impact to your organization's exposure score. +3. In the flyout panel, select **Open software page** to dive deeper into your software inventory. You will see how many weaknesses are discovered with the application, devices exposed, installed machines, version distribution, and the corresponding security recommendations for the weaknesses and vulnerabilities identified. + +## How it works +In the field of discovery, we are leveraging the same set of signals in Microsoft Defender ATP's endpoint detection and response that's responsible for detection, for vulnerability assessment. + +Since it is real-time, in a matter of minutes, you will see vulnerability information as they get discovered. The engine automatically grabs information from multiple security feeds. In fact, you'll will see if a particular application is connected to a live campaign. It also provides a link to a Threat Analytics report soon as it's available. + +## Report inaccuracy + +You can report a false positive when you see any vague, inaccurate version, incomplete, or already remediated software inventory information in the machine page. + +1. Select the **Software inventory** tab. + +2. Click **:** beside the software that you want to report about, and then select **Report inaccuracy**. +![Screenshot of Report inaccuracy control from the machine page under the Software inventory column](images/tvm_report_inaccuracy_software.png) +
                        A flyout pane opens.
                        +![Screenshot of Report inaccuracy flyout pane](images/tvm_report_inaccuracy_softwareflyout.png) + +3. From the flyout pane, select the inaccuracy category from the **Software inventory inaccuracy reason** drop-down menu. +
                        ![Screenshot of Report inaccuracy software inventory inaccuracy reason drop-down menu](images/tvm_report_inaccuracy_softwareoptions.png)
                        + +4. Include your email address so Microsoft can send you feedback regarding the inaccuracy you reported. + +5. Include your machine name for investigation context. + +>[!NOTE] +> You can also provide details regarding the inaccuracy you reported in the **Tell us more (optional)** field to give the threat and vulnerability management investigators context. + +6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context. + + +## Related topics +- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) +- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) +- [Exposure score](tvm-exposure-score.md) +- [Configuration score](configuration-score.md) +- [Security recommendation](tvm-security-recommendation.md) +- [Remediation](tvm-remediation.md) +- [Weaknesses](tvm-weaknesses.md) +- [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md index 108aef13b2..ab8bccc02c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md @@ -1,78 +1,113 @@ ---- -title: Weaknesses -description: The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization, their severity, Common Vulnerability Scoring System (CVSS) rating, its prevalence in your organization, breach, and threat insights. -keywords: mdatp threat & vulnerability management, mdatp tvm weaknesses page, finding weaknesses through tvm, tvm vulnerability list, vulnerability details in tvm -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dolmont -author: DulceMontemayor -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 04/11/2019 ---- -# Weaknesses -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Threat & Vulnerability Management leverages the same signals in Microsoft Defender ATP's endpoint protection to scan and detect vulnerabilities. - -The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization, their severity, Common Vulnerability Scoring System (CVSS) rating, its prevalence in your organization, corresponding breach, and threat insights. - -## Navigate through your organization's weaknesses page -You can see the list of vulnerabilities in three ways: - -*Vulnerabilities in global search* -1. Click the global search drop-down menu. -2. Select **Vulnerability** and key-in the Common Vulnerabilities and Exposures (CVE) ID that you are looking for, then click the search icon. The **Weaknesses** page opens with the CVE information that you are looking for. -![tvm-vuln-globalsearch](images/tvm-vuln-globalsearch.png) -3. Select the CVE and a flyout panel opens up with more information - the vulnerability description, exploits available, severity level, CVSS v3 rating, publishing and update dates. - ->[!NOTE] ->To see the rest of the vulnerabilities in the **Weaknesses** page, type CVE, then click search. - -*Weaknesses page in the menu* -1. Go to the Threat & Vulnerability Management navigation menu and select **Weaknesses** to open up the list of vulnerabilities found in your organization. -2. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates. - -*Top vulnerable software widget in the dashboard* -1. Go to the Threat & Vulnerability Management dashboard and scroll down to the **Top vulnerable software** widget. You will see the number of vulnerabilities found in each software along with threat information and a high-level view of the device exposure trend over time. -![tvm-top-vulnerable-software](images/tvm-top-vulnerable-software.png) -2. Click the software that you want to investigate and it takes you to the software page. You will the weaknesses found in your machine per severity level, in which machines are they installed, version distribution, and the corresponding security recommendation. -3. Select the **Discovered vulnerabilities** tab. -4. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates. - -## How it works -When new vulnerabilities are released, you would want know how many of your assets are exposed. You can see the list of vulnerabilities and the details in the **Weaknesses** page. - -If the **Exposed Machines** column shows 0, that means you are not infected. - -If there's a number in the **Exposed Machines**, that means you need to remediate the vulnerabilities in those machines because they put the rest of your assets and your organization at risk. - -You can also see the related alert and threat insights in the **Threat** column. - -The breach insights icons are highlighted if there are active alerts associated with the vulnerability found in your organization. -![tvm-breach-insights](images/tvm-breach-insights.png) - -The threat insights icons are highlighted if there are associated exploits in the vulnerability found in your organization. It also shows whether the threat is connected to specific campaign for which, Threat Analytics report links are provided that you can read. -![tvm-threat-insights](images/tvm-threat-insights.png) - - >[!NOTE] - > Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight ![threat insight](images/tvm_bug_icon.png) icon and possible active alert ![possible active alert](images/tvm_alert_icon.png) icon. - - -## Related topics -- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) -- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) -- [Configuration score](configuration-score.md) -- [Security recommendation](tvm-security-recommendation.md) -- [Remediation](tvm-remediation.md) -- [Software inventory](tvm-software-inventory.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) +--- +title: Weaknesses +description: The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization, their severity, Common Vulnerability Scoring System (CVSS) rating, its prevalence in your organization, breach, and threat insights. +keywords: mdatp threat & vulnerability management, mdatp tvm weaknesses page, finding weaknesses through tvm, tvm vulnerability list, vulnerability details in tvm +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dolmont +author: DulceMontemayor +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.date: 04/11/2019 +--- +# Weaknesses +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +Threat & Vulnerability Management leverages the same signals in Microsoft Defender ATP's endpoint protection to scan and detect vulnerabilities. + +The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization, their severity, Common Vulnerability Scoring System (CVSS) rating, its prevalence in your organization, corresponding breach, and threat insights. + +## Navigate through your organization's weaknesses page +You can see the list of vulnerabilities in four ways: + +*Vulnerabilities in global search* +1. Click the global search drop-down menu. +2. Select **Vulnerability** and key-in the Common Vulnerabilities and Exposures (CVE) ID that you are looking for, then click the search icon. The **Weaknesses** page opens with the CVE information that you are looking for. +![tvm-vuln-globalsearch](images/tvm-vuln-globalsearch.png) +3. Select the CVE and a flyout panel opens up with more information - the vulnerability description, exploits available, severity level, CVSS v3 rating, publishing and update dates. + +>[!NOTE] +>To see the rest of the vulnerabilities in the **Weaknesses** page, type CVE, then click search. + +*Weaknesses page in the menu* +1. Go to the Threat & Vulnerability Management navigation menu and select **Weaknesses** to open up the list of vulnerabilities found in your organization. +2. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates. + +*Top vulnerable software widget in the dashboard* +1. Go to the Threat & Vulnerability Management dashboard and scroll down to the **Top vulnerable software** widget. You will see the number of vulnerabilities found in each software along with threat information and a high-level view of the device exposure trend over time. +![tvm-top-vulnerable-software](images/tvm-top-vulnerable-software.png) +2. Click the software that you want to investigate and it takes you to the software page. You will the weaknesses found in your machine per severity level, in which machines are they installed, version distribution, and the corresponding security recommendation. +3. Select the **Discovered vulnerabilities** tab. +4. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates. + +*Discovered vulnerabilities in the machine page* +1. Go to the left-hand navigation menu bar, then select the machine icon. The **Machines list** page opens. +
                        ![Screenshot of Machines list page](images/tvm_machineslist.png)
                        +2. In the **Machines list** page, select the machine that you want to investigate. +
                        ![Screenshot of machine list with selected machine to investigate](images/tvm_machinetoinvestigate.png)
                        +
                        A flyout pane opens with machine details and response action options.
                        +![Screenshot of the flyout pane with machine details and response options](images/tvm_machine_page_flyout.png) +3. In the flyout pane, select **Open machine page**. A page opens with details and response options for the machine you want to investigate. +
                        ![Screenshot of the machine page with details and response options](images/tvm_machines_discoveredvuln.png)
                        +4. Select **Discovered vulnerabilities**. +5. Select the vulnerability that you want to investigate to open up a flyout panel with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates. + +## How it works +When new vulnerabilities are released, you would want know how many of your assets are exposed. You can see the list of vulnerabilities and the details in the **Weaknesses** page. + +If the **Exposed Machines** column shows 0, that means you are not infected. + +If there's a number in the **Exposed Machines**, that means you need to remediate the vulnerabilities in those machines because they put the rest of your assets and your organization at risk. + +You can also see the related alert and threat insights in the **Threat** column. + +The breach insights icons are highlighted if there are active alerts associated with the vulnerability found in your organization. +![tvm-breach-insights](images/tvm-breach-insights.png) + +The threat insights icons are highlighted if there are associated exploits in the vulnerability found in your organization. It also shows whether the threat is connected to specific campaign for which, Threat Analytics report links are provided that you can read. +![tvm-threat-insights](images/tvm-threat-insights.png) + + >[!NOTE] + > Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight ![threat insight](images/tvm_bug_icon.png) icon and possible active alert ![possible active alert](images/tvm_alert_icon.png) icon. + +## Report inaccuracy + +You can report a false positive when you see any vague, inaccurate, missing, or already remediated vulnerability information in the machine page. + +1. Select the **Discovered vulnerabilities** tab. + +2. Click **:** beside the vulnerability that you want to report about, and then select **Report inaccuracy**. +![Screenshot of Report inaccuracy control from the machine page in the Discovered vulnerabilities tab](images/tvm_report_inaccuracy_vuln.png) +
                        A flyout pane opens.
                        +![Screenshot of Report inaccuracy flyout pane](images/tvm_report_inaccuracy_vulnflyout.png) + +3. From the flyout pane, select the inaccuracy category from the **Discovered vulnerability inaccuracy reason** drop-down menu. +
                        ![Screenshot of discovered vulnerability inaccuracy reason drop-down menu](images/tvm_report_inaccuracy_vulnoptions.png)
                        + +4. Include your email address so Microsoft can send you feedback regarding the inaccuracy you reported. + +5. Include your machine name for investigation context. + +>[!NOTE] +> You can also provide details regarding the inaccuracy you reported in the **Tell us more (optional)** field to give the threat and vulnerability management investigators context. + +6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context. + + +## Related topics +- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) +- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) +- [Exposure score](tvm-exposure-score.md) +- [Configuration score](configuration-score.md) +- [Security recommendation](tvm-security-recommendation.md) +- [Remediation](tvm-remediation.md) +- [Software inventory](tvm-software-inventory.md) +- [Scenarios](threat-and-vuln-mgt-scenarios.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/update-alert.md b/windows/security/threat-protection/microsoft-defender-atp/update-alert.md index ca069f5c81..8d6c69ea8d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/update-alert.md +++ b/windows/security/threat-protection/microsoft-defender-atp/update-alert.md @@ -51,7 +51,7 @@ Content-Type | String | application/json. **Required**. ## Request body -In the request body, supply the values for the relevant fields that should be updated.Existing properties that are not included in the request body will maintain their previous values or be recalculated based on changes to other property values. For best performance you shouldn't include existing values that haven't change. +In the request body, supply the values for the relevant fields that should be updated. Existing properties that are not included in the request body will maintain their previous values or be recalculated based on changes to other property values. For best performance you shouldn't include existing values that haven't change. Property | Type | Description :---|:---|:--- @@ -60,6 +60,7 @@ assignedTo | String | Owner of the alert classification | String | Specifies the specification of the alert. The property values are: 'Unknown', 'FalsePositive', 'TruePositive'. determination | String | Specifies the determination of the alert. The property values are: 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other' +[!include[Improve request performance](improve-request-performance.md)] ## Response If successful, this method returns 200 OK, and the [alert](alerts.md) entity in the response body with the updated properties. If alert with the specified id was not found - 404 Not Found. @@ -71,8 +72,6 @@ If successful, this method returns 200 OK, and the [alert](alerts.md) entity in Here is an example of the request. -[!include[Improve request performance](improve-request-performance.md)] - ``` PATCH https://api.securitycenter.windows.com/api/alerts/121688558380765161_2136280442 Content-Type: application/json diff --git a/windows/security/threat-protection/microsoft-defender-atp/use-apis.md b/windows/security/threat-protection/microsoft-defender-atp/use-apis.md deleted file mode 100644 index 12a8e4cc4e..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/use-apis.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Microsoft Defender ATP APIs -ms.reviewer: -description: Use the exposed data and actions using a set of progammatic APIs that are part of the Microsoft Intelligence Security Graph. -keywords: apis, api, wdatp, open api, windows defender atp api, public api, alerts, machine, user, domain, ip, file -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -search.appverid: met150 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: ellevin -author: levinec -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual ---- - -# Microsoft Defender ATP APIs - -**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) - -## In this section -Topic | Description -:---|:--- -[Microsoft Defender ATP API overview](apis-intro.md) | Learn how to access Microsoft Defender ATP APIs. -[Supported Microsoft Defender ATP APIs](exposed-apis-list.md) | Learn more about how you can run API calls to individual supported entities, and details such as HTTP request values, request headers and expected responses. Examples include APIs for [alert resource type](alerts.md), [domain related alerts](get-domain-related-alerts.md), or even actions such as [isolate machine](isolate-machine.md). -How to use APIs - Samples | Learn how to use Advanced hunting APIs and multiple APIs such as PowerShell. Other examples include [schedule advanced hunting using Microsoft Flow](run-advanced-query-sample-ms-flow.md) or [OData queries](exposed-apis-odata-samples.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/use-custom-ti.md b/windows/security/threat-protection/microsoft-defender-atp/use-custom-ti.md index 9452c634c4..86e1ee7a44 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/use-custom-ti.md +++ b/windows/security/threat-protection/microsoft-defender-atp/use-custom-ti.md @@ -26,7 +26,7 @@ ms.date: 04/24/2018 > [!TIP] > This topic has been deprecated. See [Indicators](ti-indicator.md) for the updated content. > -> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-customti-abovefoldlink) +> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-customti-abovefoldlink) Understand threat intelligence concepts, then enable the custom threat intelligence application so that you can proceed to create custom threat intelligence alerts that are specific to your organization. diff --git a/windows/security/threat-protection/microsoft-defender-atp/use.md b/windows/security/threat-protection/microsoft-defender-atp/use.md index 5b80236d1c..f8b5c0061c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/use.md +++ b/windows/security/threat-protection/microsoft-defender-atp/use.md @@ -23,7 +23,7 @@ ms.topic: conceptual - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-usewdatp-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-usewdatp-abovefoldlink) Microsoft Defender Security Center is the portal where you can access Microsoft Defender Advanced Threat Protection capabilities. diff --git a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md index f78005ca01..1e1f628b6b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/user-roles.md +++ b/windows/security/threat-protection/microsoft-defender-atp/user-roles.md @@ -23,7 +23,7 @@ ms.topic: article - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-roles-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-roles-abovefoldlink) ## Create roles and assign the role to an Azure Active Directory group The following steps guide you on how to create roles in Microsoft Defender Security Center. It assumes that you have already created Azure Active Directory user groups. @@ -34,31 +34,31 @@ The following steps guide you on how to create roles in Microsoft Defender Secur 3. Enter the role name, description, and permissions you'd like to assign to the role. - - **Role name** - - **Description** - - **Permissions** - - **View data** - Users can view information in the portal. - - **Alerts investigation** - Users can manage alerts, initiate automated investigations, collect investigation packages, manage machine tags, and export machine timeline. - - **Active remediation actions** - Users can take response actions and approve or dismiss pending remediation actions. - - **Manage portal system settings** - Users can configure storage settings, SIEM and threat intel API settings (applies globally), advanced settings, automated file uploads, roles and machine groups. - - >[!NOTE] - >This setting is only available in the Microsoft Defender ATP administrator (default) role. + - **Role name** + - **Description** + - **Permissions** + - **View data** - Users can view information in the portal. + - **Alerts investigation** - Users can manage alerts, initiate automated investigations, collect investigation packages, manage machine tags, and export machine timeline. + - **Active remediation actions** - Users can take response actions and approve or dismiss pending remediation actions. + - **Manage portal system settings** - Users can configure storage settings, SIEM and threat intel API settings (applies globally), advanced settings, automated file uploads, roles and machine groups. - - **Manage security settings** - Users can configure alert suppression settings, manage allowed/blocked lists for automation, create and manage custom detections, manage folder exclusions for automation, onboard and offboard machines, and manage email notifications. + > [!NOTE] + > This setting is only available in the Microsoft Defender ATP administrator (default) role. - - **Live response capabilities** - Users can take basic or advanced live response commands.
                        - - Basic commands allow users to: - - Start a live response session - - Run read only live response commands on a remote machine - - Advanced commands allow users to: - - Run basic actions - - Download a file from the remote machine - - View a script from the files library - - Run a script on the remote machine from the files library take read and write commands. - - For more information on the available commands, see [Investigate machines using Live response](live-response.md). - + - **Manage security settings** - Users can configure alert suppression settings, manage allowed/blocked lists for automation, create and manage custom detections, manage folder exclusions for automation, onboard and offboard machines, and manage email notifications. + + - **Live response capabilities** - Users can take basic or advanced live response commands. + - Basic commands allow users to: + - Start a live response session + - Run read only live response commands on a remote machine + - Advanced commands allow users to: + - Run basic actions + - Download a file from the remote machine + - View a script from the files library + - Run a script on the remote machine from the files library take read and write commands. + + For more information on the available commands, see [Investigate machines using Live response](live-response.md). + 4. Click **Next** to assign the role to an Azure AD group. 5. Use the filter to select the Azure AD group that you'd like to add to this role. diff --git a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md index 994b79b7b6..f8f068cd50 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md @@ -28,6 +28,16 @@ The following features are generally available (GA) in the latest release of Mic For more information preview features, see [Preview features](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection). + +## September 2019 +- [Live response](live-response.md)
                        Get instantaneous access to a machine using a remote shell connection. Do in-depth investigative work and take immediate response actions to promptly contain identified threats - real-time. + +- [Evaluation lab](evaluation-lab.md)
                        The Microsoft Defender ATP evaluation lab is designed to eliminate the complexities of machine and environment configuration so that you can + focus on evaluating the capabilities of the platform, running simulations, and seeing the prevention, detection, and remediation features in action. + +- [Windows Server 2008 R2 SP1](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints#windows-server-2008-r2-sp1--windows-server-2012-r2-and-windows-server-2016)
                        You can now onboard Windows Server 2008 R2 SP1. + + ## June 2019 - [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
                        A new built-in capability that uses a risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations. @@ -50,7 +60,7 @@ For more information preview features, see [Preview features](https://docs.micro ## April 2019 - [Microsoft Threat Experts Targeted Attack Notification capability](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts#targeted-attack-notification)
                        Microsoft Threat Experts' Targeted Attack Notification alerts are tailored to organizations to provide as much information as can be quickly delivered thus bringing attention to critical threats in their network, including the timeline, scope of breach, and the methods of intrusion. -- [Microsoft Defender ATP API](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use-apis)
                        Microsoft Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Microsoft Defender ATP capabilities. +- [Microsoft Defender ATP API](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/apis-intro)
                        Microsoft Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Microsoft Defender ATP capabilities. @@ -79,8 +89,8 @@ For more information preview features, see [Preview features](https://docs.micro Threat Analytics is a set of interactive reports published by the Microsoft Defender ATP research team as soon as emerging threats and outbreaks are identified. The reports help security operations teams assess impact on their environment and provides recommended actions to contain, increase organizational resilience, and prevent specific threats. - New in Windows 10 version 1809, there are two new attack surface reduction rules: - - Block Adobe Reader from creating child processes - - Block Office communication application from creating child processes. + - Block Adobe Reader from creating child processes + - Block Office communication application from creating child processes. - [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) - Antimalware Scan Interface (AMSI) was extended to cover Office VBA macros as well. [Office VBA + AMSI: Parting the veil on malicious macros](https://cloudblogs.microsoft.com/microsoftsecure/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/). @@ -95,8 +105,8 @@ Query data using Advanced hunting in Microsoft Defender ATP. - [Attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)
                        New attack surface reduction rules: - - Use advanced protection against ransomware - - Block credential stealing from the Windows local security authority subsystem (lsass.exe) + - Use advanced protection against ransomware + - Block credential stealing from the Windows local security authority subsystem (lsass.exe) - Block process creations originating from PSExec and WMI commands - Block untrusted and unsigned processes that run from USB - Block executable content from email client and webmail diff --git a/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md b/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md index 00ba76594e..a9b824cade 100644 --- a/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md +++ b/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md @@ -1,8 +1,6 @@ -ms.date: 04/19/2017 -ms.reviewer: -manager: dansimp -ms.author: dolmont --- +manager: dansimp +ms.author: dansimp title: Override Process Mitigation Options to help enforce app-related security policies (Windows 10) description: How to use Group Policy to override individual Process Mitigation Options settings and to help enforce specific app-related security policies. keywords: Process Mitigation Options, Mitigation Options, Group Policy Mitigation Options @@ -10,7 +8,6 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.pagetype: security ms.sitesec: library - author: dulcemontemayor ms.localizationpriority: medium --- diff --git a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md index 3168a333af..25342b7cce 100644 --- a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md +++ b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md @@ -1,6 +1,6 @@ --- title: Mitigate threats by using Windows 10 security features (Windows 10) -description: This topic provides an overview of software and firmware threats faced in the current security landscape, and the mitigations that Windows 10 offers in response to these threats. +description: This topic provides an overview of software and firmware threats faced in the current security landscape, and the mitigations that Windows 10 offers in response to these threats. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -10,7 +10,7 @@ author: dulcemontemayor ms.date: 10/13/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- # Mitigate threats by using Windows 10 security features @@ -106,7 +106,7 @@ Windows Defender Antivirus in Windows 10 uses a multi-pronged approach to improv For more information, see [Windows Defender in Windows 10](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) and [Windows Defender Overview for Windows Server](https://technet.microsoft.com/windows-server-docs/security/windows-defender/windows-defender-overview-windows-server). -For information about Microsoft Defender Advanced Threat Protection, a service that helps enterprises to detect, investigate, and respond to advanced and targeted attacks on their networks, see [Microsoft Defender Advanced Threat Protection (ATP)](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp) (resources) and [Microsoft Defender Advanced Threat Protection (ATP)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) (documentation). +For information about Microsoft Defender Advanced Threat Protection, a service that helps enterprises to detect, investigate, and respond to advanced and targeted attacks on their networks, see [Microsoft Defender Advanced Threat Protection (ATP)](https://www.microsoft.com/WindowsForBusiness/windows-atp) (resources) and [Microsoft Defender Advanced Threat Protection (ATP)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) (documentation). ### Data Execution Prevention @@ -450,10 +450,10 @@ Microsoft Consulting Services (MCS) and Microsoft Support/Premier Field Engineer ## Related topics - [Security and Assurance in Windows Server 2016](https://technet.microsoft.com/windows-server-docs/security/security-and-assurance) -- [Microsoft Defender Advanced Threat Protection (ATP) - resources](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp) +- [Microsoft Defender Advanced Threat Protection (ATP) - resources](https://www.microsoft.com/WindowsForBusiness/windows-atp) - [Microsoft Defender Advanced Threat Protection (ATP) - documentation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) - [Exchange Online Advanced Threat Protection Service Description](https://technet.microsoft.com/library/exchange-online-advanced-threat-protection-service-description.aspx) - [Office 365 Advanced Threat Protection](https://products.office.com/en-us/exchange/online-email-threat-protection) -- [Microsoft Malware Protection Center](https://www.microsoft.com/en-us/security/portal/mmpc/default.aspx) +- [Microsoft Malware Protection Center](https://www.microsoft.com/security/portal/mmpc/default.aspx) diff --git a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index a0f5a549a6..1f3bb33e56 100644 --- a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -4,14 +4,13 @@ description: This article details an end-to-end solution that helps you protect ms.assetid: 45DB1C41-C35D-43C9-A274-3AD5F31FE873 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp keywords: security, BYOD, malware, device health attestation, mobile ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, devices author: dulcemontemayor - ms.date: 10/13/2017 ms.localizationpriority: medium --- diff --git a/windows/security/threat-protection/security-compliance-toolkit-10.md b/windows/security/threat-protection/security-compliance-toolkit-10.md index c2c3f86318..8ce51363fd 100644 --- a/windows/security/threat-protection/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/security-compliance-toolkit-10.md @@ -5,7 +5,7 @@ keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium -ms.author: dolmont +ms.author: dansimp author: dulcemontemayor manager: dansimp audience: ITPro @@ -49,7 +49,7 @@ The Security Compliance Toolkit consists of: - Local Group Policy Object (LGPO) tool -You can [download the tools](https://www.microsoft.com/download/details.aspx?id=55319) along with the baselines for the relevant Windows versions. For more details about security baseline recommendations, see the [Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/). +You can [download the tools](https://www.microsoft.com/download/details.aspx?id=55319) along with the baselines for the relevant Windows versions. For more details about security baseline recommendations, see the [Microsoft Security Guidance blog](https://techcommunity.microsoft.com/t5/Microsoft-Security-Baselines/bg-p/Microsoft-Security-Baselines). ## What is the Policy Analyzer tool? diff --git a/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md b/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md index 4fcca719b6..ef5a46869a 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md +++ b/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md @@ -102,7 +102,7 @@ If the [Audit Kernel Object](../auditing/audit-kernel-object.md) setting is conf | 565 | Access was granted to an already existing object type. | | 567 | A permission associated with a handle was used.
                        **Note:** A handle is created with certain granted permissions (Read, Write, and so on). When the handle is used, up to one audit is generated for each of the permissions that was used. | | 569 | The resource manager in Authorization Manager attempted to create a client context. | -| 570 | A client attempted to access an object.
                        **Note: ** An event will be generated for every attempted operation on the object. | +| 570 | A client attempted to access an object.
                        **Note:** An event will be generated for every attempted operation on the object. | ## Security considerations diff --git a/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md b/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md index a485a13590..af394cc02a 100644 --- a/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md +++ b/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md @@ -22,7 +22,7 @@ ms.date: 04/19/2017 **Applies to** - Windows 10 ->Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). +>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). Describes the best practices, location, values, policy management, and security considerations for the **Bypass traverse checking** security policy setting. diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md b/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md index b4f0324679..3aa61ca9b4 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md @@ -76,7 +76,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -By default, the domain members submit a password change every 30 days. If you increase this interval significantly, or set it to 0 so that the computers no longer submit a password change, an attacker has more time to undertake a brute-force attack to guess the password of one or more computer accounts. +By default, the domain members submit a password change every 30 days. If you increase this interval significantly so that the computers no longer submit a password change, an attacker has more time to undertake a brute-force attack to guess the password of one or more computer accounts. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md index 00c2b3a1a2..2e2b5f172a 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md @@ -74,7 +74,7 @@ The longer a password exists, the higher the likelihood that it will be compromi ### Considerations -Mandated password changes are a long-standing security practice, but current research strongly indicates that password expiration has a negative effect. See [Microsoft Password Guidance](https://www.microsoft.com/en-us/research/publication/password-guidance/) for further information. +Mandated password changes are a long-standing security practice, but current research strongly indicates that password expiration has a negative effect. See [Microsoft Password Guidance](https://www.microsoft.com/research/publication/password-guidance/) for further information. Configure the **Maximum password age** policy setting to a value that is suitable for your organization's business requirements. For example, many organisations have compliance or insurance mandates requiring a short lifespan on passwords. Where such a requirement exists, the **Maximum password age** policy setting can be used to meet business requirements. diff --git a/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md b/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md index 8a376e6b4f..d3d0816760 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md @@ -35,14 +35,13 @@ The following table lists and explains the allowed encryption types. | Encryption type | Description and version support | | - | - | -| DES_CBC_CRC | Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function
                        Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10 and Windows Server 2008 R2 operating systems do not support DES| by default. +| DES_CBC_CRC | Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function
                        Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10 and Windows Server 2008 R2 operating systems do not support DES by default. | | DES_CBC_MD5| Data Encryption Standard with Cipher Block Chaining using the Message-Digest algorithm 5 checksum function
                        Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10 and Windows Server 2008 R2 operating systems do not support DES by default. | | RC4_HMAC_MD5| Rivest Cipher 4 with Hashed Message Authentication Code using the Message-Digest algorithm 5 checksum function
                        Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, Windows 10 and Windows Server 2008 R2.| | AES128_HMAC_SHA1| Advanced Encryption Standard in 128 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).
                        Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, Windows 10 and Windows Server 2008 R2. | | AES256_HMAC_SHA1| Advanced Encryption Standard in 256 bit cipher block with Hashed Message Authentication Code using the Secure Hash Algorithm (1).
                        Not supported in Windows 2000 Server, Windows XP, or Windows Server 2003. Supported in Windows Vista, Windows Server 2008, Windows 7, Windows 10 and Windows Server 2008 R2. | | Future encryption types| Reserved by Microsoft for additional encryption types that might be implemented.| -  - + ### Possible values diff --git a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md index 9bcc029641..4b653cf263 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md @@ -65,7 +65,7 @@ This section describes features and tools that are available to help you manage None. Changes to this policy become effective without a device restart when they are saved locally or distributed through Group Policy. -### Policy dependencies +### Policy dependencies The settings for this security policy are dependent on the [Network security: LAN Manager authentication level](network-security-lan-manager-authentication-level.md) setting value. diff --git a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md index 44a4ae63d3..51ff05189a 100644 --- a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md +++ b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md @@ -4,7 +4,7 @@ description: Learn about an approach to collect events from devices in your orga ms.assetid: 733263E5-7FD1-45D2-914A-184B9E3E6A3F ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -413,7 +413,7 @@ Here are the minimum steps for WEF to operate: ## Appendix E – Annotated baseline subscription event query -``` syntax +```xml @@ -578,8 +578,7 @@ Here are the minimum steps for WEF to operate: ## Appendix F – Annotated Suspect Subscription Event Query -``` syntax - +```xml diff --git a/windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md b/windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md index 8ab757be7a..0d3be5701f 100644 --- a/windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md +++ b/windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md @@ -12,10 +12,10 @@ author: dulcemontemayor ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp --- -# WannaCrypt ransomware worm targets out-of-date systems +# WannaCrypt ransomware worm targets out-of-date systems On May 12, 2017 we detected a new ransomware that spreads like a worm by leveraging vulnerabilities that have been previously fixed. While security updates are automatically applied in most computers, some users and enterprises may delay deployment of patches. Unfortunately, the ransomware, known as [WannaCrypt](https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/WannaCrypt), appears to have affected computers that have not applied the patch for these vulnerabilities. While the attack is unfolding, we remind users to install [MS17-010](https://technet.microsoft.com/library/security/ms17-010.aspx) if they have not already done so. @@ -182,7 +182,7 @@ When it successfully infects a vulnerable computer, the malware runs kernel-leve ## Protection against the WannaCrypt attack -To get the latest protection from Microsoft, upgrade to [Windows 10](https://www.microsoft.com/en-us/windows/windows-10-upgrade). Keeping your computers [up-to-date](https://www.microsoft.com/en-us/security/portal/mmpc/help/updatefaqs.aspx) gives you the benefits of the latest features and proactive mitigations built into the latest versions of Windows. +To get the latest protection from Microsoft, upgrade to [Windows 10](https://www.microsoft.com/windows/windows-10-upgrade). Keeping your computers [up-to-date](https://www.microsoft.com/security/portal/mmpc/help/updatefaqs.aspx) gives you the benefits of the latest features and proactive mitigations built into the latest versions of Windows. We recommend customers that have not yet installed the security update [MS17-010](https://technet.microsoft.com/library/security/ms17-010.aspx) do so as soon as possible. Until you can apply the patch, we also recommend two possible workarounds to reduce the attack surface: @@ -195,7 +195,7 @@ For enterprises, use [Device Guard](https://technet.microsoft.com/itpro/windows/ Use [Office 365 Advanced Threat Protection](https://blogs.office.com/2015/04/08/introducing-exchange-online-advanced-threat-protection/), which has machine learning capability that blocks dangerous email threats, such as the emails carrying ransomware. -Monitor networks with [Windows Defender Advanced Threat Protection](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp), which alerts security operations teams about suspicious activities. Download this playbook to see how you can leverage Windows Defender ATP to detect, investigate, and mitigate ransomware in networks: [Windows Defender Advanced Threat Protection - Ransomware response playbook](https://www.microsoft.com/en-us/download/details.aspx?id=55090). +Monitor networks with [Windows Defender Advanced Threat Protection](https://www.microsoft.com/WindowsForBusiness/windows-atp), which alerts security operations teams about suspicious activities. Download this playbook to see how you can leverage Windows Defender ATP to detect, investigate, and mitigate ransomware in networks: [Windows Defender Advanced Threat Protection - Ransomware response playbook](https://www.microsoft.com/download/details.aspx?id=55090). ## Resources @@ -207,7 +207,7 @@ MS17-010 Security Update: [https://technet.microsoft.com/library/security/ms17-0 Customer guidance for WannaCrypt attacks: [https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/](https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/) -General information on ransomware: [https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx](https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx) +General information on ransomware: [https://www.microsoft.com/security/portal/mmpc/shared/ransomware.aspx](https://www.microsoft.com/security/portal/mmpc/shared/ransomware.aspx) ## Indicators of compromise diff --git a/windows/security/threat-protection/windows-10-mobile-security-guide.md b/windows/security/threat-protection/windows-10-mobile-security-guide.md index a9991a6eef..eede2665f7 100644 --- a/windows/security/threat-protection/windows-10-mobile-security-guide.md +++ b/windows/security/threat-protection/windows-10-mobile-security-guide.md @@ -4,7 +4,7 @@ description: This guide provides a detailed description of the most important se ms.assetid: D51EF508-699E-4A68-A7CD-91D821A97205 ms.reviewer: manager: dansimp -ms.author: dolmont +ms.author: dansimp keywords: data protection, encryption, malware resistance, smartphone, device, Microsoft Store ms.prod: w10 ms.mktglfcycl: manage @@ -22,16 +22,16 @@ ms.date: 10/13/2017 Smartphones now serve as a primary productivity tool for business workers and, just like desktops or laptops, need to be secured against malware and data theft. Protecting these devices can be challenging due to the wide range of device operating systems and configurations and the fact that many employees use their own personal devices. IT needs to secure corporate assets on every device, but also ensure the privacy of the user’s personal apps and data. Windows 10 Mobile addresses these security concerns directly, whether workers are using personal or corporate-owned devices. It uses the same security technologies as the Windows 10 operating system to help protect against known and emerging security threats across the spectrum of attack vectors. These technologies include: -- **Windows Hello for Business** Enhanced identity and access control features ensure that only authorized users can access corporate data and resources. Windows Hello simplifies multifactor authentication (MFA) deployment and use, offering PIN, companion device, and biometric authentication methods. -- **Windows Information Protection** Automatic data separation keeps corporate information from being shared with personal data and apps. -- **Malware resistance** Multi-layered protections built into the device hardware, startup processes, and app platform help reduce the threat of malware that can compromise employee devices. +- **Windows Hello for Business** Enhanced identity and access control features ensure that only authorized users can access corporate data and resources. Windows Hello simplifies multifactor authentication (MFA) deployment and use, offering PIN, companion device, and biometric authentication methods. +- **Windows Information Protection** Automatic data separation keeps corporate information from being shared with personal data and apps. +- **Malware resistance** Multi-layered protections built into the device hardware, startup processes, and app platform help reduce the threat of malware that can compromise employee devices. This guide helps IT administrators better understand the security features in Windows 10 Mobile, which can be used to improve protection against unauthorized access, data leakage, and malware. **In this article:** -- Windows Hello for Business -- Windows Information Protection -- Malware resistance +- Windows Hello for Business +- Windows Information Protection +- Malware resistance ## Windows Hello @@ -56,9 +56,9 @@ To compromise Windows Hello credentials, an attacker would need access to the ph Biometrics help prevent credential theft and make it easier for users to login to their devices. Users always have their biometric identity with them – there is nothing to forget, lose, or leave behind. Attackers would need to have both access to the user’s device and be able to impersonate the user’s biometric identity to gain access to corporate resources, which is far more difficult than stealing a password. Windows Hello supports three biometric sensor scenarios: -- **Facial recognition** uses special IR cameras to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major manufacturers are already shipping laptops with integrated facial-recognition technology. Both Surface Pro 4 and Surface Book support this technology. -- **Fingerprint recognition** uses a sensor to scan the user’s fingerprint. Although fingerprint readers have been available for computers running the Windows operating system for years, the detection, anti-spoofing, and recognition algorithms in Windows 10 are more advanced than in previous Windows versions. Most existing fingerprint readers (whether external to or integrated into laptops or USB keyboards) that support the Windows Biometric Framework will work with Windows Hello. -- **Iris scanning** uses cameras designed to scan the user’s iris, the colorful and highly detailed portion of the eye. Because the data must be accurate, iris scanning uses a combination of an IR light source and a high-quality camera. Microsoft Lumia 950 and 950 XL devices support this technology. +- **Facial recognition** uses special IR cameras to reliably tell the difference between a photograph or scan and a living person. Several vendors are shipping external cameras that incorporate this technology, and major manufacturers are already shipping laptops with integrated facial-recognition technology. Both Surface Pro 4 and Surface Book support this technology. +- **Fingerprint recognition** uses a sensor to scan the user’s fingerprint. Although fingerprint readers have been available for computers running the Windows operating system for years, the detection, anti-spoofing, and recognition algorithms in Windows 10 are more advanced than in previous Windows versions. Most existing fingerprint readers (whether external to or integrated into laptops or USB keyboards) that support the Windows Biometric Framework will work with Windows Hello. +- **Iris scanning** uses cameras designed to scan the user’s iris, the colorful and highly detailed portion of the eye. Because the data must be accurate, iris scanning uses a combination of an IR light source and a high-quality camera. Microsoft Lumia 950 and 950 XL devices support this technology. >Users must create an unlock PIN while they enroll a biometric gesture. The device uses this PIN as a fallback mechanism in situations where it cannot capture the biometric gesture. @@ -72,8 +72,6 @@ The biometric image collected at enrollment is converted into an algorithmic for A Windows Hello companion device enables a physical device, like a wearable, to serve as a factor for validating the user’s identity before granting them access to their credentials. For instance, when the user has physical possession of a companion device they can easily, possibly even automatically, unlock their PC and authenticate with apps and websites. This type of device can be useful for smartphones or tablets that don’t have integrated biometric sensors or for industries where users need a faster, more convenient sign-in experience, such as retail. -In some cases, the companion device for Windows Hello enables a physical device, like a phone, wearable, or other types of device to store all of the user’s credentials. Storage of the credentials on a mobile device makes it possible to use them on any supporting device, like a kiosk or family PC, and eliminates the need to enroll Windows Hello on each device. Companion devices also help enable organizations to meet regulatory requirements, such as Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS 140-2). - ### Standards-based approach The Fast Identity Online (FIDO) Alliance is a nonprofit organization that works to address the lack of interoperability among strong authentication devices and the problems users face in creating and remembering multiple user names and passwords. FIDO standards help reduce reliance on passwords to authenticate users of online services securely, allowing any business network, app, website, or cloud application to interface with a broad variety of existing and future FIDO-enabled devices and operating system platforms. @@ -87,12 +85,12 @@ Enterprises have seen huge growth in the convergence of personal and corporate d Inadvertent disclosure is rapidly becoming the biggest source of confidential data leakage as organizations allow personal devices to access corporate resources. It’s easy to imagine that an employee using work email on their personal phone could unintentionally save an attachment containing sensitive company information to personal cloud storage, which could be shared with unauthorized people. This accidental sharing of corporate data is just one example of the challenges common to using mobile devices in the workplace. To prevent this type of data leakage, most solutions require users to login with a separate username and password to a container that stores all corporate apps and data, an experience that degrades user productivity. Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data secure and personal data private. Because corporate data is always protected, users cannot inadvertently copy it or share it with unauthorized users or apps. Key features include: -- Automatically tag personal and corporate data. -- Protect data while it’s at rest on local or removable storage. -- Control which apps can access corporate data. -- Control which apps can access a virtual private network (VPN) connection. -- Prevent users from copying corporate data to public locations. -- Help ensure business data is inaccessible when the device is in a locked state. +- Automatically tag personal and corporate data. +- Protect data while it’s at rest on local or removable storage. +- Control which apps can access corporate data. +- Control which apps can access a virtual private network (VPN) connection. +- Prevent users from copying corporate data to public locations. +- Help ensure business data is inaccessible when the device is in a locked state. ### Enlightened apps @@ -101,21 +99,21 @@ Third-party data loss protection solutions usually require developers to wrap th Windows Information Protection classifies apps into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on internal policies. Corporate data will be encrypted on the managed device and attempts to copy/paste or share this information with non-corporate apps or users will fail. Unenlightened apps, when marked as corporate-managed, consider all data corporate and encrypt everything by default. When you do not want all data encrypted by default – because it would create a poor user experience – developers should consider enlightening apps by adding code and compiling them using the Windows Information Protection application programming interfaces. The most likely candidates for enlightenment are apps that: -- Don’t use common controls for saving files. -- Don’t use common controls for text boxes. -- Work on personal and enterprise data simultaneously (e.g., contact apps that display personal and enterprise data in a single view or a browser that displays personal and enterprise web pages on tabs within a single instance). +- Don’t use common controls for saving files. +- Don’t use common controls for text boxes. +- Work on personal and enterprise data simultaneously (e.g., contact apps that display personal and enterprise data in a single view or a browser that displays personal and enterprise web pages on tabs within a single instance). In many cases, most apps don’t require enlightenment for them to use Windows Information Protection. Simply adding them to the allow list is the only step you need to take. Line-of-Business (LOB) apps are a good example of where this works well because they only handle corporate data. **When is app enlightenment required?** -- **Required** - - App needs to work with both personal and enterprise data. -- **Recommended** - - App handles only corporate data, but needs to modify a file (such as a configuration file) in order to launch, uninstall itself, update etc. Without enlightenment you wouldn’t be able to properly revoke these apps. - - App needs to access enterprise data, while protection under lock is activated. -- **Not required** - - App handles only corporate data - - App handles only personal data +- **Required** + - App needs to work with both personal and enterprise data. +- **Recommended** + - App handles only corporate data, but needs to modify a file (such as a configuration file) in order to launch, uninstall itself, update etc. Without enlightenment you wouldn’t be able to properly revoke these apps. + - App needs to access enterprise data, while protection under lock is activated. +- **Not required** + - App handles only corporate data + - App handles only personal data ### Data leakage control @@ -124,10 +122,10 @@ To configure Windows Information Protection in a Mobile Device Management (MDM) Windows Information Protection works seamlessly until users try to access enterprise data with or paste enterprise data into unauthorized apps or locations on the web. For example, copying enterprise data from an authorized app to another authorized app works as usual, but Window Information Protection can block users from copying enterprise data from an authorized app to an unauthorized app. Likewise, it will block users from using an unauthorized app to open a file that contains enterprise data. The extent to which users will be prevented from copying and pasting data from authorized apps to unauthorized apps or locations on the web depends on which protection level is set: -- **Block.** Windows Information Protection blocks users from completing the operation. -- **Override.** Windows Information Protection notifies users that the operation is inappropriate but allows them to override the policy, although it logs the operation in the audit log. -- **Audit.** Windows Information Protection does not block or notify users but logs the operation in the audit log. -- **Off.** Windows Information Protection does not block or notify users and does not log operations in the audit log. +- **Block.** Windows Information Protection blocks users from completing the operation. +- **Override.** Windows Information Protection notifies users that the operation is inappropriate but allows them to override the policy, although it logs the operation in the audit log. +- **Audit.** Windows Information Protection does not block or notify users but logs the operation in the audit log. +- **Off.** Windows Information Protection does not block or notify users and does not log operations in the audit log. ### Data separation @@ -140,11 +138,11 @@ Windows Information Protection provides data separation without requiring a cont Windows 10 Mobile uses device encryption, based on BitLocker technology, to encrypt all internal storage, including operating systems and data storage partitions. The user can activate device encryption, or the IT department can activate and enforce encryption for company-managed devices through MDM tools. When device encryption is turned on, all data stored on the phone is encrypted automatically. A Windows 10 Mobile device with encryption turned on helps protect the confidentiality of data stored – even if the device is lost or stolen. The combination of Windows Hello lock and data encryption makes it extremely difficult for an unauthorized party to retrieve sensitive information from the device. You can customize how device encryption works to meet your unique security requirements. Device encryption even enables you to define your own cipher suite. For example, you can specify the algorithm and key size that Windows 10 Mobile uses for data encryption, which Transport Layer Security (TLS) cipher suites are permitted, and whether Federal Information Processing Standard (FIPS) policy is enabled. The list below shows the policies you can change to customize device encryption on Windows 10 Mobile devices. -- Cryptography - - Allow FIPS Algorithm: This policy enables or disable the FIPS policy. A restart is needed to enforce this policy. The default value is disabled. - - TLS Cipher Suite: This policy contains a list of the cryptographic cipher algorithms allowed for Secure Sockets Layer connections. -- BitLocker - - Encryption Method: Configures the BitLocker Drive Encryption Method and cipher strength. The default value is AES-CBC 128-bit. If the device cannot use the value specified, it will use another one. +- Cryptography + - Allow FIPS Algorithm: This policy enables or disable the FIPS policy. A restart is needed to enforce this policy. The default value is disabled. + - TLS Cipher Suite: This policy contains a list of the cryptographic cipher algorithms allowed for Secure Sockets Layer connections. +- BitLocker + - Encryption Method: Configures the BitLocker Drive Encryption Method and cipher strength. The default value is AES-CBC 128-bit. If the device cannot use the value specified, it will use another one. To help make the device even more secured against outside interference, Windows 10 Mobile also now includes protection-under-lock. That means that encryption keys are removed from memory whenever a device is locked. Apps are unable to access sensitive data while the device is in a locked state, so hackers and malware have no way to find and co-opt keys. Everything is locked up tight with the TPM until the user unlocks the device with Windows Hello. @@ -230,9 +228,9 @@ A Trusted Platform Module (TPM) is a tamper-resistant cryptographic module that A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, if you create a key in a TPM with the property that no one can export that key from the TPM, the key absolutely cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling a reliable report of the software used to start a platform. The following list describes key functionality that a TPM provides in Windows 10 Mobile: -- **Managing cryptographic keys.** A TPM can create, store, and permit the use of keys in defined ways. Windows 10 Mobile uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and various other keys. -- **Safeguarding and reporting integrity measurements.** Windows 10 Mobile uses the TPM to record and help protect integrity-related measurements of select hardware and Windows boot components for the Measured Boot feature. In this scenario, Measured Boot measures each component – from firmware up through the drivers – and then stores those measurements in the device’s TPM. From here, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 Mobile device. -- **Proving a TPM is really a TPM.** Managing cryptographic keys and measuring integrity are so central to protecting privacy and security that a TPM must differentiate itself from malware masquerading as a TPM. +- **Managing cryptographic keys.** A TPM can create, store, and permit the use of keys in defined ways. Windows 10 Mobile uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and various other keys. +- **Safeguarding and reporting integrity measurements.** Windows 10 Mobile uses the TPM to record and help protect integrity-related measurements of select hardware and Windows boot components for the Measured Boot feature. In this scenario, Measured Boot measures each component – from firmware up through the drivers – and then stores those measurements in the device’s TPM. From here, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 Mobile device. +- **Proving a TPM is really a TPM.** Managing cryptographic keys and measuring integrity are so central to protecting privacy and security that a TPM must differentiate itself from malware masquerading as a TPM. Windows 10 Mobile supports TPM implementations that comply with the 2.0 standard. The TPM 2.0 standard includes several improvements that make it superior to the 1.2 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. When the TPM 1.2 standard appeared in the early 2000s, the security community considered these algorithms cryptographically strong. Since then, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection, as well as the ability to plug-in algorithms that certain geographies or industries may prefer. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. @@ -241,9 +239,9 @@ Many assume that original equipment manufacturers (OEMs) must implant a TPM in h >Microsoft requires TPM 2.0 on devices running any version of Windows 10 Mobile. For more information, see [minimum hardware requirements](https://technet.microsoft.com/library/dn915086.aspx) Several Windows 10 Mobile security features require TPM: -- Virtual smart cards -- Measured Boot -- Health attestation (requires TPM 2.0 or later) +- Virtual smart cards +- Measured Boot +- Health attestation (requires TPM 2.0 or later) Still other features will use the TPM if it is available. For example, Windows Hello does not require TPM but uses it if it’s available. Organizations can configure policy to require TPM for Windows Hello. @@ -312,9 +310,9 @@ Malware depends on its ability to insert a malicious payload into memory with th The heap is a location in memory that Windows uses to store dynamic application data. Microsoft continues to improve on earlier Windows heap designs by further mitigating the risk of heap exploits that an attacker could use. Windows 10 Mobile has made several important improvements to the security of the heap over previous versions of Windows: -- Internal data structures that the heap uses are better protected against memory corruption. -- Heap memory allocations have randomized locations and sizes, making it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 10 Mobile adds a random offset to the address of a newly allocated heap, making the allocation much less predictable. -- Windows 10 Mobile uses “guard pages” before and after blocks of memory as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 Mobile responds by instantly terminating the app. +- Internal data structures that the heap uses are better protected against memory corruption. +- Heap memory allocations have randomized locations and sizes, making it more difficult for an attacker to predict the location of critical memory to overwrite. Specifically, Windows 10 Mobile adds a random offset to the address of a newly allocated heap, making the allocation much less predictable. +- Windows 10 Mobile uses “guard pages” before and after blocks of memory as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 Mobile responds by instantly terminating the app. ### Memory reservations @@ -342,9 +340,9 @@ The security policy of a specific AppContainer defines the operating system capa A set of default permissions are granted to all AppContainers, including access to a unique, isolated storage location. Access to other capabilities can be declared within the app code itself. Unlike traditional desktop applications, access to additional capabilities and privileges cannot be requested at run time. The AppContainer concept is advantageous because it provides: -- **Attack surface reduction.** Apps can access only those capabilities that are declared in the application code and needed to perform their functions. -- **User consent and control.** Capabilities that apps use are automatically published to the app details page in the Microsoft Store. App access to capabilities that may expose sensitive information automatically prompt the user to acknowledge and provide consent. -- **App isolation.** Communication between Windows apps is tightly controlled. Apps are isolated from one another and can communicate only by using predefined communication channels and data types. +- **Attack surface reduction.** Apps can access only those capabilities that are declared in the application code and needed to perform their functions. +- **User consent and control.** Capabilities that apps use are automatically published to the app details page in the Microsoft Store. App access to capabilities that may expose sensitive information automatically prompt the user to acknowledge and provide consent. +- **App isolation.** Communication between Windows apps is tightly controlled. Apps are isolated from one another and can communicate only by using predefined communication channels and data types. Apps receive the minimal privileges they need to perform their legitimate tasks. This means that even if a malicious attacker exploits an app, the potential damage is limited because the app cannot elevate its privileges and is contained within its AppContainer. Microsoft Store displays the permissions that the app requires along with the app’s age rating and publisher. @@ -355,9 +353,9 @@ The combination of Device Guard and AppContainer help to prevent unauthorized ap The web browser is a critical component of any security strategy. It is the user’s interface to the Internet, an environment teeming with malicious sites and potentially dangerous content. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. Windows 10 Mobile includes Microsoft Edge, an entirely new web browser that goes beyond browsing with features like Reading View. Microsoft Edge is more secure than previous Microsoft web browsers in several ways: -- **Microsoft Edge on Windows 10 Mobile does not support extensions.** Microsoft Edge has built-in PDF viewing capability. -- **Microsoft Edge is designed as a UWP app.** It is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps. -- **Microsoft Edge simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, fewer security settings are required. In addition, Microsoft established Microsoft Edge default settings that align with security best practices, making it more secure by design. +- **Microsoft Edge on Windows 10 Mobile does not support extensions.** Microsoft Edge has built-in PDF viewing capability. +- **Microsoft Edge is designed as a UWP app.** It is inherently compartmentalized and runs in an AppContainer that sandboxes the browser from the system, data, and other apps. +- **Microsoft Edge simplifies security configuration tasks.** Because Microsoft Edge uses a simplified application structure and a single sandbox configuration, fewer security settings are required. In addition, Microsoft established Microsoft Edge default settings that align with security best practices, making it more secure by design. ## Summary diff --git a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md index 4f08806147..e73bbfe476 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md @@ -46,18 +46,19 @@ See [Enable cloud-delivered protection](enable-cloud-protection-windows-defender After you've enabled the service, you may need to configure your network or firewall to allow connections between it and your endpoints. -As a cloud service, it is required that computers have access to the internet and that the ATP machine learning services are reachable. The following table lists the services and their associated URLs. You should ensure there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an allow rule specifically for them: +As a cloud service, it is required that computers have access to the internet and that the ATP machine learning services are reachable. The URL: "\*.blob.core.windows.net" should not be excluded from any kind of network inspection. The table below lists the services and their associated URLs. You should ensure there are no firewall or network filtering rules denying access to these URLs, or you may need to create an allow rule specifically for them (excluding the URL: "\*.blob.core.windows.net"). | **Service**| **Description** |**URL** | | :--: | :-- | :-- | -| *Windows Defender Antivirus cloud-delivered protection service, also referred to as Microsoft Active Protection Service (MAPS)*|Used by Windows Defender Antivirus to provide cloud-delivered protection|*.wdcp.microsoft.com *.wdcpalt.microsoft.com *.wd.microsoft.com| -| *Microsoft Update Service (MU)*| Security intelligence and product updates |*.update.microsoft.com| -| *Security intelligence updates Alternate Download Location (ADL)*| Alternate location for Windows Defender Antivirus Security intelligence updates if the installed Security intelligence is out of date (7 or more days behind)| *.download.microsoft.com| -| *Malware submission storage *|Upload location for files submitted to Microsoft via the Submission form or automatic sample submission | ussus1eastprod.blob.core.windows.net ussus1westprod.blob.core.windows.net usseu1northprod.blob.core.windows.net usseu1westprod.blob.core.windows.net ussuk1southprod.blob.core.windows.net ussuk1westprod.blob.core.windows.net ussas1eastprod.blob.core.windows.net ussas1southeastprod.blob.core.windows.net ussau1eastprod.blob.core.windows.net ussau1southeastprod.blob.core.windows.net | -| *Certificate Revocation List (CRL)* |Used by Windows when creating the SSL connection to MAPS for updating the CRL | http://www.microsoft.com/pkiops/crl/ http://www.microsoft.com/pkiops/certs http://crl.microsoft.com/pki/crl/products http://www.microsoft.com/pki/certs | -| *Symbol Store *|Used by Windows Defender Antivirus to restore certain critical files during remediation flows | https://msdl.microsoft.com/download/symbols | -| *Universal Telemetry Client* | Used by Windows to send client diagnostic data; Windows Defender Antivirus uses this for product quality monitoring purposes | This update uses SSL (TCP Port 443) to download manifests and upload diagnostic data to Microsoft that uses the following DNS endpoints: vortex-win.data.microsoft.com settings-win.data.microsoft.com| +| *Windows Defender Antivirus cloud-delivered protection service, also referred to as Microsoft Active Protection Service (MAPS)*|Used by Windows Defender Antivirus to provide cloud-delivered protection|\*.wdcp.microsoft.com \*.wdcpalt.microsoft.com \*.wd.microsoft.com| +| *Microsoft Update Service (MU)*| Security intelligence and product updates |\*.update.microsoft.com| +| *Security intelligence updates Alternate Download Location (ADL)*| Alternate location for Windows Defender Antivirus Security intelligence updates if the installed Security intelligence is out of date (7 or more days behind)| \*.download.microsoft.com| +| *Malware submission storage*|Upload location for files submitted to Microsoft via the Submission form or automatic sample submission | ussus1eastprod.blob.core.windows.net ussus1westprod.blob.core.windows.net usseu1northprod.blob.core.windows.net usseu1westprod.blob.core.windows.net ussuk1southprod.blob.core.windows.net ussuk1westprod.blob.core.windows.net ussas1eastprod.blob.core.windows.net ussas1southeastprod.blob.core.windows.net ussau1eastprod.blob.core.windows.net ussau1southeastprod.blob.core.windows.net | +| *Certificate Revocation List (CRL)*|Used by Windows when creating the SSL connection to MAPS for updating the CRL | http://www.microsoft.com/pkiops/crl/ http://www.microsoft.com/pkiops/certs http://crl.microsoft.com/pki/crl/products http://www.microsoft.com/pki/certs | +| *Symbol Store*|Used by Windows Defender Antivirus to restore certain critical files during remediation flows | https://msdl.microsoft.com/download/symbols | +| *Universal Telemetry Client*| Used by Windows to send client diagnostic data; Windows Defender Antivirus uses this for product quality monitoring purposes | This update uses SSL (TCP Port 443) to download manifests and upload diagnostic data to Microsoft that uses the following DNS endpoints: vortex-win.data.microsoft.com settings-win.data.microsoft.com| + ## Validate connections between your network and the cloud diff --git a/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md index 404e3d39cf..b95dce5844 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md @@ -41,7 +41,7 @@ Tool|Deployment options (2)|Management options (net Microsoft Intune|[Add endpoint protection settings in Intune](https://docs.microsoft.com/intune/endpoint-protection-configure)|[Configure device restriction settings in Intune](https://docs.microsoft.com/intune/device-restrictions-configure)| [Use the Intune console to manage devices](https://docs.microsoft.com/intune/device-management) System Center Configuration Manager ([1](#fn1))|Use the [Endpoint Protection point site system role][] and [enable Endpoint Protection with custom client settings][]|With [default and customized antimalware policies][] and [client management][]|With the default [Configuration Manager Monitoring workspace][] and [email alerts][] Group Policy and Active Directory (domain-joined)|Use a Group Policy Object to deploy configuration changes and ensure Windows Defender Antivirus is enabled.|Use Group Policy Objects (GPOs) to [Configure update options for Windows Defender Antivirus][] and [Configure Windows Defender features][]|Endpoint reporting is not available with Group Policy. You can generate a list of [Group Policies to determine if any settings or policies are not applied][] -PowerShell|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set-MpPreference][] and [Update-MpSignature] [] cmdlets available in the Defender module|Use the appropriate [Get- cmdlets available in the Defender module][] +PowerShell|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set-MpPreference] and [Update-MpSignature] cmdlets available in the Defender module.|Use the appropriate [Get- cmdlets available in the Defender module][] Windows Management Instrumentation|Deploy with Group Policy, System Center Configuration Manager, or manually on individual endpoints.|Use the [Set method of the MSFT_MpPreference class][] and the [Update method of the MSFT_MpSignature class][]|Use the [MSFT_MpComputerStatus][] class and the get method of associated classes in the [Windows Defender WMIv2 Provider][] Microsoft Azure|Deploy Microsoft Antimalware for Azure in the [Azure portal, by using Visual Studio virtual machine configuration, or using Azure PowerShell cmdlets](https://docs.microsoft.com/azure/security/azure-security-antimalware#antimalware-deployment-scenarios). You can also [Install Endpoint protection in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-install-endpoint-protection)|Configure [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](https://docs.microsoft.com/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) or [use code samples](https://gallery.technet.microsoft.com/Antimalware-For-Azure-5ce70efe)|Use [Microsoft Antimalware for Virtual Machines and Cloud Services with Azure PowerShell cmdlets](https://docs.microsoft.com/azure/security/azure-security-antimalware#enable-and-configure-antimalware-using-powershell-cmdlets) to enable monitoring. You can also review usage reports in Azure Active Directory to determine suspicious activity, including the [Possibly infected devices][] report and configure an SIEM tool to report on [Windows Defender Antivirus events][] and add that tool as an app in AAD. diff --git a/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md index b61fbe54d1..307d8fcd7d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md @@ -24,7 +24,7 @@ manager: dansimp In addition to standard on-premises or hardware configurations, you can also use Windows Defender Antivirus in a remote desktop (RDS) or virtual desktop infrastructure (VDI) environment. -See the [Microsoft Desktop virtualization site](https://www.microsoft.com/en-us/server-cloud/products/virtual-desktop-infrastructure/) for more details on Microsoft Remote Desktop Services and VDI support. +See the [Microsoft Desktop virtualization site](https://www.microsoft.com/server-cloud/products/virtual-desktop-infrastructure/) for more details on Microsoft Remote Desktop Services and VDI support. For Azure-based virtual machines, you can also review the [Install Endpoint Protection in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-install-endpoint-protection) topic. @@ -143,7 +143,7 @@ You can initiate the update manually by right-clicking on the task and clicking If you would prefer to do everything manually, this what you would need to do to replicate the script’s behavior: 1. Create a new folder on the system root called *wdav_update* to store intelligence updates, for example, create the folder *c:\wdav_update* 1. Create a subfolder under *wdav_update* with a GUID name, such as *{00000000-0000-0000-0000-000000000000}*; for example *c:\wdav_update\{00000000-0000-0000-0000-000000000000}* (note, in the script we set it so the last 12 digits of the GUID are the year, month, day, and time when the file was downloaded so that a new folder is created each time. You can change this so that the file is downloaded to the same folder each time) -1. Download a security intelligence package from https://www.microsoft.com/en-us/wdsi/definitions into the GUID folder. The file should be named *mpam-fe.exe*. +1. Download a security intelligence package from https://www.microsoft.com/wdsi/definitions into the GUID folder. The file should be named *mpam-fe.exe*. 1. Open a cmd prompt window and navigate to the GUID folder you created. Use the **/X** extraction command to extract the files, for example **mpam-fe.exe /X**. Note: The VMs will pick up the updated package whenever a new GUID folder is created with an extracted update package or whenever an existing folder is updated with a new extracted package. @@ -191,7 +191,7 @@ This setting will prevent a scan from occurring after receiving an update. You c ### Enable headless UI mode - - Double-click **Enable headless UI mode** and set the option to **Enabled**. Click **OK**. This hides the entire Windows Defender AV user interface from users. +- Double-click **Enable headless UI mode** and set the option to **Enabled**. Click **OK**. This hides the entire Windows Defender AV user interface from users. diff --git a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md index 69fc95abeb..c9aca52f0d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md @@ -42,7 +42,7 @@ There are specific network-connectivity requirements to ensure your endpoints ca 2. Select **All services > Intune**. 3. In the **Intune** pane, select **Device configuration > Profiles**, and then select the **Device restrictions** profile type you want to configure. If you haven't yet created a **Device restrictions** profile type, or if you want to create a new one, see [Configure device restriction settings in Microsoft Intune](https://docs.microsoft.com/intune/device-restrictions-configure). 4. Select **Properties**, select **Settings: Configure**, and then select **Windows Defender Antivirus**. -5. On the **Cloud-delivered protection** switch, select **Enable**. +5. On the **Cloud-delivered protection** switch, select **Not configured**. 6. In the **Prompt users before sample submission** dropdown, select **Send all data without prompting**. 7. In the **Submit samples consent** dropdown, select one of the following: diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-alert.jpg b/windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-alert.jpg new file mode 100644 index 0000000000..36da4a5988 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-alert.jpg differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-huntingquery.png b/windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-huntingquery.png new file mode 100644 index 0000000000..2e11d9e9b5 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-huntingquery.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-windowssecurityapp.png b/windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-windowssecurityapp.png new file mode 100644 index 0000000000..d0eef7ebef Binary files /dev/null and b/windows/security/threat-protection/windows-defender-antivirus/images/tampprotintune-windowssecurityapp.png differ diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md index 73f3bdc5e1..e3142e03ef 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md @@ -148,10 +148,10 @@ realTimeProtectionEnabled : true mdatp --health orgId ``` -2. Install the configuration file on a client machine: +2. Run the Python script to install the configuration file: ```bash - python WindowsDefenderATPOnboarding.py + /usr/bin/python WindowsDefenderATPOnboarding.py Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password) ``` diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md index da2a6a8dcd..21be43c179 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md @@ -166,6 +166,12 @@ Once the Intune changes are propagated to the enrolled devices, you can see them ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) +## Troubleshooting + +Issue: No license found + +Solution: Follow the steps above to create a device profile using WindowsDefenderATPOnboarding.xml + ## Logging installation issues For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) . diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index 44f2ed7150..9a52b56369 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -198,8 +198,9 @@ You can check that devices have been correctly onboarded by creating a script. F mdatp --health healthy ``` -This script returns: -- 0 if Microsoft Defender ATP is registered with the Microsoft Defender ATP service +The above command prints "1" if the product is onboarded and functioning as expected. + +If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: - 1 if the device is not yet onboarded - 3 if the connection to the daemon cannot be established—for example, if the daemon is not running diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md index 856b617100..8d22a596c8 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md @@ -35,6 +35,9 @@ This topic describes the structure of this profile (including a recommended prof The configuration profile is a .plist file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can either be simple (such as a numerical value) or complex, such as a nested list of preferences. +>[!CAUTION] +>The layout of the configuration profile depends on the management console that you are using. The following sections contain examples of configuration profiles for JAMF and Intune. + The top level of the configuration profile includes product-wide preferences and entries for subareas of the product, which are explained in more detail in the next sections. ### Antivirus engine preferences @@ -222,6 +225,8 @@ The following configuration profile will: - Enable cloud delivered protection - Enable automatic sample submission +### JAMF profile + ```XML @@ -258,10 +263,91 @@ The following configuration profile will: ``` +### Intune profile + +```XML + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + antivirusEngine + + enableRealTimeProtection + + threatTypeSettings + + + key + potentially_unwanted_application + value + block + + + key + archive_bomb + value + audit + + + + cloudService + + enabled + + automaticSampleSubmission + + + + + + +``` + ## Full configuration profile example The following configuration profile contains entries for all settings described in this document and can be used for more advanced scenarios where you want more control over the product. +### JAMF profile + ```XML @@ -329,6 +415,116 @@ The following configuration profile contains entries for all settings described ``` +### Intune profile + +```XML + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + antivirusEngine + + enableRealTimeProtection + + exclusions + + + $type + excludedPath + isDirectory + + path + /var/log/system.log + + + $type + excludedPath + isDirectory + + path + /home + + + $type + excludedFileExtension + extension + pdf + + + allowedThreats + + eicar + + threatTypeSettings + + + key + potentially_unwanted_application + value + block + + + key + archive_bomb + value + audit + + + + cloudService + + enabled + + diagnosticLevel + optional + automaticSampleSubmission + + + + + + +``` + ## Configuration profile deployment Once you've built the configuration profile for your enterprise, you can deploy it through the management console that your enterprise is using. The following sections provide instructions on how to deploy this profile using JAMF and Intune. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md index eb3359531d..7cf18820f8 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md @@ -122,6 +122,7 @@ The following fields are collected: | cloud_service.service_uri | URI used to communicate with the cloud. | | cloud_service.diagnostic_level | Diagnostic level of the device (required, optional). | | cloud_service.automatic_sample_submission | Whether automatic sample submission is turned on or not. | +| edr.early_preview | Whether the machine should run EDR early preview features. | | features.\[optional feature name\] | List of preview features, along with whether they are enabled or not. | #### Product and service performance data events @@ -148,6 +149,8 @@ Diagnostic logs are collected only with the consent of the user as part of the f - All files under */Library/Logs/Microsoft/mdatp/* - Subset of files under */Library/Application Support/Microsoft/Defender/* that are created and used by Microsoft Defender ATP for Mac - Subset of files under */Library/Managed Preferences* that are used by Microsoft Defender ATP for Mac +- /Library/Logs/Microsoft/autoupdate.log +- $HOME/Library/Preferences/com.microsoft.autoupdate2.plist ### Optional diagnostic data diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md index a39cf22ad8..e8697f63a3 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md @@ -80,21 +80,21 @@ Important tasks, such as controlling product settings and triggering on-demand s |Group |Scenario |Command | |-------------|-------------------------------------------|-----------------------------------------------------------------------| -|Configuration|Turn on/off real-time protection |`mdatp --config rtp [true/false]` | -|Configuration|Turn on/off cloud protection |`mdatp --config cloud [true/false]` | +|Configuration|Turn on/off real-time protection |`mdatp --config realTimeProtectionEnabled [true/false]` | +|Configuration|Turn on/off cloud protection |`mdatp --config cloudEnabled [true/false]` | |Configuration|Turn on/off product diagnostics |`mdatp --config diagnostic [true/false]` | -|Configuration|Turn on/off automatic sample submission |`mdatp --config sample-submission [true/false]` | +|Configuration|Turn on/off automatic sample submission |`mdatp --config cloudAutomaticSampleSubmission [true/false]` | |Configuration|Turn on PUA protection |`mdatp --threat --type-handling potentially_unwanted_application block`| |Configuration|Turn off PUA protection |`mdatp --threat --type-handling potentially_unwanted_application off` | |Configuration|Turn on audit mode for PUA protection |`mdatp --threat --type-handling potentially_unwanted_application audit`| |Diagnostics |Change the log level |`mdatp --log-level [error/warning/info/verbose]` | -|Diagnostics |Generate diagnostic logs |`mdatp --diagnostic --create` | +|Diagnostics |Generate diagnostic logs |`mdatp --diagnostic` | |Health |Check the product's health |`mdatp --health` | |Protection |Scan a path |`mdatp --scan --path [path]` | |Protection |Do a quick scan |`mdatp --scan --quick` | |Protection |Do a full scan |`mdatp --scan --full` | |Protection |Cancel an ongoing on-demand scan |`mdatp --scan --cancel` | -|Protection |Request a security intelligence update |`mdatp --definition-update` | +|Protection |Request a security intelligence update |`mdatp --definition-update` | ## Microsoft Defender ATP portal information diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md index dde9d19622..50267f26bb 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md @@ -34,7 +34,7 @@ If you decide to deploy updates by using your software distribution tools, you s ## Use msupdate -MAU includes a command line tool, called *msupdate*, that is designed for IT administrators so that they have more precise control over when updates are applied. Instructions for how to use this tool can be found in [Update Office for Mac by using msupdate](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate). +MAU includes a command-line tool, called *msupdate*, that is designed for IT administrators so that they have more precise control over when updates are applied. Instructions for how to use this tool can be found in [Update Office for Mac by using msupdate](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate). In MAU, the application identifier for Microsoft Defender ATP for Mac is *WDAV00*. To download and install the latest updates for Microsoft Defender ATP for Mac, execute the following command from a Terminal window: @@ -86,6 +86,17 @@ Change how MAU searches for updates. | **Possible values** | Manual
                        AutomaticCheck
                        AutomaticDownload | | **Comment** | Note that AutomaticDownload will do a download and install silently if possible. | +### Change whether the "Check for Updates" button is enabled + +Change whether local users will be able to click the "Check for Updates" option in the Microsoft AutoUpdate user interface. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | EnableCheckForUpdatesButton | +| **Data type** | Boolean | +| **Possible values** | True (default)
                        False | + ### Disable Insider checkbox Set to true to make the "Join the Office Insider Program..." checkbox unavailable / greyed out to users. @@ -116,6 +127,8 @@ The following configuration profile is used to: - Enable the "Check for updates" button in the user interface - Allow users on the device to enroll into the Insider channels +### JAMF + ```XML @@ -135,6 +148,68 @@ The following configuration profile is used to: ``` +### Intune + +```XML + + + + + PayloadUUID + B762FF60-6ACB-4A72-9E72-459D00C936F3 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.autoupdate2 + PayloadDisplayName + Microsoft AutoUpdate settings + PayloadDescription + Microsoft AutoUpdate configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 5A6F350A-CC2C-440B-A074-68E3F34EBAE9 + PayloadType + com.microsoft.autoupdate2 + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.autoupdate2 + PayloadDisplayName + Microsoft AutoUpdate configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + ChannelName + InsiderFast + HowToCheck + AutomaticDownload + EnableCheckForUpdatesButton + + DisableInsiderCheckbox + + SendAllTelemetryEnabled + + + + + +``` + To configure MAU, you can deploy this configuration profile from the management tool that your enterprise is using: - From JAMF, upload this configuration profile and set the Preference Domain to *com.microsoft.autoupdate2*. - From Intune, upload this configuration profile and set the custom configuration profile name to *com.microsoft.autoupdate2*. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md index b9d60523ba..8fe52e371e 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md @@ -55,7 +55,7 @@ The following table lists the services and their associated URLs that your netwo | ---------------------------------------- | ----------------------- | | Common URLs for all locations | x.cp.wd.microsoft.com
                        cdn.x.cp.wd.microsoft.com
                        eu-cdn.x.cp.wd.microsoft.com
                        wu-cdn.x.cp.wd.microsoft.com
                        *.blob.core.windows.net
                        officecdn-microsoft-com.akamaized.net | | European Union | europe.x.cp.wd.microsoft.com | -| United Kingdon | unitedkingdom.x.cp.wd.microsoft.com | +| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com | | United States | unitedstates.x.cp.wd.microsoft.com | Microsoft Defender ATP can discover a proxy server by using the following discovery methods: diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index c074504ddd..5ba3f228c0 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -1,9 +1,9 @@ --- -title: Prevent security settings changes with Tamper Protection +title: Protect security settings with Tamper Protection ms.reviewer: manager: dansimp -description: Use tamper protection to prevent malicious apps from changing important security settings. -keywords: malware, defender, antivirus, tamper protection +description: Use Tamper Protection to prevent malicious apps from changing important security settings. +keywords: malware, defender, antivirus, Tamper Protection search.product: eADQiWindows 10XVcnh ms.pagetype: security ms.prod: w10 @@ -11,48 +11,162 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp +audience: ITPro +author: denisebmsft +ms.author: deniseb --- -# Prevent security settings changes with tamper protection +# Protect security settings with Tamper Protection **Applies to:** - Windows 10 -Tamper Protection helps prevent malicious apps from changing important security settings. These settings include: +## Overview -- Real-time protection -- Cloud-delivered protection -- IOfficeAntivirus (IOAV) -- Behavior monitoring +During some kinds of cyber attacks, bad actors try to disable security features, such as anti-virus protection, on your machines. They do this to get easier access to your data, to install malware, or to otherwise exploit your data, identity, and devices. Tamper Protection helps prevent this from occurring. + +With Tamper Protection, malicious apps are prevented from taking actions like these: +- Disabling virus and threat protection +- Disabling real-time protection +- Turning off behavior monitoring +- Disabling antivirus (such as IOfficeAntivirus (IOAV)) +- Disabling cloud-delivered protection - Removing security intelligence updates -With Tamper Protection set to **On**, you can still change these settings in the Windows Security app. The following apps and methods can't change these settings: +## How it works -- Mobile device management (MDM) apps like Intune -- Enterprise configuration management apps like System Center Configuration Manager (SCCM) -- Command line instruction MpCmdRun.exe -removedefinitions -dynamicsignatures -- Windows System Image Manager (Windows SIM) settings DisableAntiSpyware and DisableAntiMalware (used in Windows unattended setup) -- Group Policy -- Other Windows Management Instrumentation (WMI) apps + Tamper Protection essentially locks Microsoft Defender and prevents your security settings from being changed through apps and methods like these: +- Configuring settings in Registry Editor on your Windows machine +- Changing settings through PowerShell cmdlets +- Editing or removing security settings through group policies +- and so on. -The Tamper Protection setting doesn't affect how third party antivirus apps register with the Windows Security app. +Tamper Protection doesn't prevent you from viewing your security settings. And, Tamper Protection doesn't affect how third-party antivirus apps register with the Windows Security app. If your organization is using Windows 10 Enterprise E5, individual users can't change the Tamper Protection setting; this is managed by your security team. -On computers running Windows 10 Enterprise E5, users can't change the Tamper Protection setting. +### What do you want to do? -Tamper Protection is set to **On** by default. If you set Tamper Protection to **Off**, you will see a yellow warning in the Windows Security app under **Virus & Threat Protection**. +[Turn Tamper Protection on (or off) for an individual machine](#turn-tamper-protection-on-or-off-for-an-individual-machine) -## Configure tamper protection +[Turn Tamper Protection on (or off) for your organization with Intune (Preview)](#turn-tamper-protection-on-or-off-for-your-organization-with-intune) + +## Turn Tamper Protection on (or off) for an individual machine + +If you are a home user, or you are not subject to settings managed by a security team, you can use the Windows Security app to turn Tamper Protection on or off. You must have appropriate admin permissions on your machine to perform the following task. + +1. Click **Start**, and start typing *Defender*. In the search results, select **Windows Security**. + +2. Select **Virus & threat protection** > **Virus & threat protection settings**. -1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. -2. Select **Virus & threat protection**, then select **Virus & threat protection settings**. 3. Set **Tamper Protection** to **On** or **Off**. ->[!NOTE] ->Tamper Protection blocks attempts to modify Windows Defender Antivirus settings through the registry. -> ->To help ensure that Tamper Protection doesn’t interfere with third-party security products or enterprise installation scripts that modify these settings, go to **Windows Security** and update **Security intelligence** to version 1.287.60.0 or later. -> ->Once you’ve made this update, Tamper Protection will continue to protect your registry settings, and will also log attempts to modify them without returning errors. +> [!NOTE] +> Tamper Protection blocks attempts to modify Windows Defender Antivirus settings through the registry. +> +> To help ensure that Tamper Protection doesn’t interfere with third-party security products or enterprise installation scripts that modify these settings, go to **Windows Security** and update **Security intelligence** to version 1.287.60.0 or later. (See [Security intelligence updates](https://www.microsoft.com/wdsi/definitions).) +> +> Once you’ve made this update, Tamper Protection will continue to protect your registry settings, and will also log attempts to modify them without returning errors. + + +## Turn Tamper Protection on (or off) for your organization with Intune + +If you are part of your organization's security team, the ability to turn Tamper Protection on (or off) for your organization in the Microsoft 365 Device Management portal (Intune) is now in preview. "In preview" means this feature is rolling out to business customers who have [Microsoft Defender ATP](../microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) and who have agreed to participate in the preview program. As a preview feature, the following applies: + +*Some information in this section relates to prereleased product that might be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.* + +You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations, to perform the following task. + +1. Make sure your organization meets the following requirements: + + - Your organization must have [Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) (this is included in Microsoft 365 E5. See [Microsoft 365 Enterprise overview](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview) for more details.) + - Your organization's devices must be managed by [Intune](https://docs.microsoft.com/intune/device-management-capabilities). + - Your Windows machines must be running [Windows OS 1903](https://docs.microsoft.com/windows/release-information/status-windows-10-1903) or later. + - You must be using Windows security and update [security intelligence](https://www.microsoft.com/wdsi/definitions) to version 1.287.60.0 (or above) + - Your machines must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above). (See [Manage Windows Defender Antivirus updates and apply baselines](manage-updates-baselines-windows-defender-antivirus.md).) + +2. Go to the Microsoft 365 Device Management portal ([https://devicemanagement.microsoft.com](https://devicemanagement.microsoft.com)) and sign in with your work or school account. + +3. Select **Device configuration** > **Profiles**. + +4. Create a profile that includes the following settings: + + - **Platform**: Windows 10 and later + - **ProfileType**: Endpoint protection + - **Settings** > Windows Defender Security Center > Tamper Protection + +5. Assign the profile to one or more groups. + +## Frequently asked questions + +### To which Windows OS versions is configuring Tamper Protection is applicable? + +Windows 1903 May release + +### Is configuring Tamper Protection in Intune supported on servers? + +No + +### Will Tamper Protection have any impact on third party antivirus registration? + +No, third-party antivirus will continue to register with the Windows Security application. + +### What happens if Microsoft Defender is not active on a device? + +Tamper Protection will not have any impact on such devices. + +### How can I turn Tamper Protection on/off? + +If you are a home user, see [Turn Tamper Protection on (or off) for an individual machine](#turn-tamper-protection-on-or-off-for-an-individual-machine). + +If you are an organization using [Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp), you should be able to manage Tamper Protection in Intune similar to how you manage other endpoint protection features. See [Turn Tamper Protection on (or off) for your organization with Intune](#turn-tamper-protection-on-or-off-for-your-organization-with-intune). + + +### How does configuring Tamper Protection in Intune affect how I manage Windows Defender through my group policy? + +Your regular group policy doesn’t apply to Tamper Protection, and changes to Windows Defender settings will be ignored when Tamper Protection is on. + +### For Microsoft Defender Advanced Threat Protection E5, is configuring Tamper Protection in Intune targeted to the entire organization only? + +Configuring Tamper Protection in Intune can be targeted to your entire organization as well as to devices and user groups with Intune. + +### Can I configure Tamper Protection in System Center Configuration Manager? + +Currently we do not have support to manage Tamper Protection through System Center Configuration Manager. + +### I have the Windows E3 enrollment. Can I use configuring Tamper Protection in Intune? + +Currently, configuring Tamper Protection in Intune is only available for customers who have [Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp). + +### What happens if I try to change Microsoft Defender settings in Intune, System Center Configuration Manager, and Windows Management Instrumentation when Tamper Protection is enabled on a device? + +You won’t be able to change the features that are protected by Tamper Protection; those change requests are ignored. + +### I’m an enterprise customer. Can local admins change Tamper Protection on their devices? + +No. Local admins cannot change or modify Tamper Protection settings. + +### What happens if my device is onboarded with Microsoft Defender Advanced Threat Protection and then goes into an off-boarded state? + +In this case, Tamper Protection status changes, and this feature is no longer applied. + +### Will there be an alert about Tamper Protection status changing in the Microsoft Defender Advanced Threat Protection portal? + +Yes. The alert is shown in [https://microsoft.securitycenter.com](https://microsoft.securitycenter.com) under **Alerts**. + +In addition, your security operations team can use hunting queries, such as the following: + +`AlertEvents | where Title == "Tamper Protection bypass"` + +### Will there be a group policy setting for Tamper Protection? + +No. + +## Related resources + +[Windows 10 Enterprise Security](https://docs.microsoft.com/windows/security/index) + +[Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/intune/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune) + +[Microsoft 365 Enterprise overview (at a glance)](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview#at-a-glance) + +[Microsoft Defender Advanced Threat Protection E5](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) diff --git a/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md index 8c57a43727..68c4accc82 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md @@ -29,6 +29,9 @@ If Windows Defender Antivirus is configured to detect and remediate threats on y 3. Under **Quarantined threats**, click **See full history**. 4. Click an item you want to keep, then click **Restore**. (If you prefer to remove the item, you can click **Remove**.) +> [!NOTE] +> You can also use the dedicated command-line tool [mpcmdrun.exe](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus) to restore quarantined files in Windows Defender AV. + ## Related topics - [Configure remediation for scans](configure-remediation-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md index 44eb90d185..5553e762b8 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md @@ -34,7 +34,7 @@ To take advantage of the power and speed of these next-gen technologies, Windows With cloud-delivered protection, next-gen technologies provide rapid identification of new threats, sometimes even before a single machine is infected. Watch the following video about Microsoft AI and Windows Defender Antivirus in action: +src="https://www.microsoft.com/videoplayer/embed/RE1Yu4B" width="768" height="432" allowFullScreen="true" frameBorder="0" scrolling="no"> To understand how next-gen technologies shorten protection delivery time through the cloud, watch the following video: diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md index bd9df5835d..def6571abc 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md @@ -47,7 +47,6 @@ You can configure and manage Windows Defender Antivirus with: > [!NOTE] > For more information regarding what's new in each Windows version, please refer to [What's new in Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp). -======= ## Minimum system requirements diff --git a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md index dfac2bdc61..5af8d81560 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md +++ b/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md @@ -9,9 +9,9 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: dansimp -ms.author: dansimp -ms.date: 09/03/2018 +author: denisebmsft +ms.author: deniseb +ms.date: 09/10/2019 ms.reviewer: manager: dansimp --- @@ -31,17 +31,16 @@ While the functionality, configuration, and management is largely the same for W This topic includes the following instructions for setting up and running Windows Defender AV on a server platform: -- [Enable the interface](#BKMK_UsingDef) +- [Enable the interface](#enable-or-disable-the-interface-on-windows-server-2016) -- [Verify Windows Defender AV is running](#BKMK_DefRun) +- [Verify Windows Defender AV is running](#verify-windows-defender-is-running) -- [Update antimalware Security intelligence](#BKMK_UpdateDef) +- [Update antimalware Security intelligence](#update-antimalware-security-intelligence) -- [Submit Samples](#BKMK_DefSamples) +- [Submit Samples](#submit-samples) -- [Configure automatic exclusions](#BKMK_DefExclusions) +- [Configure automatic exclusions](#configure-automatic-exclusions) - ## Enable or disable the interface on Windows Server 2016 By default, Windows Defender AV is installed and functional on Windows Server 2016. The user interface is installed by default on some SKUs, but is not required. @@ -76,7 +75,7 @@ Uninstall-WindowsFeature -Name Windows-Defender-GUI You can also uninstall Windows Defender AV completely with the **Remove Roles and Features Wizard** by deselecting the **Windows Defender Features** option at the **Features** step in the wizard. -This is useful if you have a third-party antivirus product installed on the machine already. Multiple AV products can cause problems when installed and actively running on the same machine. See the question "Should I run Microsoft security software at the same time as other security products?" on the [Windows Defender Security Intelligence Antivirus and antimalware software FAQ](https://www.microsoft.com/en-us/wdsi/help/antimalware-faq#multiple-products). +This is useful if you have a third-party antivirus product installed on the machine already. Multiple AV products can cause problems when installed and actively running on the same machine. See the question "Should I run Microsoft security software at the same time as other security products?" on the [Windows Defender Security Intelligence Antivirus and antimalware software FAQ](https://www.microsoft.com/wdsi/help/antimalware-faq#multiple-products). >[!NOTE] >Deselecting **Windows Defender** on its own under the **Windows Defender Features** section will automatically prompt you to remove the interface option **GUI for Windows Defender**. @@ -87,7 +86,7 @@ This is useful if you have a third-party antivirus product installed on the mach The following PowerShell cmdlet will also uninstall Windows Defender AV on Windows Server 2016: -```PS +```PowerShell Uninstall-WindowsFeature -Name Windows-Defender ``` @@ -95,7 +94,7 @@ To install Windows Defender AV again, use the **Add Roles and Features Wizard** You can also use the following PowerShell cmdlet to install Windows Defender AV: -```PS +```PowerShell Install-WindowsFeature -Name Windows-Defender ``` @@ -103,9 +102,21 @@ Install-WindowsFeature -Name Windows-Defender > Event messages for the antimalware engine included with Windows Defender AV can be found in [Windows Defender AV Events](troubleshoot-windows-defender-antivirus.md). - ## Verify Windows Defender is running -To verify that Windows Defender AV is running on the server, run the following command from a command prompt: + +To verify that Windows Defender AV is running on the server, run the following PowerShell cmdlet: + +```PowerShell +Get-Service -Name windefend +``` + +To verify that firewall protection through Windows Defender is turned on, run the following PowerShell cmdlet: + +```PowerShell +Get-Service -Name mpssvc +``` + +As an alternative to PowerShell, you can use Command Prompt to verify that Windows Defender AV is running. To do that, run the following command from a command prompt: ```DOS sc query Windefend @@ -113,8 +124,8 @@ sc query Windefend The `sc query` command returns information about the Windows Defender service. If Windows Defender is running, the `STATE` value displays `RUNNING`. - ## Update antimalware Security intelligence + In order to get updated antimalware Security intelligence , you must have the Windows Update service running. If you use an update management service, like Windows Server Update Services (WSUS), make sure that updates for Windows Defender Antivirus Security intelligence are approved for the computers you manage. By default, Windows Update does not download and install updates automatically on Windows Server 2016. You can change this configuration by using one of the following methods: @@ -148,37 +159,34 @@ The following table lists the services for Windows Defender and the dependent se |Windows Defender Firewall (MpsSvc)|C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork|We recommend leaving the Windows Defender Firewall service enabled.| |Windows Update (Wuauserv)|C:\WINDOWS\system32\svchost.exe -k netsvcs|Windows Update is needed to get Security intelligence updates and antimalware engine updates| - - - ## Submit Samples + Sample submission allows Microsoft to collect samples of potentially malicious software. To help provide continued and up-to-date protection, Microsoft researchers use these samples to analyze suspicious activities and produce updated antimalware Security intelligence. We collect program executable files, such as .exe files and .dll files. We do not collect files that contain personal data, like Microsoft Word documents and PDF files. ### Enable automatic sample submission -- To enable automatic sample submission, start a Windows PowerShell console as an administrator, and set the **SubmitSamplesConsent** value data according to one of the following settings: +To enable automatic sample submission, start a Windows PowerShell console as an administrator, and set the **SubmitSamplesConsent** value data according to one of the following settings: - - **0** Always prompt. The Windows Defender service prompts you to confirm submission of all required files. This is the default setting for Windows Defender, but is not recommended for Windows Server 2016 installations without a GUI. +- **0** Always prompt. The Windows Defender service prompts you to confirm submission of all required files. This is the default setting for Windows Defender, but is not recommended for Windows Server 2016 installations without a GUI. - - **1** Send safe samples automatically. The Windows Defender service sends all files marked as "safe" and prompts for the remainder of the files. +- **1** Send safe samples automatically. The Windows Defender service sends all files marked as "safe" and prompts for the remainder of the files. - - **2** Never send. The Windows Defender service does not prompt and does not send any files. +- **2** Never send. The Windows Defender service does not prompt and does not send any files. - - **3** Send all samples automatically. The Windows Defender service sends all files without a prompt for confirmation. +- **3** Send all samples automatically. The Windows Defender service sends all files without a prompt for confirmation. - ## Configure automatic exclusions + To help ensure security and performance, certain exclusions are automatically added based on the roles and features you install when using Windows Defender AV on Server 2016. See the [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) topic for more information. - - ## Related topics - [Windows Defender Antivirus in Windows 10](windows-defender-antivirus-in-windows-10.md) + - [Configure exclusions in Windows Defender AV on Windows Server](configure-server-exclusions-windows-defender-antivirus.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/TOC.md index ac99737410..196c8dc9a2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.md +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.md @@ -11,7 +11,7 @@ ## [Windows Defender Application Control deployment guide](windows-defender-application-control-deployment-guide.md) ### [Types of devices](types-of-devices.md) -###Use WDAC with custom policies +### Use WDAC with custom policies #### [Create an initial default policy](create-initial-default-policy.md) #### [Create path-based rules](create-path-based-rules.md) #### [Microsoft recommended block rules](microsoft-recommended-block-rules.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md index 3622d0e101..f762644195 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Add rules for packaged apps to existing AppLocker rule-set **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md index 86c295cf9e..8730c6c545 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md @@ -20,8 +20,8 @@ ms.date: 02/28/2019 # Administer AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md index d2d3584bf7..f7a0f16873 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # AppLocker architecture and components **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professional describes AppLocker’s basic architecture and its major components. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md index c12a1e59ac..3bfb26bb30 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # AppLocker functions **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md index 37045a74e8..7f4112593f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md @@ -20,8 +20,8 @@ ms.date: 10/16/2017 # AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md index 7758f45ec7..e92450d695 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md @@ -21,8 +21,8 @@ ms.date: 09/21/2017 # AppLocker deployment guide **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md index a7258ab473..d723d9a054 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # AppLocker design guide **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md index 6e50eebbd2..3e660d6659 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # AppLocker policy use scenarios **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md index e32e6bf896..54ec678b22 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # AppLocker processes and interactions **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md index c02fce9a90..f289a40fe7 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # AppLocker settings **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional lists the settings used by AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md index f330084b0b..031ce25230 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # AppLocker technical reference **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This overview topic for IT professionals provides links to the topics in the technical reference. AppLocker advances the application control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny apps from running based on unique identities of files and to specify which users or groups can run those apps. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md index ce69d9e064..2dd978d52b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md @@ -20,8 +20,8 @@ ms.date: 06/08/2018 # Configure an AppLocker policy for audit only **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes how to set AppLocker policies to **Audit only** within your IT environment by using AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md index 24f5aeb1ef..36cce5baec 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Configure an AppLocker policy for enforce rules **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md index 018d76dd6b..dfb7c8814a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Add exceptions for an AppLocker rule **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md index 52899e5621..a3a2d593bb 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Configure the AppLocker reference device **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md index fffa53c756..c2c55cccf6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md @@ -20,8 +20,8 @@ ms.date: 04/02/2018 # Configure the Application Identity service **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md index d87b6b2d31..7ac5a2faeb 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Create a rule for packaged apps **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md index 9248042379..f7689c76f7 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Create a rule that uses a file hash condition **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals shows how to create an AppLocker rule with a file hash condition. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md index 7d7608f7c8..728693dc35 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Create a rule that uses a path condition **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals shows how to create an AppLocker rule with a path condition. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md index 58609a7102..5a875b4b84 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Create a rule that uses a publisher condition **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals shows how to create an AppLocker rule with a publisher condition. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md index 8f20bf3c9a..f68602c282 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Create AppLocker default rules **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md index 7afc539899..e0c0cb658f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Create a list of apps deployed to each business group **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md index 859761b9b9..4cb2f24434 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Create Your AppLocker policies **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md index 6fb52b2843..6d75ecfc99 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Create Your AppLocker rules **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md index 84e53cfb2d..be00ebc127 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md @@ -20,8 +20,8 @@ ms.date: 08/02/2018 # Delete an AppLocker rule **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to delete an AppLocker rule. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md index 0fe96e42aa..65374479fc 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Deploy AppLocker policies by using the enforce rules setting **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md index dd81603afd..058e736230 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Deploy the AppLocker policy into production **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md index 2226a672dd..e03376d487 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Determine the Group Policy structure and rule enforcement **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This overview topic describes the process to follow when you are planning to deploy AppLocker rules. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md index c8d4acc789..3b75aaec82 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Determine which apps are digitally signed on a reference device **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md index e1b0bef761..7f43b4f3cd 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Determine your application control objectives **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic helps you with the decisions you need to make to determine what applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md b/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md index c39d07f07a..f87c93e451 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Display a custom URL message when users try to run a blocked app **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md index 60741a87ed..ec45f1d75e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # DLL rules in AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic describes the file formats and available default rules for the DLL rule collection. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md index 415d381cc4..44a181aa71 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Document the Group Policy structure and AppLocker rule enforcement **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md index 1ea62b509f..3cac5abbce 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Document your app list **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This planning topic describes the app information that you should document when you create a list of apps for AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md index a748a0fb9d..2147e2fe3f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Document your AppLocker rules **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic describes what rule conditions to associate with each file, how to associate the rule conditions with each file, the source of the rule, and whether the file should be included or excluded. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md index 08db847c8a..03b04a1190 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Edit an AppLocker policy **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps required to modify an AppLocker policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md index 8bf42722e6..028a8237bc 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Edit AppLocker rules **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md b/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md index 1f45a8cb4d..575de45499 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Enable the DLL rule collection **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md index e34cd10524..b396db1cfb 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Enforce AppLocker rules **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes how to enforce application control rules by using AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md index 09e13411bb..ffdc7ace8c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Executable rules in AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic describes the file formats and available default rules for the executable rule collection. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md index 579f6a1677..0443b67c6b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Export an AppLocker policy from a GPO **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md index 1d42dabe51..6856386f4a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Export an AppLocker policy to an XML file **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing. Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md b/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md index 6d259a430f..b4adeb4b33 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # How AppLocker works **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md index cd3f2ab32d..eaa7c7aa78 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Import an AppLocker policy from another computer **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes how to import an AppLocker policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md index 07ffba8bd0..ac5ac53cd5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Import an AppLocker policy into a GPO **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). AppLocker policies can be created as local security policies and modified like any other local security policy, or they can be created as part of a GPO and managed by using Group Policy. You can create AppLocker policies on any supported computer. For info about which Windows editions are supported, see [Requirements to Use AppLocker](requirements-to-use-applocker.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md index af959d3197..20b1b50dae 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Maintain AppLocker policies **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic describes how to maintain rules within AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md index bd4497b964..3a9dee486d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Manage packaged apps with AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md index 7ee34ff838..47c7db9884 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Merge AppLocker policies by using Set-ApplockerPolicy **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell. @@ -41,6 +41,6 @@ You can also manually merge AppLocker policies. For the procedure to do this, se Gets the local AppLocker policy, and then merges the policy with the existing AppLocker policy in the GPO specified in the LDAP path. -``` syntax +```powershell C:\PS>Get-AppLockerPolicy -Local | Set-AppLockerPolicy -LDAP "LDAP://DC13.Contoso.com/CN={31B2F340-016D-11D2-945F-00C044FB984F9},CN=Policies,CN=System,DC=Contoso,DC=com" -Merge ``` diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md index 0ccb16202c..f40ead0fc0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Merge AppLocker policies manually **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md index 72378b52ca..9d03415f49 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Monitor app usage with AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md b/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md index 50e84edb7a..d669f7c890 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Optimize AppLocker performance **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes how to optimize AppLocker policy enforcement. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md index eb87d51320..1057121e64 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md @@ -20,8 +20,8 @@ ms.date: 10/13/2017 # Packaged apps and packaged app installer rules in AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic explains the AppLocker rule collection for packaged app installers and packaged apps. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md index d0e2f069fe..90bf198903 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Plan for AppLocker policy management **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md index de3556a475..9e6a10f475 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Refresh an AppLocker policy **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to force an update for an AppLocker policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md index b1187d6b13..5bfe8d38ed 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Requirements for deploying AppLocker policies **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md index edcc2be0d3..ded7e2d592 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Requirements to use AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md b/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md index a0a509e1ae..a87df1bc69 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Run the Automatically Generate Rules wizard **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md index 068f4f5786..1854e961d1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Script rules in AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic describes the file formats and available default rules for the script rule collection. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md index 2fbfbf63aa..bde5f92033 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Security considerations for AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md index 74fe7bc8ec..4daacad66d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Select the types of rules to create **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic lists resources you can use when selecting your application control policy rules by using AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md index dd5cb6b46d..00511d0f23 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Test an AppLocker policy by using Test-AppLockerPolicy **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md index e1d63a2f9d..6306c10479 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Test and update an AppLocker policy **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic discusses the steps required to test an AppLocker policy prior to deployment. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md index d3666a1e1e..974a0000cc 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Tools to use with AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional describes the tools available to create and administer AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md index 38e080a194..0cd67f03d8 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Understand AppLocker enforcement settings **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic describes the AppLocker enforcement settings for rule collections. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md index 29a92cb366..fedd0c187e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md @@ -20,8 +20,8 @@ ms.date: 10/13/2017 # Understand AppLocker policy design decisions **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using AppLocker within a Windows operating system environment. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md index 60372d5be9..eef85dda63 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Understand AppLocker rules and enforcement setting inheritance in Group Policy **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md index cf93b27a4b..5e0c80b55d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Understand the AppLocker policy deployment process **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md index 50811e33c0..f9cdae7831 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Understanding AppLocker allow and deny actions on rules **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic explains the differences between allow and deny actions on AppLocker rules. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md index aab40287b6..d2d2d98598 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Understanding AppLocker default rules **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md index fb7afc79b9..cbb7806a6b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Understanding AppLocker rule behavior **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md index f2788d4bfc..0392b51405 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Understanding AppLocker rule collections **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic explains the five different types of AppLocker rules used to enforce AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md index f937e73090..ace4b89837 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Understanding AppLocker rule condition types **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional describes the three types of AppLocker rule conditions. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md index 08aeb4091d..9420c1f20f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Understanding AppLocker rule exceptions **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic describes the result of applying AppLocker rule exceptions to rule collections. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md index 3bb3ba52c4..b0e028c79d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Understanding the file hash rule condition in AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it is applied. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md index 0e59ec885b..95863340c0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Understanding the path rule condition in AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it is applied. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md index 52259c9248..73bd0d992a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Understanding the publisher rule condition in AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic explains the AppLocker publisher rule condition, what controls are available, and how it is applied. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md index 9c5076e4c6..adf5eb6279 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md @@ -21,8 +21,8 @@ ms.date: 09/21/2017 # Use a reference device to create and maintain AppLocker policies **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md index 1f70ea7e87..828934ca43 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Use AppLocker and Software Restriction Policies in the same domain **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md index 0f4a4872cf..58edb0059e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Use the AppLocker Windows PowerShell cmdlets **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md index 6fa4d92a72..78c04357c6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Using Event Viewer with AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic lists AppLocker events and describes how to use Event Viewer with AppLocker. @@ -50,11 +50,11 @@ The following table contains information about the events that you can use to de | 8000 | Error| Application Identity Policy conversion failed. Status *<%1> *| Indicates that the policy was not applied correctly to the computer. The status message is provided for troubleshooting purposes.| | 8001 | Information| The AppLocker policy was applied successfully to this computer.| Indicates that the AppLocker policy was successfully applied to the computer.| | 8002 | Information| *<File name> * was allowed to run.| Specifies that the .exe or .dll file is allowed by an AppLocker rule.| -| 8003 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Applied only when the **Audit only ** enforcement mode is enabled. Specifies that the .exe or .dll file would be blocked if the **Enforce rules ** enforcement mode were enabled. | -| 8004 | Error| *<File name> * was not allowed to run.| Access to *<file name> * is restricted by the administrator. Applied only when the **Enforce rules ** enforcement mode is set either directly or indirectly through Group Policy inheritance. The .exe or .dll file cannot run.| +| 8003 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Applied only when the **Audit only** enforcement mode is enabled. Specifies that the .exe or .dll file would be blocked if the **Enforce rules** enforcement mode were enabled. | +| 8004 | Error| *<File name> * was not allowed to run.| Access to *<file name>* is restricted by the administrator. Applied only when the **Enforce rules** enforcement mode is set either directly or indirectly through Group Policy inheritance. The .exe or .dll file cannot run.| | 8005| Information| *<File name> * was allowed to run.| Specifies that the script or .msi file is allowed by an AppLocker rule.| -| 8006 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Applied only when the **Audit only ** enforcement mode is enabled. Specifies that the script or .msi file would be blocked if the **Enforce rules ** enforcement mode were enabled. | -| 8007 | Error| *<File name> * was not allowed to run.| Access to *<file name> * is restricted by the administrator. Applied only when the **Enforce rules ** enforcement mode is set either directly or indirectly through Group Policy inheritance. The script or .msi file cannot run.| +| 8006 | Warning| *<File name> * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.| Applied only when the **Audit only** enforcement mode is enabled. Specifies that the script or .msi file would be blocked if the **Enforce rules** enforcement mode were enabled. | +| 8007 | Error| *<File name> * was not allowed to run.| Access to *<file name>* is restricted by the administrator. Applied only when the **Enforce rules** enforcement mode is set either directly or indirectly through Group Policy inheritance. The script or .msi file cannot run.| | 8008| Error| AppLocker disabled on the SKU.| Added in Windows Server 2012 and Windows 8.| | 8020| Information| Packaged app allowed.| Added in Windows Server 2012 and Windows 8.| | 8021| Information| Packaged app audited.| Added in Windows Server 2012 and Windows 8.| diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md index 3583e3fd1b..1dd5197ddd 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Use Software Restriction Policies and AppLocker policies **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md index a3c525fbfa..2ddcbb332e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # What Is AppLocker? **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md index a853be9f44..50fff5a7b2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Windows Installer rules in AppLocker **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic describes the file formats and available default rules for the Windows Installer rule collection. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md index 8e77d3e330..2bde016bc2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Working with AppLocker policies **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. @@ -30,7 +30,7 @@ This topic for IT professionals provides links to procedural topics about creati | Topic | Description | | - | - | | [Configure the Application Identity service](configure-the-application-identity-service.md) | This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually.| -| [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) | This topic for IT professionals describes how to set AppLocker policies to **Audit only ** within your IT environment by using AppLocker.| +| [Configure an AppLocker policy for audit only](configure-an-applocker-policy-for-audit-only.md) | This topic for IT professionals describes how to set AppLocker policies to **Audit only** within your IT environment by using AppLocker.| | [Configure an AppLocker policy for enforce rules](configure-an-applocker-policy-for-enforce-rules.md) | This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting.| | [Display a custom URL message when users try to run a blocked app](display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md) | This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app.| | [Export an AppLocker policy from a GPO](export-an-applocker-policy-from-a-gpo.md) | This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified.| diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md index c899126846..1b92efcccf 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md @@ -18,8 +18,8 @@ ms.date: 08/27/2018 # Working with AppLocker rules **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md index 105f6a46bb..babbce2e0b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md @@ -52,10 +52,10 @@ Beginning with Windows 10 version 1903, Windows Defender Application Control (WD - Suffix (ex. C:\foo\\*) OR Prefix (ex. *\foo\bar.exe) - One or the other, not both at the same time - Does not support wildcard in the middle (ex. C:\\*\foo.exe) - - Examples: - - %WINDIR%\\... - - %SYSTEM32%\\... - - %OSDRIVE%\\... +- Supported Macros: + - %WINDIR%\\... + - %SYSTEM32%\\... + - %OSDRIVE%\\... - Disable default FilePath rule protection of enforcing user-writeability. For example, to add “Disabled:Runtime FilePath Rule Protection” to the policy: diff --git a/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md b/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md index abaa31c6ff..d7f2a132fb 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Create your Windows Defender Application Control (WDAC) planning document **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This planning topic for the IT professional summarizes the information you need to research and include in your WDAC planning document. diff --git a/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md b/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md index 6a6df72992..f29188cd79 100644 --- a/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md +++ b/windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md @@ -20,8 +20,8 @@ ms.date: 09/21/2017 # Document your application control management processes **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This planning topic describes the Windows Defender Application Control (WDAC) policy maintenance information to record for your design document. diff --git a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md index 8fb9a6ccaf..fbad450704 100644 --- a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md @@ -116,7 +116,7 @@ If the app you intend to block is not installed on the system you are using the 3. Copy the GUID in the URL for the app - Example: the GUID for the Microsoft To-Do app is 9nblggh5r558 - - https://www.microsoft.com/en-us/p/microsoft-to-do-list-task-reminder/9nblggh5r558?activetab=pivot:overviewtab + - https://www.microsoft.com/p/microsoft-to-do-list-task-reminder/9nblggh5r558?activetab=pivot:overviewtab 4. Use the GUID in the following REST query URL to retrieve the identifiers for the app - Example: for the Microsoft To-Do app, the URL would be https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblggh5r558/applockerdata - The URL will return: diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 6f92fd0056..8aae066fd4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -1,6 +1,6 @@ --- title: Microsoft recommended block rules (Windows 10) -description: To help you plan and begin the initial test stages of a deployment of Microsoft Windows Defender Application Comntrol, this article outlines how to gather information, create a plan, and begin to create and test initial code integrity policies. +description: To help you plan and begin the initial test stages of a deployment of Microsoft Windows Defender Application Control, this article outlines how to gather information, create a plan, and begin to create and test initial code integrity policies. keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index ab584cebd9..530d8659f9 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -111,15 +111,16 @@ They could also choose to create a catalog that captures information about the u Beginning with Windows 10 version 1903, Windows Defender Application Control (WDAC) policies can contain path-based rules. -- New-CIPolicy parameters +- New-CIPolicy parameter - FilePath: create path rules under path \ for anything not user-writeable (at the individual file level) ```powershell - New-CIPolicy -f .\mypolicy.xml -l FilePath -s -u + New-CIPolicy -FilePath .\mypolicy.xml -Level FileName -ScanPath -UserPEs ``` Optionally, add -UserWriteablePaths to ignore user writeability - + +- New-CIPolicyRule parameter - FilePathRule: create a rule where filepath string is directly set to value of \ ```powershell @@ -134,7 +135,7 @@ Beginning with Windows 10 version 1903, Windows Defender Application Control (WD $rules = New-CIPolicyRule … $rules += New-CIPolicyRule … … - New-CIPolicyRule -f .\mypolicy.xml -u + New-CIPolicy -FilePath .\mypolicy.xml -Rules $rules -UserPEs ``` - Wildcards supported @@ -149,6 +150,6 @@ Beginning with Windows 10 version 1903, Windows Defender Application Control (WD - Disable default FilePath rule protection of enforcing user-writeability. For example, to add “Disabled:Runtime FilePath Rule Protection” to the policy: ```powershell - Set-RuleOption -o 18 .\policy.xml + Set-RuleOption -Option 18 .\policy.xml ``` diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md index 44ff0aa926..e9719fd4e4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md @@ -18,8 +18,8 @@ ms.author: dansimp # Windows Defender Application Control design guide **Applies to** - - Windows 10 - - Windows Server +- Windows 10 +- Windows Server This guide covers design and planning for Windows Defender Application Control (WDAC). It is intended to help security architects, security administrators, and system administrators create a plan that addresses specific application control requirements for different departments or business groups within an organization. diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md index 9617e485b3..3605322e2c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md @@ -18,7 +18,7 @@ ms.date: 01/08/2019 **Applies to:** -- Windows 10 +- Windows 10 Enterprise - Windows Server 2016 - Windows Server 2019 @@ -40,8 +40,8 @@ WDAC policies also block unsigned scripts and MSIs, and Windows PowerShell runs ## WDAC System Requirements -WDAC policies can only be created on computers beginning with Windows 10 Enterprise or Professional editions or Windows Server 2016. -They can be applied to computers running any edition of Windows 10 or Windows Server 2016 and optionally managed via Mobile Device Management (MDM), such as Microsoft Intune. +WDAC policies can only be created on computers beginning with Windows 10 Enterprise or Windows Server 2016 and above. +They can be applied to computers running Windows 10 Enterprise or Windows Server 2016 and above and optionally managed via Mobile Device Management (MDM), such as Microsoft Intune. Group Policy or Intune can be used to distribute WDAC policies. ## New and changed functionality diff --git a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md index fb335353dc..d79135d66a 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md @@ -29,11 +29,21 @@ These settings, located at **Computer Configuration\Administrative Templates\Net >You must configure either the Enterprise resource domains hosted in the cloud or Private network ranges for apps settings on your employee devices to successfully turn on Application Guard using enterprise mode. -| Policy name | Supported versions | Description | -|-------------------------------------------------|--------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Private network ranges for apps | At least Windows Server 2012, Windows 8, or Windows RT | A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. | -| Enterprise resource domains hosted in the cloud | At least Windows Server 2012, Windows 8, or Windows RT | A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. Notes: 1) Please include a full domain name (www.contoso.com) in the configuration 2) You may optionally use "." as a wildcard character to automatically trust subdomains. Configuring ".constoso.com" will automatically trust "subdomain1.contoso.com", "subdomain2.contoso.com" etc. | -| Domains categorized as both work and personal | At least Windows Server 2012, Windows 8, or Windows RT | A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment. | + +|Policy name|Supported versions|Description| +|-----------|------------------|-----------| +|Private network ranges for apps|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of IP address ranges that are in your corporate network. Included endpoints or endpoints that are included within a specified IP address range, are rendered using Microsoft Edge and won't be accessible from the Application Guard environment.| +|Enterprise resource domains hosted in the cloud|At least Windows Server 2012, Windows 8, or Windows RT|A pipe-separated (\|) list of your domain cloud resources. Included endpoints are rendered using Microsoft Edge and won't be accessible from the Application Guard environment. Note: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| +|Domains categorized as both work and personal|At least Windows Server 2012, Windows 8, or Windows RT|A comma-separated list of domain names used as both work or personal resources. Included endpoints are rendered using Microsoft Edge and will be accessible from the Application Guard and regular Edge environment. Note: This list supports the wildcards detailed in the [Network isolation settings wildcards](#network-isolation-settings-wildcards) table.| + +## Network isolation settings wildcards + +|Value|Number of dots to the left|Meaning| +|-----|--------------------------|-------| +|contoso.com|0|Trust only the literal value of **contoso.com**.| +|www.contoso.com|0|Trust only the literal value of **www.contoso.com**.| +|.contoso.com|1|Trust any domain that ends with the text **contoso.com**. Matching sites include **spearphishingcontoso.com**, **contoso.com**, and **www.contoso.com**.| +|..contoso.com|2|Trust all levels of the domain hierarchy that are to the left of the dot. Matching sites include **shop.contoso.com**, **us.shop.contoso.com**, **www.us.shop.contoso.com**, but NOT **contoso.com** itself.| ## Application-specific settings These settings, located at **Computer Configuration\Administrative Templates\Windows Components\Windows Defender Application Guard**, can help you to manage your company's implementation of Application Guard. diff --git a/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md index 8a0d017824..1d5756d650 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md @@ -103,3 +103,11 @@ Answering frequently asked questions about Windows Defender Application Guard (A | **A:** | To trust a subdomain, you must precede your domain with two dots, for example: ..contoso.com. |
                        + +| | | +|--------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **Q:** | Are there differences between using Application Guard on Windows Pro vs Windows Enterprise? | +| **A:** | When using Windows Pro and Windows Enterprise, you will have access to using Application Guard's Standalone Mode. However, when using Enterprise you will have access to Application Guard's Enterprise-Managed Mode. This mode has some extra features that the Standalone Mode does not. For more information, see [Prepare to install Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard). | + +
                        + diff --git a/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md b/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md index 3f889598d3..dc6820bd94 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md +++ b/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard.md @@ -19,29 +19,12 @@ manager: dansimp - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ## Review system requirements - + +See [System requirements for Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard) to review the hardware and software installation requirements for Windows Defender Application Guard. >[!NOTE] >Windows Defender Application Guard is not supported on VMs and VDI environment. For testing and automation on non-production machines, you may enable WDAG on a VM by enabling Hyper-V nested virtualization on the host. -### Hardware requirements -Your environment needs the following hardware to run Windows Defender Application Guard. -|Hardware|Description| -|--------|-----------| -|64-bit CPU|A 64-bit computer with minimum 4 cores is required for the hypervisor. For more info about Hyper-V, see [Hyper-V on Windows Server 2016](https://docs.microsoft.com/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/virtualization/hyper-v-on-windows/about/). For more info about hypervisor, see [Hypervisor Specifications](https://docs.microsoft.com/virtualization/hyper-v-on-windows/reference/tlfs).| -|CPU virtualization extensions|Extended page tables, also called _Second Level Address Translation (SLAT)_

                        **-AND-**

                        One of the following virtualization extensions for VBS:

                        VT-x (Intel)

                        **-OR-**

                        AMD-V| -|Hardware memory|Microsoft requires a minimum of 8GB RAM| -|Hard disk|5 GB free space, solid state disk (SSD) recommended| -|Input/Output Memory Management Unit (IOMMU) support|Not required, but strongly recommended| - -### Software requirements -Your environment needs the following software to run Windows Defender Application Guard. - -|Software|Description| -|--------|-----------| -|Operating system|Windows 10 Enterprise edition, version 1709 or higher
                        Windows 10 Professional edition, version 1803| -|Browser|Microsoft Edge and Internet Explorer| -|Management system
                        (only for managed devices)|[Microsoft Intune](https://docs.microsoft.com/intune/)

                        **-OR-**

                        [System Center Configuration Manager](https://docs.microsoft.com/sccm/)

                        **-OR-**

                        [Group Policy](https://technet.microsoft.com/library/cc753298(v=ws.11).aspx)

                        **-OR-**

                        Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product.| ## Prepare for Windows Defender Application Guard diff --git a/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md b/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md index 4aadf6d205..7e4be68ec5 100644 --- a/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md +++ b/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md @@ -37,74 +37,6 @@ Application Guard has been created to target several types of systems: - **Personal devices.** These personally-owned desktops or mobile laptops are not domain-joined or managed by an organization. The user is an admin on the device and uses a high-bandwidth wireless personal network while at home or a comparable public network while outside. -## Frequently Asked Questions - -| | | -|--------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Q:** | Can I enable Application Guard on machines equipped with 4GB RAM? | -| **A:** | We recommend 8GB RAM for optimal performance but you may use the following registry DWORD values to enable Application Guard on machines that aren't meeting the recommended hardware configuration. | -| | HKLM\software\Microsoft\Hvsi\SpecRequiredProcessorCount - Default is 4 cores. | -| | HKLM\software\Microsoft\Hvsi\SpecRequiredMemoryInGB - Default is 8GB. | -| | HKLM\software\Microsoft\Hvsi\SpecRequiredFreeDiskSpaceInGB - Default is 5GB. | - -
                        - - -| | | -|--------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Q:** | Can employees download documents from the Application Guard Edge session onto host devices? | -| **A:** | In Windows 10 Enterprise edition 1803, users will be able to download documents from the isolated Application Guard container to the host PC. This is managed by policy.

                        In Windows 10 Enterprise edition 1709 or Windows 10 Professional edition 1803, it is not possible to download files from the isolated Application Guard container to the host PC. However, employees can use the **Print as PDF** or **Print as XPS** options and save those files to the host device. | - -
                        - - -| | | -|--------|------------------------------------------------------------------------------------------------------------------------------------| -| **Q:** | Can employees copy and paste between the host device and the Application Guard Edge session? | -| **A:** | Depending on your organization's settings, employees can copy and paste images (.bmp) and text to and from the isolated container. | - -
                        - - -| | | -|--------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Q:** | Why don't employees see their Favorites in the Application Guard Edge session? | -| **A:** | To help keep the Application Guard Edge session secure and isolated from the host device, we don't copy the Favorites stored in the Application Guard Edge session back to the host device. | - -
                        - - -| | | -|--------|---------------------------------------------------------------------------------------------------------------------------------------| -| **Q:** | Why aren’t employees able to see their Extensions in the Application Guard Edge session? | -| **A:** | Currently, the Application Guard Edge session doesn't support Extensions. However, we're closely monitoring your feedback about this. | - -
                        - - -| | | -|--------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Q:** | How do I configure WDAG to work with my network proxy (IP-Literal Addresses)? | -| **A:** | WDAG requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as “192.168.1.4:81” can be annotated as “itproxy:81” or using a record such as “P19216810010” for a proxy with an IP address of 192.168.100.10. This applies to Windows 10 Enterprise edition, 1709 or higher. | - -
                        - - -| | | -|--------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Q:** | I enabled the hardware acceleration policy on my Windows 10 Enterprise, version 1803 deployment. Why are my users still only getting CPU rendering? | -| **A:** | This feature is currently experimental-only and is not functional without an additional regkey provided by Microsoft. If you would like to evaluate this feature on a deployment of Windows 10 Enterprise, version 1803, please contact Microsoft and we’ll work with you to enable the feature. | - -
                        - - -| | | -|--------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Q:** | What is the WDAGUtilityAccount local account? | -| **A:** | This account is part of Application Guard beginning with Windows 10 version 1709 (Fall Creators Update). This account remains disabled until Application Guard is enabled on your device. This item is integrated to the OS and is not considered as a threat/virus/malware. | - -
                        - ## Related topics |Topic |Description | @@ -112,5 +44,5 @@ Application Guard has been created to target several types of systems: |[System requirements for Windows Defender Application Guard](reqs-wd-app-guard.md) |Specifies the pre-requisites necessary to install and use Application Guard.| |[Prepare and install Windows Defender Application Guard](install-wd-app-guard.md) |Provides instructions about determining which mode to use, either Standalone or Enterprise-managed, and how to install Application Guard in your organization.| |[Configure the Group Policy settings for Windows Defender Application Guard](configure-wd-app-guard.md) |Provides info about the available Group Policy and MDM settings.| -|[Testing scenarios using Windows Defender Application Guard in your business or organization](test-scenarios-wd-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Windows Defender Application Guard (Application Guard) in your organization.| - +|[Testing scenarios using Windows Defender Application Guard in your business or organization](test-scenarios-wd-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Application Guard in your organization.| +|[Frequently asked questions - Windows Defender Application Guard](faq-wd-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md deleted file mode 100644 index 0a5a679109..0000000000 --- a/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -title: Compare the features in Exploit protection with EMET -keywords: emet, enhanced mitigation experience toolkit, configuration, exploit, compare, difference between, versus, upgrade, convert -description: Exploit protection in Windows 10 provides advanced configuration over the settings offered in EMET. -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: levinec -ms.author: ellevin -ms.date: 08/08/2018 -ms.reviewer: -manager: dansimp ---- - -# Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender Exploit Guard - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - ->[!IMPORTANT] ->If you are currently using EMET, you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with exploit protection in Microsoft Defender ATP. -> ->You can [convert an existing EMET configuration file into Exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings. - -This topic describes the differences between the Enhance Mitigation Experience Toolkit (EMET) and exploit protection in Microsoft Defender ATP. - -Exploit protection in Microsoft Defender ATP is our successor to EMET and provides stronger protection, more customization, an easier user interface, and better configuration and management options. - -EMET is a standalone product for earlier versions of Windows and provides some mitigation against older, known exploit techniques. - -After July 31, 2018, it will not be supported. - -For more information about the individual features and mitigations available in Microsoft Defender ATP, as well as how to enable, configure, and deploy them to better protect your network, see the following topics: - -- [Protect devices from exploits](exploit-protection-exploit-guard.md) -- [Configure and audit exploit protection mitigations](customize-exploit-protection.md) - - - ## Feature comparison - - The table in this section illustrates the differences between EMET and Windows Defender Exploit Guard. - -  | Windows Defender Exploit Guard | EMET - -|:-:|:-: -Windows versions | [!include[Check mark yes](images/svg/check-yes.svg)]
                        All versions of Windows 10 starting with version 1709 | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Windows 8.1; Windows 8; Windows 7
                        Cannot be installed on Windows 10, version 1709 and later -Installation requirements | [Windows Security in Windows 10](../windows-defender-security-center/windows-defender-security-center.md)
                        (no additional installation required)
                        Windows Defender Exploit Guard is built into Windows - it doesn't require a separate tool or package for management, configuration, or deployment. | Available only as an additional download and must be installed onto a management device -User interface | Modern interface integrated with the [Windows Security app](../windows-defender-security-center/windows-defender-security-center.md) | Older, complex interface that requires considerable ramp-up training -Supportability | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Dedicated submission-based support channel](https://www.microsoft.com/en-us/wdsi/filesubmission)[[1](#fn1)]
                        [Part of the Windows 10 support lifecycle](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) | [!include[Check mark no](images/svg/check-no.svg)]
                        Ends after July 31, 2018 -Updates | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Ongoing updates and development of new features, released twice yearly as part of the [Windows 10 semi-annual update channel](https://blogs.technet.microsoft.com/windowsitpro/2017/07/27/waas-simplified-and-aligned/) | [!include[Check mark no](images/svg/check-no.svg)]
                        No planned updates or development -Exploit protection | [!include[Check mark yes](images/svg/check-yes.svg)]
                        All EMET mitigations plus new, specific mitigations ([see table](#mitigation-comparison))
                        [Can convert and import existing EMET configurations](import-export-exploit-protection-emet-xml.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Limited set of mitigations -Attack surface reduction[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Helps block known infection vectors](attack-surface-reduction-exploit-guard.md)
                        [Can configure individual rules](enable-attack-surface-reduction.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Limited ruleset configuration only for modules (no processes) -Network protection[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Helps block malicious network connections](network-protection-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)]
                        Not available -Controlled folder access[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Helps protect important folders](controlled-folders-exploit-guard.md)
                        [Configurable for apps and folders](customize-controlled-folders-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)]
                        Not available -Configuration with GUI (user interface) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Use Windows Security app to customize and manage configurations](customize-exploit-protection.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Requires installation and use of EMET tool -Configuration with Group Policy | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Use Group Policy to deploy and manage configurations](import-export-exploit-protection-emet-xml.md#manage-or-deploy-a-configuration) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Available -Configuration with shell tools | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Use PowerShell to customize and manage configurations](customize-exploit-protection.md#powershell-reference) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Requires use of EMET tool (EMET_CONF) -System Center Configuration Manager | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Use Configuration Manager to customize, deploy, and manage configurations](https://docs.microsoft.com/sccm/protect/deploy-use/create-deploy-exploit-guard-policy) | [!include[Check mark no](images/svg/check-no.svg)]
                        Not available -Microsoft Intune | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Use Intune to customize, deploy, and manage configurations](https://docs.microsoft.com/intune/whats-new#window-defender-exploit-guard-is-a-new-set-of-intrusion-prevention-capabilities-for-windows-10----1063615---) | [!include[Check mark no](images/svg/check-no.svg)]
                        Not available -Reporting | [!include[Check mark yes](images/svg/check-yes.svg)]
                        With [Windows event logs](event-views-exploit-guard.md) and [full audit mode reporting](audit-windows-defender-exploit-guard.md)
                        [Full integration with Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/secure-score-dashboard.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Limited Windows event log monitoring -Audit mode | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Full audit mode with Windows event reporting](audit-windows-defender-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)]
                        Limited to EAF, EAF+, and anti-ROP mitigations - -([1](#ref1)) Requires an enterprise subscription with Azure Active Directory or a [Software Assurance ID](https://www.microsoft.com/en-us/licensing/licensing-programs/software-assurance-default.aspx). - -([2](#ref2-1)) Additional requirements may apply (such as use of Windows Defender Antivirus). See [Windows Defender Exploit Guard requirements](windows-defender-exploit-guard.md#requirements) for more details. Customizable mitigation options that are configured with [Exploit protection](exploit-protection-exploit-guard.md) do not require Windows Defender Antivirus. - -## Mitigation comparison - -The mitigations available in EMET are included in Windows Defender Exploit Guard, under the [exploit protection feature](exploit-protection-exploit-guard.md). - -The table in this section indicates the availability and support of native mitigations between EMET and Exploit protection. - -Mitigation | Available in Windows Defender Exploit Guard | Available in EMET --|:-:|:-: -Arbitrary code guard (ACG) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
                        As "Memory Protection Check" -Block remote images | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
                        As "Load Library Check" -Block untrusted fonts | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Data Execution Prevention (DEP) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Export address filtering (EAF) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Force randomization for images (Mandatory ASLR) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -NullPage Security Mitigation | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Included natively in Windows 10
                        See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](images/svg/check-yes.svg)] -Randomize memory allocations (Bottom-Up ASLR) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Simulate execution (SimExec) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Validate API invocation (CallerCheck) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Validate exception chains (SEHOP) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Validate stack integrity (StackPivot) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Certificate trust (configurable certificate pinning) | Windows 10 provides enterprise certificate pinning | [!include[Check mark yes](images/svg/check-yes.svg)] -Heap spray allocation | Ineffective against newer browser-based exploits; newer mitigations provide better protection
                        See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](images/svg/check-yes.svg)] -Block low integrity images | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Code integrity guard | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Disable extension points | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Disable Win32k system calls | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Do not allow child processes | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Import address filtering (IAF) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Validate handle usage | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Validate heap integrity | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Validate image dependency integrity | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] - - ->[!NOTE] ->The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10, which other EMET advanced settings are enabled by default in Windows Defender Exploit Guard as part of enabling the anti-ROP mitigations for a process. -> ->See the [Mitigation threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information on how Windows 10 employs existing EMET technology. - - -## Related topics - -- [Protect devices from exploits with Windows Defender Exploit Guard](exploit-protection-exploit-guard.md) -- [Evaluate exploit protection](evaluate-exploit-protection.md) -- [Enable exploit protection](enable-exploit-protection.md) -- [Configure and audit exploit protection mitigations](customize-exploit-protection.md) -- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) - - diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md deleted file mode 100644 index 7a23a23e04..0000000000 --- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: Evaluate the impact of Windows Defender Exploit Guard -description: Use our evaluation guides to quickly enable and configure features, and test them against common attack scenarios -keywords: evaluate, guides, evaluation, exploit guard, controlled folder access, attack surface reduction, exploit protection, network protection, test, demo -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: levinec -ms.author: ellevin -ms.date: 05/30/2018 -ms.reviewer: -manager: dansimp ---- - -# Evaluate Windows Defender Exploit Guard - -**Applies to:** - -- Windows 10, version 1709 and later -- Windows Server 2016 - -Windows Defender Exploit Guard is a collection of tools and features that help you keep your network safe from exploits. Exploits are infection vectors for malware that rely on vulnerabilities in software. - -Windows Defender Exploit Guard is comprised of four features. We've developed evaluation guides for each of the features so you can easily and quickly see how they work and determine if they are suitable for your organization. - ->[!TIP] ->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how they work. - -Before you begin, you should read the main [Windows Defender Exploit Guard](windows-defender-exploit-guard.md) topic to get an understanding of each of the features and what their prerequisites are. - -- [Evaluate attack surface reduction](evaluate-attack-surface-reduction.md) -- [Evaluate controlled folder access](evaluate-controlled-folder-access.md) -- [Evaluate exploit protection](evaluate-exploit-protection.md) -- [Evaluate network protection](evaluate-network-protection.md) - -You might also be interested in enabling the features in audit mode - which allows you to see how the features work in the real world without impacting your organization or employee's work habits: - -- [Use audit mode to evaluate Windows Defender Exploit Guard features](audit-windows-defender-exploit-guard.md) - -## Related topics - -| Topic | Description | -|-------|-------------| -| | | - -- [Protect devices from exploits](exploit-protection-exploit-guard.md) -- [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction-exploit-guard.md) -- [Protect your network](network-protection-exploit-guard.md) -- [Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md deleted file mode 100644 index d701915788..0000000000 --- a/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -title: Apply mitigations to help prevent attacks through vulnerabilities -keywords: mitigations, vulnerabilities, vulnerability, mitigation, exploit, exploits, emet -description: Exploit protection in Windows 10 provides advanced configuration over the settings offered in EMET. -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: levinec -ms.author: ellevin -ms.date: 04/02/2019 -ms.reviewer: -manager: dansimp ---- - -# Protect devices from exploits - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Exploit protection automatically applies a number of exploit mitigation techniques to operating system processes and apps. - -It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). Exploit protection is supported beginning with Windows 10, version 1709 and Windows Server 2016, version 1803. - ->[!TIP] ->You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. - -Exploit protection works best with [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) - which gives you detailed reporting into exploit protection events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). - -You can [enable exploit protection](enable-exploit-protection.md) on an individual machine, and then use [Group Policy](import-export-exploit-protection-emet-xml.md) to distribute the XML file to multiple devices at once. - -When a mitigation is encountered on the machine, a notification will be displayed from the Action Center. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors. - -You can also use [audit mode](evaluate-exploit-protection.md) to evaluate how exploit protection would impact your organization if it were enabled. - -Many of the features in the [Enhanced Mitigation Experience Toolkit (EMET)](https://technet.microsoft.com/security/jj653751) have been included in Exploit protection, and you can convert and import existing EMET configuration profiles into Exploit protection. See [Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender Exploit Guard](emet-exploit-protection-exploit-guard.md) for more information on how Exploit protection supersedes EMET and what the benefits are when considering moving to exploit protection on Windows 10. - ->[!IMPORTANT] ->If you are currently using EMET you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with exploit protection in Windows 10. You can [convert an existing EMET configuration file into exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings. - ->[!WARNING] ->Some security mitigation technologies may have compatibility issues with some applications. You should test exploit protection in all target use scenarios by using [audit mode](audit-windows-defender-exploit-guard.md) before deploying the configuration across a production environment or the rest of your network. - -## Review exploit protection events in the Microsoft Security Center - -Microsoft Defender ATP provides detailed reporting into events and blocks as part of its alert investigation scenarios. - -You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender-exploit-guard.md), you can use Advanced hunting to see how exploit protection settings could affect your environment. - -Here is an example query: - -``` -MiscEvents -| where ActionType startswith 'ExploitGuard' and ActionType !contains 'NetworkProtection' -``` - -## Review exploit protection events in Windows Event Viewer - -You can review the Windows event log to see events that are created when exploit protection blocks (or audits) an app: - -Provider/source | Event ID | Description --|:-:|- -Security-Mitigations | 1 | ACG audit -Security-Mitigations | 2 | ACG enforce -Security-Mitigations | 3 | Do not allow child processes audit -Security-Mitigations | 4 | Do not allow child processes block -Security-Mitigations | 5 | Block low integrity images audit -Security-Mitigations | 6 | Block low integrity images block -Security-Mitigations | 7 | Block remote images audit -Security-Mitigations | 8 | Block remote images block -Security-Mitigations | 9 | Disable win32k system calls audit -Security-Mitigations | 10 | Disable win32k system calls block -Security-Mitigations | 11 | Code integrity guard audit -Security-Mitigations | 12 | Code integrity guard block -Security-Mitigations | 13 | EAF audit -Security-Mitigations | 14 | EAF enforce -Security-Mitigations | 15 | EAF+ audit -Security-Mitigations | 16 | EAF+ enforce -Security-Mitigations | 17 | IAF audit -Security-Mitigations | 18 | IAF enforce -Security-Mitigations | 19 | ROP StackPivot audit -Security-Mitigations | 20 | ROP StackPivot enforce -Security-Mitigations | 21 | ROP CallerCheck audit -Security-Mitigations | 22 | ROP CallerCheck enforce -Security-Mitigations | 23 | ROP SimExec audit -Security-Mitigations | 24 | ROP SimExec enforce -WER-Diagnostics | 5 | CFG Block -Win32K | 260 | Untrusted Font - -## Comparison between Enhanced Mitigation Experience Toolkit and Windows Defender Exploit Guard - ->[!IMPORTANT] ->If you are currently using EMET, you should be aware that [EMET reached end of life on July 31, 2018](https://blogs.technet.microsoft.com/srd/2016/11/03/beyond-emet/). You should consider replacing EMET with exploit protection in Microsoft Defender ATP. -> ->You can [convert an existing EMET configuration file into exploit protection](import-export-exploit-protection-emet-xml.md#convert-an-emet-configuration-file-to-an-exploit-protection-configuration-file) to make the migration easier and keep your existing settings. - -This section compares exploit protection in Microsoft Defender ATP with the Enhance Mitigation Experience Toolkit (EMET) for reference. -The table in this section illustrates the differences between EMET and Windows Defender Exploit Guard. - -  | Windows Defender Exploit Guard | EMET - -|:-:|:-: -Windows versions | [!include[Check mark yes](images/svg/check-yes.svg)]
                        All versions of Windows 10 starting with version 1709 | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Windows 8.1; Windows 8; Windows 7
                        Cannot be installed on Windows 10, version 1709 and later -Installation requirements | [Windows Security in Windows 10](../windows-defender-security-center/windows-defender-security-center.md)
                        (no additional installation required)
                        Windows Defender Exploit Guard is built into Windows - it doesn't require a separate tool or package for management, configuration, or deployment. | Available only as an additional download and must be installed onto a management device -User interface | Modern interface integrated with the [Windows Security app](../windows-defender-security-center/windows-defender-security-center.md) | Older, complex interface that requires considerable ramp-up training -Supportability | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Dedicated submission-based support channel](https://www.microsoft.com/en-us/wdsi/filesubmission)[[1](#fn1)]
                        [Part of the Windows 10 support lifecycle](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) | [!include[Check mark no](images/svg/check-no.svg)]
                        Ends after July 31, 2018 -Updates | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Ongoing updates and development of new features, released twice yearly as part of the [Windows 10 semi-annual update channel](https://blogs.technet.microsoft.com/windowsitpro/2017/07/27/waas-simplified-and-aligned/) | [!include[Check mark no](images/svg/check-no.svg)]
                        No planned updates or development -Exploit protection | [!include[Check mark yes](images/svg/check-yes.svg)]
                        All EMET mitigations plus new, specific mitigations ([see table](#mitigation-comparison))
                        [Can convert and import existing EMET configurations](import-export-exploit-protection-emet-xml.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Limited set of mitigations -Attack surface reduction[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Helps block known infection vectors](attack-surface-reduction-exploit-guard.md)
                        [Can configure individual rules](enable-attack-surface-reduction.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Limited ruleset configuration only for modules (no processes) -Network protection[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Helps block malicious network connections](network-protection-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)]
                        Not available -Controlled folder access[[2](#fn2)] | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Helps protect important folders](controlled-folders-exploit-guard.md)
                        [Configurable for apps and folders](customize-controlled-folders-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)]
                        Not available -Configuration with GUI (user interface) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Use Windows Security app to customize and manage configurations](customize-exploit-protection.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Requires installation and use of EMET tool -Configuration with Group Policy | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Use Group Policy to deploy and manage configurations](import-export-exploit-protection-emet-xml.md#manage-or-deploy-a-configuration) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Available -Configuration with shell tools | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Use PowerShell to customize and manage configurations](customize-exploit-protection.md#powershell-reference) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Requires use of EMET tool (EMET_CONF) -System Center Configuration Manager | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Use Configuration Manager to customize, deploy, and manage configurations](https://docs.microsoft.com/sccm/protect/deploy-use/create-deploy-exploit-guard-policy) | [!include[Check mark no](images/svg/check-no.svg)]
                        Not available -Microsoft Intune | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Use Intune to customize, deploy, and manage configurations](https://docs.microsoft.com/intune/whats-new#window-defender-exploit-guard-is-a-new-set-of-intrusion-prevention-capabilities-for-windows-10----1063615---) | [!include[Check mark no](images/svg/check-no.svg)]
                        Not available -Reporting | [!include[Check mark yes](images/svg/check-yes.svg)]
                        With [Windows event logs](event-views-exploit-guard.md) and [full audit mode reporting](audit-windows-defender-exploit-guard.md)
                        [Full integration with Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/secure-score-dashboard.md) | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Limited Windows event log monitoring -Audit mode | [!include[Check mark yes](images/svg/check-yes.svg)]
                        [Full audit mode with Windows event reporting](audit-windows-defender-exploit-guard.md) | [!include[Check mark no](images/svg/check-no.svg)]
                        Limited to EAF, EAF+, and anti-ROP mitigations - -([1](#ref1)) Requires an enterprise subscription with Azure Active Directory or a [Software Assurance ID](https://www.microsoft.com/en-us/licensing/licensing-programs/software-assurance-default.aspx). - -([2](#ref2-1)) Additional requirements may apply (such as use of Windows Defender Antivirus). See [Windows Defender Exploit Guard requirements](windows-defender-exploit-guard.md#requirements) for more details. Customizable mitigation options that are configured with [exploit protection](exploit-protection-exploit-guard.md) do not require Windows Defender Antivirus. - -## Mitigation comparison - -The mitigations available in EMET are included in Windows Defender Exploit Guard, under the [exploit protection feature](exploit-protection-exploit-guard.md). - -The table in this section indicates the availability and support of native mitigations between EMET and exploit protection. - -Mitigation | Available in Windows Defender Exploit Guard | Available in EMET --|:-:|:-: -Arbitrary code guard (ACG) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
                        As "Memory Protection Check" -Block remote images | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
                        As "Load Library Check" -Block untrusted fonts | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Data Execution Prevention (DEP) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Export address filtering (EAF) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Force randomization for images (Mandatory ASLR) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -NullPage Security Mitigation | [!include[Check mark yes](images/svg/check-yes.svg)]
                        Included natively in Windows 10
                        See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](images/svg/check-yes.svg)] -Randomize memory allocations (Bottom-Up ASLR) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Simulate execution (SimExec) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Validate API invocation (CallerCheck) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Validate exception chains (SEHOP) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Validate stack integrity (StackPivot) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] -Certificate trust (configurable certificate pinning) | Windows 10 provides enterprise certificate pinning | [!include[Check mark yes](images/svg/check-yes.svg)] -Heap spray allocation | Ineffective against newer browser-based exploits; newer mitigations provide better protection
                        See [Mitigate threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information | [!include[Check mark yes](images/svg/check-yes.svg)] -Block low integrity images | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Code integrity guard | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Disable extension points | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Disable Win32k system calls | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Do not allow child processes | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Import address filtering (IAF) | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Validate handle usage | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Validate heap integrity | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] -Validate image dependency integrity | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] - ->[!NOTE] ->The Advanced ROP mitigations that are available in EMET are superseded by ACG in Windows 10, which other EMET advanced settings are enabled by default in Windows Defender Exploit Guard as part of enabling the anti-ROP mitigations for a process. -> ->See the [Mitigation threats by using Windows 10 security features](../overview-of-threat-mitigations-in-windows-10.md#understanding-windows-10-in-relation-to-the-enhanced-mitigation-experience-toolkit) for more information on how Windows 10 employs existing EMET technology. - - -## Related topics - -- [Protect devices from exploits](exploit-protection-exploit-guard.md) -- [Evaluate exploit protection](evaluate-exploit-protection.md) -- [Enable exploit protection](enable-exploit-protection.md) -- [Configure and audit exploit protection mitigations](customize-exploit-protection.md) -- [Import, export, and deploy exploit protection configurations](import-export-exploit-protection-emet-xml.md) -- [Troubleshoot exploit protection](troubleshoot-exploit-protection-mitigations.md) - - diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/graphics.md b/windows/security/threat-protection/windows-defender-exploit-guard/graphics.md deleted file mode 100644 index 111bb99fc5..0000000000 --- a/windows/security/threat-protection/windows-defender-exploit-guard/graphics.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -ms.date: 09/18/2017 -ms.reviewer: -manager: dansimp -ms.author: ellevin -author: levinec ---- -Check mark no - - -Check mark yes diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/ball_50.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/ball_50.png deleted file mode 100644 index bab791f3c0..0000000000 Binary files a/windows/security/threat-protection/windows-defender-exploit-guard/images/ball_50.png and /dev/null differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/ball_75.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/ball_75.png deleted file mode 100644 index de277c05e1..0000000000 Binary files a/windows/security/threat-protection/windows-defender-exploit-guard/images/ball_75.png and /dev/null differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/ball_empty.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/ball_empty.png deleted file mode 100644 index 97f905f5ea..0000000000 Binary files a/windows/security/threat-protection/windows-defender-exploit-guard/images/ball_empty.png and /dev/null differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/ball_full.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/ball_full.png deleted file mode 100644 index 2bc45259d3..0000000000 Binary files a/windows/security/threat-protection/windows-defender-exploit-guard/images/ball_full.png and /dev/null differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/turn-windows-features-on-or-off.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/turn-windows-features-on-or-off.png deleted file mode 100644 index 8d47a53b51..0000000000 Binary files a/windows/security/threat-protection/windows-defender-exploit-guard/images/turn-windows-features-on-or-off.png and /dev/null differ diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/oldTOC.md b/windows/security/threat-protection/windows-defender-exploit-guard/oldTOC.md deleted file mode 100644 index eedb76c8dc..0000000000 --- a/windows/security/threat-protection/windows-defender-exploit-guard/oldTOC.md +++ /dev/null @@ -1,30 +0,0 @@ -# [Windows Defender Exploit Guard](windows-defender-exploit-guard.md) - -## [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) -### [Use auditing mode to evaluate Windows Defender Exploit Guard](audit-windows-defender-exploit-guard.md) -### [View Exploit Guard events](event-views-exploit-guard.md) - -## [Exploit protection](exploit-protection-exploit-guard.md) -### [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) -### [Evaluate Exploit protection](evaluate-exploit-protection.md) -### [Enable Exploit protection](enable-exploit-protection.md) -### [Customize Exploit protection](customize-exploit-protection.md) -#### [Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md) -### [Memory integrity](memory-integrity.md) -#### [Requirements for virtualization-based protection of code integrity](requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) -#### [Enable virtualization-based protection of code integrity](enable-virtualization-based-protection-of-code-integrity.md) -## [Attack surface reduction](attack-surface-reduction-exploit-guard.md) -### [Evaluate Attack surface reduction](evaluate-attack-surface-reduction.md) -### [Enable Attack surface reduction](enable-attack-surface-reduction.md) -### [Customize Attack surface reduction](customize-attack-surface-reduction.md) -### [Troubleshoot Attack surface reduction rules](troubleshoot-asr.md) -## [Network Protection](network-protection-exploit-guard.md) -### [Evaluate Network Protection](evaluate-network-protection.md) -### [Enable Network Protection](enable-network-protection.md) -### [Troubleshoot Network protection](troubleshoot-np.md) -## [Controlled folder access](controlled-folders-exploit-guard.md) -### [Evaluate Controlled folder access](evaluate-controlled-folder-access.md) -### [Enable Controlled folder access](enable-controlled-folders-exploit-guard.md) -### [Customize Controlled folder access](customize-controlled-folders-exploit-guard.md) - - diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/prerelease.md b/windows/security/threat-protection/windows-defender-exploit-guard/prerelease.md deleted file mode 100644 index 6e993c8c0a..0000000000 --- a/windows/security/threat-protection/windows-defender-exploit-guard/prerelease.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -ms.date: 08/25/2017 -ms.reviewer: -manager: dansimp -ms.author: ellevin -author: levinec ---- -> [!IMPORTANT] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md deleted file mode 100644 index a60d5f5a24..0000000000 --- a/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md +++ /dev/null @@ -1,90 +0,0 @@ ---- -title: Use Windows Defender Exploit Guard to protect your network -description: Windows Defender EG employs features that help protect your network from threats, including helping prevent ransomware encryption and exploit attacks -keywords: emet, exploit guard, Controlled folder access, Network protection, Exploit protection, Attack surface reduction, hips, host intrusion prevention system -search.product: eADQiWindows 10XVcnh -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: dansimp -ms.author: dansimp -ms.date: 08/09/2018 -ms.reviewer: -manager: dansimp ---- - -# Windows Defender Exploit Guard - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -Windows Defender Exploit Guard (Windows Defender EG) is a new set of host intrusion prevention capabilities for Windows 10, allowing you to manage and reduce the attack surface of apps used by your employees. - -There are four features in Windows Defender EG: - -- [Exploit protection](exploit-protection-exploit-guard.md) can apply exploit mitigation techniques to apps your organization uses, both individually and to all apps. Works with third-party antivirus solutions and Windows Defender Antivirus (Windows Defender AV). -- [Attack surface reduction rules](attack-surface-reduction-exploit-guard.md) can reduce the attack surface of your applications with intelligent rules that stop the vectors used by Office-, script- and mail-based malware. Requires Windows Defender AV. -- [Network protection](network-protection-exploit-guard.md) extends the malware and social engineering protection offered by Windows Defender SmartScreen in Microsoft Edge to cover network traffic and connectivity on your organization's devices. Requires Windows Defender AV. -- [Controlled folder access](controlled-folders-exploit-guard.md) helps protect files in key system folders from changes made by malicious and suspicious apps, including file-encrypting ransomware malware. Requires Windows Defender AV. - -Windows 10, version 1803 provides additional protections: - -- New Attack surface reduction rules -- Controlled folder access can now block disk sectors - -You can evaluate each feature of Windows Defender EG with the guides at the following link, which provide pre-built PowerShell scripts and testing tools so you can see the features in action: -- [Evaluate Windows Defender Exploit Guard](evaluate-windows-defender-exploit-guard.md) - - -You can also [enable audit mode](audit-windows-defender-exploit-guard.md) for the features, which provides you with basic event logs that indicate how the feature would have responded if it had been fully enabled. This can be useful when evaluating the impact of Windows Defender EG and to help determine the impact of the features on your network's security. - ->[!TIP] ->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the features are working and see how each of them work. - -Windows Defender EG can be managed and reported on in the Windows Security app as part of the Microsoft Defender Advanced Threat Protection suite of threat mitigation, preventing, protection, and analysis technologies. - -You can use the Windows Security app to obtain detailed reporting into events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). You can [sign up for a free trial of Microsoft Defender ATP](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=cx-docs-msa4053440) to see how it works. - -## Requirements - -This section covers requirements for each feature in Windows Defender EG. - -| Symbol | Support | -|--------|---------| -| ![not supported](./images/ball_empty.png) | Not supported | -| ![supported](./images/ball_50.png) | Supported | -| ![supported, full reporting](./images/ball_full.png) | Recommended. Includes full, automated reporting into the Microsoft Defender ATP console. Provides additional cloud-powered capabilities, including the Network protection ability to block apps from accessing low-reputation websites and an attack surface reduction rule that blocks executable files that meet age or prevalence criteria.| - -| Feature | Windows 10 Home | Windows 10 Professional | Windows 10 Enterprise | Windows 10 with Enterprise E3 subscription | Windows 10 with Enterprise E5 subscription | -| ----------------- | :------------------------------------: | :---------------------------: | :-------------------------: | :--------------------------------------: | :--------------------------------------: | -| Exploit protection | ![supported](./images/ball_50.png) | ![supported](./images/ball_50.png) | ![supported, enhanced](./images/ball_50.png) | ![supported, enhanced](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | -| Attack surface reduction rules | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | -| Network protection | ![not supported](./images/ball_empty.png) | ![not supported](./images/ball_empty.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | -| Controlled folder access | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, limited reporting](./images/ball_50.png) | ![supported, full reporting](./images/ball_full.png) | - ->[!NOTE] -> The [Identity & Threat Protection package](https://www.microsoft.com/microsoft-365/blog/2019/01/02/introducing-new-advanced-security-and-compliance-offerings-for-microsoft-365/), available for Microsoft 365 E3 customers, provides the same Windows Defender ATP capabilities as the Enterprise E5 subscription. - -The following table lists which features in Windows Defender EG require enabling [real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) from Windows Defender Antivirus. - -| Feature | Real-time protection | -|-----------------| ------------------------------------ | -| Exploit protection | No requirement | -| Attack surface reduction rules | Must be enabled | -| Network protection | Must be enabled | -| Controlled folder access | Must be enabled | - - ## In this library - -Topic | Description ----|--- -[Protect devices from exploits](exploit-protection-exploit-guard.md) | Exploit protection provides you with many of the features in now-retired Enhanced Mitigations Experience Toolkit - and adds additional configuration and technologies. These features can help prevent threats from using vulnerabilities to gain access to your network and devices. You can create a template of settings that can be exported and copied to multiple machines in your network at once. -[Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction-exploit-guard.md) | Use pre-built rules to manage mitigations for key attack and infection vectors, such as Office-based malicious macro code and PowerShell, VBScript, and JavaScript scripts. -[Protect your network](network-protection-exploit-guard.md) | Minimize the exposure of your devices from network and web-based infection vectors. -[Protect important folders with controlled folder access](controlled-folders-exploit-guard.md) | Prevent unknown or unauthorized apps (including ransomware encryption malware) from writing to sensitive folders, such as folders containing sensitive or business-critical data. - - diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md index ca32f2c55a..001c490193 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md @@ -9,6 +9,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium +audience: ITPro author: dansimp ms.author: dansimp ms.date: 04/30/2018 @@ -16,64 +17,63 @@ ms.reviewer: manager: dansimp --- - # App and browser control **Applies to** - Windows 10, version 1703 and later - The **App and browser control** section contains information and settings for Windows Defender SmartScreen. IT administrators and IT pros can get configuration guidance from the [Windows Defender SmartScreen documentation library](https://docs.microsoft.com/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview). -In Windows 10, version 1709 and later, the section also provides configuration options for Exploit protection. You can prevent users from modifying these specific options with Group Policy. IT administrators can get more information at the [Exploit protection](../windows-defender-exploit-guard/exploit-protection-exploit-guard.md) topic in the Windows Defender Exploit Guard library. +In Windows 10, version 1709 and later, the section also provides configuration options for Exploit protection. You can prevent users from modifying these specific options with Group Policy. IT administrators can get more information at [Exploit protection](../microsoft-defender-atp/exploit-protection.md). You can also choose to hide the section from users of the machine. This can be useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section. - ## Prevent users from making changes to the Exploit protection area in the App & browser control section You can prevent users from modifying settings in the Exploit protection area. The settings will be either greyed out or not appear if you enable this setting. Users will still have access to other settings in the App & browser control section, such as those for Windows Defender SmartScreen, unless those options have been configured separately. You can only prevent users from modifying Exploit protection settings by using Group Policy. ->[!IMPORTANT] ->### Requirements +> [!IMPORTANT] > ->You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +> ### Requirements +> +> You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Security > App and browser protection**. +3. Expand the tree to **Windows components > Windows Security > App and browser protection**. -6. Open the **Prevent users from modifying settings** setting and set it to **Enabled**. Click **OK**. +4. Open the **Prevent users from modifying settings** setting and set it to **Enabled**. Click **OK**. -7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). +5. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). ## Hide the App & browser control section -You can choose to hide the entire section by using Group Policy. The section will not appear on the home page of the Windows Security app, and its icon will not be shown on the navigiation bar on the side of the app. +You can choose to hide the entire section by using Group Policy. The section will not appear on the home page of the Windows Security app, and its icon will not be shown on the navigation bar on the side of the app. This can only be done in Group Policy. ->[!IMPORTANT] ->### Requirements +> [!IMPORTANT] > ->You must have Windows 10, version 1709 (the Fall Creators Update). The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +> ### Requirements +> +> You must have Windows 10, version 1709 (the Fall Creators Update). The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Security > App and browser protection**. +3. Expand the tree to **Windows components > Windows Security > App and browser protection**. -6. Open the **Hide the App and browser protection area** setting and set it to **Enabled**. Click **OK**. +4. Open the **Hide the App and browser protection area** setting and set it to **Enabled**. Click **OK**. -7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). +5. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). ->[!NOTE] ->If you hide all sections then the app will show a restricted interface, as in the following screenshot: -> ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) +> [!NOTE] +> If you hide all sections then the app will show a restricted interface, as in the following screenshot: +> +> ![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md index 9692fa9046..d84d263388 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md @@ -30,23 +30,23 @@ manager: dansimp - Group Policy -You can add information about your organization in a contact card to the Windows Security app. This can include a link to a support site, a phone number for a help desk, and an email address for email-based support. +You can add information about your organization in a contact card to the Windows Security app. This can include a link to a support site, a phone number for a help desk, and an email address for email-based support. -![](images/security-center-custom-flyout.png) +![The security center custom fly-out](images/security-center-custom-flyout.png) -This information will also be shown in some enterprise-specific notifications (including those for [Windows Defender Exploit Guard](/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard), the [Block at first sight feature](/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus), and [potentially unwanted applications](/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus). - -![](images/security-center-custom-notif.png) +This information will also be shown in some enterprise-specific notifications (including those for the [Block at first sight feature](/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus), and [potentially unwanted applications](/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus). +![A security center notification](images/security-center-custom-notif.png) Users can click on the displayed information to initiate a support request: + - Clicking **Call** or the phone number will open Skype to start a call to the displayed number - Clicking **Email** or the email address will create a new email in the machine's default email app address to the displayed email - Clicking **Help portal** or the website URL will open the machine's default web browser and go to the displayed address ## Requirements -You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. +You must have Windows 10, version 1709 or later. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. ## Use Group Policy to enable and customize contact information @@ -54,29 +54,26 @@ There are two stages to using the contact card and customized notifications. Fir This can only be done in Group Policy. -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. -3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. +2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. -5. Expand the tree to **Windows components > Windows Security > Enterprise Customization**. +3. Expand the tree to **Windows components > Windows Security > Enterprise Customization**. -6. You enable the contact card and the customized notifications by configuring two separate Group Policy settings. They will both use the same source of information (explained in Steps 7 and 8), and you can enable both or only one or the other: +4. Enable the contact card and the customized notifications by configuring two separate Group Policy settings. They will both use the same source of information (explained in Steps 5 and 6). You can enable both, or slect one or the other: 1. To enable the contact card, open the **Configure customized contact information** setting and set it to **Enabled**. Click **OK**. 2. To enable the customized notifications, open the **Configure customized notifications** setting and set it to **Enabled**. Click **OK**. -7. After you've enabled the contact card or the customized notifications (or both), you must configure the **Specify contact company name** to **Enabled**. Enter your company or organization's name in the field in the **Options** section. Click **OK**. +5. After you've enabled the contact card or the customized notifications (or both), you must configure the **Specify contact company name** to **Enabled**. Enter your company or organization's name in the field in the **Options** section. Click **OK**. -8. To ensure the custom notifications or contact card appear, you must also configure at least one of the following settings by opening them, setting them to **Enabled** and adding the contact information in the field under **Options**: +6. To ensure the custom notifications or contact card appear, you must also configure at least one of the following settings by opening them, setting them to **Enabled** and adding the contact information in the field under **Options**: 1. **Specify contact email address or Email ID** 2. **Specify contact phone number or Skype ID** 3. **Specify contact website** -9. Click **OK** after configuring each setting to save your changes. - +7. Click **OK** after configuring each setting to save your changes. >[!IMPORTANT] >You must specify the contact company name and at least one contact method - email, phone number, or website URL. If you do not specify the contact name and a contact method the customization will not apply, the contact card will not show, and notifications will not be customized. - - diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md index dc0bab469f..875fd5bfae 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md @@ -56,7 +56,9 @@ This can only be done in Group Policy. > >You must have Windows 10, version 1903. The ADMX/ADML template files for earlier versions of Windows do not include these Group Policy settings. -1. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. +1. Download the latest [Administrative Templates (.admx) for Windows 10, v1809](https://www.microsoft.com/download/details.aspx?id=57576). + +2. On your Group Policy management machine, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**. 3. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. @@ -86,7 +88,18 @@ This can only be done in Group Policy. 6. Open the **Hide all notifications** setting and set it to **Enabled**. Click **OK**. -7. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). +7. Use the following registry key and DWORD value to **Hide all notifications**. + + **[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications]** + **"DisableNotifications"=dword:00000001** + +8. Use the following registry key and DWORD value to **Hide not-critical notifications** + + **[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications]** + **"DisableEnhancedNotifications"=dword:00000001** + +9. [Deploy the updated GPO as you normally do](https://msdn.microsoft.com/library/ee663280(v=vs.85).aspx). + ## Notifications @@ -136,3 +149,4 @@ This can only be done in Group Policy. | Dynamic lock on, bluetooth on, but unable to detect device | | | No | | NoPa or federated no hello | | | No | | NoPa or federated hello broken | | | No | + diff --git a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md index a12e0b136b..af8816db71 100644 --- a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md @@ -16,10 +16,6 @@ ms.reviewer: manager: dansimp --- - - - - # The Windows Security app **Applies to** @@ -29,6 +25,7 @@ manager: dansimp This library describes the Windows Security app, and provides information on configuring certain features, including: + - [Showing and customizing contact information on the app and in notifications](wdsc-customize-contact-information.md) - [Hiding notifications](wdsc-hide-notifications.md) @@ -38,33 +35,32 @@ In Windows 10, version 1803, the app has two new areas, **Account protection** a ![Screen shot of the Windows Security app showing that the device is protected and five icons for each of the features](images/security-center-home.png) ->[!NOTE] ->The Windows Security app is a client interface on Windows 10, version 1703 and later. It is not the Microsoft Defender Security Center web portal console that is used to review and manage [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection). +> [!NOTE] +> The Windows Security app is a client interface on Windows 10, version 1703 and later. It is not the Microsoft Defender Security Center web portal console that is used to review and manage [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection). You can't uninstall the Windows Security app, but you can do one of the following: -- Disable the interface on Windows Server 2016. See [Windows Defender Antivirus on Windows Server 2016](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016). +- Disable the interface on Windows Server 2016. See [Windows Defender Antivirus on Windows Server 2016](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016). - Hide all of the sections on client computers (see below). - Disable Windows Defender Antivirus, if needed. See [Enable and configure Windows Defender AV always-on protection and monitoring](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus). You can find more information about each section, including options for configuring the sections - such as hiding each of the sections - at the following topics: - -- [Virus & threat protection](wdsc-virus-threat-protection.md), which has information and access to antivirus ransomware protection settings and notifications, including the Controlled folder access feature of Windows Defender Exploit Guard and sign-in to Microsoft OneDrive. -- [Account protection](wdsc-account-protection.md), which has information and access to sign-in and account protection settings. +- [Virus & threat protection](wdsc-virus-threat-protection.md), which has information and access to antivirus ransomware protection settings and notifications, including Controlled folder access, and sign-in to Microsoft OneDrive. +- [Account protection](wdsc-account-protection.md), which has information and access to sign-in and account protection settings. - [Firewall & network protection](wdsc-firewall-network-protection.md), which has information and access to firewall settings, including Windows Defender Firewall. - [App & browser control](wdsc-app-browser-control.md), covering Windows Defender SmartScreen settings and Exploit protection mitigations. - [Device security](wdsc-device-security.md), which provides access to built-in device security settings. - [Device performance & health](wdsc-device-performance-health.md), which has information about drivers, storage space, and general Windows Update issues. - [Family options](wdsc-family-options.md), which includes access to parental controls along with tips and information for keeping kids safe online. - ->[!NOTE] ->If you hide all sections then the app will show a restricted interface, as in the following screenshot: -> ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) +> [!NOTE] +> If you hide all sections then the app will show a restricted interface, as in the following screenshot: +> +> ![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) ## Open the Windows Security app + - Click the icon in the notification area on the taskbar. ![Screen shot of the icon for the Windows Security app on the Windows task bar](images/security-center-taskbar.png) @@ -75,34 +71,30 @@ You can find more information about each section, including options for configur ![Screen shot of Windows Settings showing the different areas available in the Windows Security](images/settings-windows-defender-security-center-areas.png) - > [!NOTE] > Settings configured with management tools, such as Group Policy, Microsoft Intune, or System Center Configuration Manager, will generally take precedence over the settings in the Windows Security. See the topics for each of the sections for links to configuring the associated features or products. - - ## How the Windows Security app works with Windows security features - ->[!IMPORTANT] ->Windows Defender AV and the Windows Security app use similarly named services for specific purposes. -> ->The Windows Security app uses the Windows Security Service (*SecurityHealthService* or *Windows Security Health Servce*), which in turn utilizes the Security Center service ([*wscsvc*](https://technet.microsoft.com/library/bb457154.aspx#EDAA)) to ensure the app provides the most up-to-date information about the protection status on the endpoint, including protection offered by third-party antivirus products, Windows Defender Firewall, third-party firewalls, and other security protection. -> +> [!IMPORTANT] +> Windows Defender AV and the Windows Security app use similarly named services for specific purposes. +> +> The Windows Security app uses the Windows Security Service (*SecurityHealthService* or *Windows Security Health Servce*), which in turn utilizes the Security Center service ([*wscsvc*](https://technet.microsoft.com/library/bb457154.aspx#EDAA)) to ensure the app provides the most up-to-date information about the protection status on the endpoint, including protection offered by third-party antivirus products, Windows Defender Firewall, third-party firewalls, and other security protection. +> >These services do not affect the state of Windows Defender AV. Disabling or modifying these services will not disable Windows Defender AV, and will lead to a lowered protection state on the endpoint, even if you are using a third-party antivirus product. -> +> >Windows Defender AV will be [disabled automatically when a third-party antivirus product is installed and kept up to date](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md). -> ->Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). +> +> Disabling the Windows Security Center service will not disable Windows Defender AV or [Windows Defender Firewall](https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security). > [!WARNING] -> If you disable the Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. -> ->It may also prevent Windows Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed. -> ->This will significantly lower the protection of your device and could lead to malware infection. +> If you disable the Security Center service, or configure its associated Group Policy settings to prevent it from starting or running, the Windows Security app may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. +> +> It may also prevent Windows Defender AV from enabling itself if you have an old or outdated third-party antivirus, or if you uninstall any third-party antivirus products you may have previously installed. +> +> This will significantly lower the protection of your device and could lead to malware infection. -The Windows Security app operates as a separate app or process from each of the individual features, and will display notifications through the Action Center. +The Windows Security app operates as a separate app or process from each of the individual features, and will display notifications through the Action Center. It acts as a collector or single place to see the status and perform some configuration for each of the features. @@ -112,18 +104,3 @@ Disabling any of the individual features (through Group Policy or other manageme > Individually disabling any of the services will not disable the other services or the Windows Security app. For example, [using a third-party antivirus will disable Windows Defender Antivirus](https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility). However, the Windows Security app will still run, show its icon in the taskbar, and display information about the other features, such as Windows Defender SmartScreen and Windows Defender Firewall. - - - - - - - - - - - - - - - diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md index 027d92a3b4..9d214a2b3c 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium ms.date: 07/27/2017 ms.reviewer: manager: dansimp -ms.author: mjcaparas +ms.author: macapara --- # Windows Defender SmartScreen diff --git a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md index f9fb884957..ca7c0039c1 100644 --- a/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md +++ b/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium ms.date: 10/13/2017 ms.reviewer: manager: dansimp -ms.author: mjcaparas +ms.author: macapara --- # Set up and use Windows Defender SmartScreen on individual devices diff --git a/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md b/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md index 8de4021830..cde7dc4fc5 100644 --- a/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md +++ b/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md @@ -14,7 +14,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/11/2019 --- # Create Windows Firewall rules in Intune @@ -35,29 +34,7 @@ Select Windows Defender Firewall. ## Firewall rule components -Following table has description for each field. - - -| Property | Type | Description | -|----------|------|-------------| -| DisplayName | String | The display name of the rule. Does not need to be unique. | -| Description | String | The description of the rule. | -| PackageFamilyName | String | The package family name of a Microsoft Store application that's affected by the firewall rule. | -| FilePath | String | The full file path of an app that's affected by the firewall rule. | -| FullyQualifiedBinaryName | String | The fully qualified binary name. | -| ServiceName | String | The name used in cases when a service, not an application, is sending or receiving traffic. | -| Protocol | Nullable Integer - default value is null which maps to All | 0-255 number representing the [IP protocol](https://www.wikipedia.org/wiki/List_of_IP_protocol_numbers) (TCP = 6, UDP = 17). If not specified, the default is All. | -| LocalPortRanges | String array | List of local port ranges. For example, "100-120", "200", "300-320". If not specified, the default is All. | -| RemotePortRanges | String array | List of remote port ranges. For example, "100-120", "200", "300-320". If not specified, the default is All. | -| LocalAddressRanges | String array | List of local addresses covered by the rule. Valid tokens include:
                        - "\*" indicates any local address. If present, this must be the only token included.
                        - A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255.
                        - A valid IPv6 address.
                        - An IPv4 address range in the format of "start address - end address" with no spaces included.
                        - An IPv6 address range in the format of "start address - end address" with no spaces included.
                        Default is any address. | -| RemoteAddressRanges | String array | List of tokens specifying the remote addresses covered by the rule.Tokens are case insensitive. Valid tokens include:
                        - "\*" indicates any remote address. If present, this must be the only token included.
                        - "Defaultgateway"
                        - "DHCP"
                        - "DNS"
                        - "WINS"
                        - "Intranet"
                        - "RmtIntranet"
                        - "Internet"
                        - "Ply2Renders"
                        - "LocalSubnet" indicates any local address on the local subnet. This token is not case-sensitive.
                        - A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255.
                        - A valid IPv6 address.
                        - An IPv4 address range in the format of "start address - end address" with no spaces included.
                        - An IPv6 address range in the format of "start address - end address" with no spaces included.
                        Default is any address. | -| ProfileTypes | WindowsFirewallNetworkProfileTypes | Specifies the profiles to which the rule belongs. If not specified, the default is All. | -| Action| StateManagementSetting | The action the rule enforces. If not specified, the default is Allowed. | -| TrafficDirection | WindowsFirewallRuleTrafficDirectionType | The traffic direction that the rule is enabled for. If not specified, the default is Out. | -| InterfaceTypes | WindowsFirewallRuleInterfaceTypes | The interface types of the rule. | -| EdgeTraversal | StateManagementSetting | Indicates whether edge traversal is enabled or disabled for this rule.
                        The EdgeTraversal setting indicates that specific inbound traffic is allowed to tunnel through NATs and other edge devices using the Teredo tunneling technology. In order for this setting to work correctly, the application or service with the inbound firewall rule needs to support IPv6. The primary application of this setting allows listeners on the host to be globally addressable through a Teredo IPv6 address.
                        New rules have the EdgeTraversal property disabled by default. | -| LocalUserAuthorizations | String | Specifies the list of authorized local users for the app container. This is a string in Security Descriptor Definition Language (SDDL) format. | - +The firewall rule configurations in Intune use the Windows 10 CSP for Firewall. For more information, see [Firewall CSP](https://docs.microsoft.com/en-us/windows/client-management/mdm/firewall-csp). ## Application Control connections for an app or program. @@ -123,8 +100,8 @@ Default is Any address. [Learn more](https://aka.ms/intunefirewallremotaddressrule) -## Edge traversal (coming soon) -Indicates whether edge traversal is enabled or disabled for this rule. The EdgeTraversal setting indicates that specific inbound traffic is allowed to tunnel through NATs and other edge devices using the Teredo tunneling technology. In order for this setting to work correctly, the application or service with the inbound firewall rule needs to support IPv6. The primary application of this setting allows listeners on the host to be globally addressable through a Teredo IPv6 address. New rules have the EdgeTraversal property disabled by default. +## Edge traversal (UI coming soon) +Indicates whether edge traversal is enabled or disabled for this rule. The EdgeTraversal setting indicates that specific inbound traffic is allowed to tunnel through NATs and other edge devices using the Teredo tunneling technology. In order for this setting to work correctly, the application or service with the inbound firewall rule needs to support IPv6. The primary application of this setting allows listeners on the host to be globally addressable through a Teredo IPv6 address. New rules have the EdgeTraversal property disabled by default. This setting can only be configured via Intune Graph at this time. [Learn more](https://aka.ms/intunefirewalledgetraversal) diff --git a/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md b/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md index 9c6966b525..5ded02bd51 100644 --- a/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md +++ b/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md @@ -80,7 +80,7 @@ This script does the following: Type each cmdlet on a single line, even though they may appear to wrap across several lines because of formatting constraints. -``` syntax +```powershell # Create a Security Group for the computers that will get the policy $pathname = (Get-ADDomain).distinguishedname New-ADGroup -name "IPsec client and servers" -SamAccountName "IPsec client and servers" ` @@ -120,7 +120,7 @@ Use a Windows PowerShell script similar to the following to create a local IPsec Type each cmdlet on a single line, even though they may appear to wrap across several lines because of formatting constraints. -``` syntax +```powershell #Set up the certificate $certprop = New-NetIPsecAuthProposal -machine -cert -Authority "DC=com, DC=contoso, DC=corp, CN=corp-APP1-CA" $myauth = New-NetIPsecPhase1AuthSet -DisplayName "IKEv2TestPhase1AuthSet" -proposal $certprop @@ -173,7 +173,7 @@ Follow these procedures to verify and troubleshoot your IKEv2 IPsec connections: 6. Open the wfpdiag.xml file with your an XML viewer program or Notepad, and then examine the contents. There will be a lot of data in this file. One way to narrow down where to start looking is to search the last “errorFrequencyTable” at the end of the file. There might be many instances of this table, so make sure that you look at the last table in the file. For example, if you have a certificate problem, you might see the following entry in the last table at the end of the file: - ``` syntax + ```xml ERROR_IPSEC_IKE_NO_CERT 32 diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md index 79ee3e58bd..4daaa5d367 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md @@ -67,7 +67,7 @@ netsh advfirewall set allprofiles state on **Windows PowerShell** -``` syntax +```powershell Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True ``` @@ -88,7 +88,7 @@ netsh advfirewall set allprofiles logging filename %SystemRoot%\System32\LogFile Windows PowerShell -``` syntax +```powershell Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow –NotifyOnListen True -AllowUnicastResponseToMulticast True –LogFileName %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log ``` @@ -140,7 +140,7 @@ netsh advfirewall firewall add rule name="Allow Inbound Telnet" dir=in program= Windows PowerShell -``` syntax +```powershell New-NetFirewallRule -DisplayName “Allow Inbound Telnet” -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow ``` @@ -157,7 +157,7 @@ netsh advfirewall firewall add rule name="Block Outbound Telnet" dir=out program Windows PowerShell -``` syntax +```powershell New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe –Protocol TCP –LocalPort 23 -Action Block –PolicyStore domain.contoso.com\gpo_name ``` @@ -169,7 +169,7 @@ The following performs the same actions as the previous example (by adding a Tel Windows PowerShell -``` syntax +```powershell $gpo = Open-NetGPO –PolicyStore domain.contoso.com\gpo_name New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\telnet.exe –Protocol TCP –LocalPort 23 -Action Block –GPOSession $gpo Save-NetGPO –GPOSession $gpo @@ -191,7 +191,7 @@ netsh advfirewall firewall set rule name="Allow Web 80" new remoteip=192.168.0.2 Windows PowerShell -``` syntax +```powershell Set-NetFirewallRule –DisplayName “Allow Web 80” -RemoteAddress 192.168.0.2 ``` @@ -205,7 +205,7 @@ In the following example, we assume the query returns a single firewall rule, wh Windows PowerShell -``` syntax +```powershell Get-NetFirewallPortFilter | ?{$_.LocalPort -eq 80} | Get-NetFirewallRule | ?{ $_.Direction –eq “Inbound” -and $_.Action –eq “Allow”} | Set-NetFirewallRule -RemoteAddress 192.168.0.2 ``` @@ -213,7 +213,7 @@ You can also query for rules using the wildcard character. The following example Windows PowerShell -``` syntax +```powershell Get-NetFirewallApplicationFilter -Program "*svchost*" | Get-NetFirewallRule ``` @@ -223,7 +223,7 @@ In the following example, we add both inbound and outbound Telnet firewall rules Windows PowerShell -``` syntax +```powershell New-NetFirewallRule -DisplayName “Allow Inbound Telnet” -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow –Group “Telnet Management” New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow –Group “Telnet Management” ``` @@ -232,7 +232,7 @@ If the group is not specified at rule creation time, the rule can be added to th Windows PowerShell -``` syntax +```powershell $rule = Get-NetFirewallRule -DisplayName “Allow Inbound Telnet” $rule.Group = “Telnet Management” $rule | Set-NetFirewallRule @@ -250,7 +250,7 @@ netsh advfirewall firewall set rule group="Windows Defender Firewall remote mana Windows PowerShell -``` syntax +```powershell Set-NetFirewallRule -DisplayGroup “Windows Defender Firewall Remote Management” –Enabled True ``` @@ -258,7 +258,7 @@ There is also a separate `Enable-NetFirewallRule` cmdlet for enabling rules by g Windows PowerShell -``` syntax +```powershell Enable-NetFirewallRule -DisplayGroup “Windows Defender Firewall Remote Management” -Verbose ``` @@ -276,7 +276,7 @@ netsh advfirewall firewall delete rule name=“Allow Web 80” Windows PowerShell -``` syntax +```powershell Remove-NetFirewallRule –DisplayName “Allow Web 80” ``` @@ -284,7 +284,7 @@ Like with other cmdlets, you can also query for rules to be removed. Here, all b Windows PowerShell -``` syntax +```powershell Remove-NetFirewallRule –Action Block ``` @@ -292,7 +292,7 @@ Note that it may be safer to query the rules with the **Get** command and save i Windows PowerShell -``` syntax +```powershell $x = Get-NetFirewallRule –Action Block $x $x[0-3] | Remove-NetFirewallRule @@ -306,7 +306,7 @@ The following example returns all firewall rules of the persistent store on a de Windows PowerShell -``` syntax +```powershell Get-NetFirewallRule –CimSession RemoteDevice ``` @@ -314,7 +314,7 @@ We can perform any modifications or view rules on remote devices by simply usin Windows PowerShell -``` syntax +```powershell $RemoteSession = New-CimSession –ComputerName RemoteDevice Remove-NetFirewallRule –DisplayName “AllowWeb80” –CimSession $RemoteSession -Confirm ``` @@ -342,7 +342,7 @@ netsh advfirewall consec add rule name="Require Inbound Authentication" endpoint Windows PowerShell -``` syntax +```powershell New-NetIPsecRule -DisplayName “Require Inbound Authentication” -PolicyStore domain.contoso.com\gpo_name ``` @@ -365,7 +365,7 @@ netsh advfirewall consec add rule name="Require Outbound Authentication" endpoin Windows PowerShell -``` syntax +```powershell $AHandESPQM = New-NetIPsecQuickModeCryptoProposal -Encapsulation AH,ESP –AHHash SHA1 -ESPHash SHA1 -Encryption DES3 $QMCryptoSet = New-NetIPsecQuickModeCryptoSet –DisplayName “ah:sha1+esp:sha1-des3” -Proposal $AHandESPQM –PolicyStore domain.contoso.com\gpo_name New-NetIPsecRule -DisplayName “Require Inbound Authentication” -InboundSecurity Require -OutboundSecurity Request -QuickModeCryptoSet $QMCryptoSet.Name –PolicyStore domain.contoso.com\gpo_name @@ -379,7 +379,7 @@ You can leverage IKEv2 capabilities in Windows Server 2012 by simply specifying Windows PowerShell -``` syntax +```powershell New-NetIPsecRule -DisplayName “Require Inbound Authentication” -InboundSecurity Require -OutboundSecurity Request –Phase1AuthSet MyCertAuthSet -KeyModule IKEv2 –RemoteAddress $nonWindowsGateway ``` @@ -395,7 +395,7 @@ Copying individual rules is a task that is not possible through the Netsh interf Windows PowerShell -``` syntax +```powershell $Rule = Get-NetIPsecRule –DisplayName “Require Inbound Authentication” $Rule | Copy-NetIPsecRule –NewPolicyStore domain.costoso.com\new_gpo_name $Rule | Copy-NetPhase1AuthSet –NewPolicyStore domain.costoso.com\new_gpo_name @@ -407,7 +407,7 @@ To handle errors in your Windows PowerShell scripts, you can use the *–ErrorAc Windows PowerShell -``` syntax +```powershell Remove-NetFirewallRule –DisplayName “Contoso Messenger 98” –ErrorAction SilentlyContinue ``` @@ -415,7 +415,7 @@ Note that the use of wildcards can also suppress errors, but they could potentia Windows PowerShell -``` syntax +```powershell Remove-NetFirewallRule –DisplayName “Contoso Messenger 98*” ``` @@ -423,7 +423,7 @@ When using wildcards, if you want to double-check the set of rules that is match Windows PowerShell -``` syntax +```powershell Remove-NetFirewallRule –DisplayName “Contoso Messenger 98*” –WhatIf ``` @@ -431,7 +431,7 @@ If you only want to delete some of the matched rules, you can use the *–Confir Windows PowerShell -``` syntax +```powershell Remove-NetFirewallRule –DisplayName “Contoso Messenger 98*” –Confirm ``` @@ -439,7 +439,7 @@ You can also just perform the whole operation, displaying the name of each rule Windows PowerShell -``` syntax +```powershell Remove-NetFirewallRule –DisplayName “Contoso Messenger 98*” –Verbose ``` @@ -457,7 +457,7 @@ netsh advfirewall consec show rule name=all Windows PowerShell -``` syntax +```powershell Show-NetIPsecRule –PolicyStore ActiveStore ``` @@ -473,7 +473,7 @@ netsh advfirewall monitor show mmsa all Windows PowerShell -``` syntax +```powershell Get-NetIPsecMainModeSA ``` @@ -485,7 +485,7 @@ For objects that come from a GPO (the *–PolicyStoreSourceType* parameter is sp Windows PowerShell -``` syntax +```powershell Get-NetIPsecRule –DisplayName “Require Inbound Authentication” –TracePolicyStore ``` @@ -506,7 +506,7 @@ netsh advfirewall consec add rule name=“Basic Domain Isolation Policy” profi Windows PowerShell -``` syntax +```powershell $kerbprop = New-NetIPsecAuthProposal –Machine –Kerberos $Phase1AuthSet = New-NetIPsecPhase1AuthSet -DisplayName "Kerberos Auth Phase1" -Proposal $kerbprop –PolicyStore domain.contoso.com\domain_isolation New-NetIPsecRule –DisplayName “Basic Domain Isolation Policy” –Profile Domain –Phase1AuthSet $Phase1AuthSet.Name –InboundSecurity Require –OutboundSecurity Request –PolicyStore domain.contoso.com\domain_isolation @@ -524,7 +524,7 @@ netsh advfirewall consec add rule name="Tunnel from 192.168.0.0/16 to 192.157.0. Windows PowerShell -``` syntax +```powershell $QMProposal = New-NetIPsecQuickModeCryptoProposal -Encapsulation ESP -ESPHash SHA1 -Encryption DES3 $QMCryptoSet = New-NetIPsecQuickModeCryptoSet –DisplayName “esp:sha1-des3” -Proposal $QMProposal New-NetIPSecRule -DisplayName “Tunnel from HQ to Dallas Branch” -Mode Tunnel -LocalAddress 192.168.0.0/16 -RemoteAddress 192.157.0.0/16 -LocalTunnelEndpoint 1.1.1.1 -RemoteTunnelEndpoint 2.2.2.2 -InboundSecurity Require -OutboundSecurity Require -QuickModeCryptoSet $QMCryptoSet.Name @@ -548,7 +548,7 @@ netsh advfirewall firewall add rule name="Allow Authenticated Telnet" dir=in pro Windows PowerShell -``` syntax +```powershell New-NetFirewallRule -DisplayName “Allow Authenticated Telnet” -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -Authentication Required -Action Allow ``` @@ -562,7 +562,7 @@ netsh advfirewall consec add rule name="Authenticate Both Computer and User" end Windows PowerShell -``` syntax +```powershell $mkerbauthprop = New-NetIPsecAuthProposal -Machine –Kerberos $mntlmauthprop = New-NetIPsecAuthProposal -Machine -NTLM $P1Auth = New-NetIPsecPhase1AuthSet -DisplayName “Machine Auth” –Proposal $mkerbauthprop,$mntlmauthprop @@ -593,7 +593,7 @@ The following example shows you how to create an SDDL string that represents sec Windows PowerShell -``` syntax +```powershell $user = new-object System.Security.Principal.NTAccount (“corp.contoso.com\Administrators”) $SIDofSecureUserGroup = $user.Translate([System.Security.Principal.SecurityIdentifier]).Value $secureUserGroup = "D:(A;;CC;;;$SIDofSecureUserGroup)" @@ -603,7 +603,7 @@ By using the previous scriptlet, you can also get the SDDL string for a secure c Windows PowerShell -``` syntax +```powershell $secureMachineGroup = "D:(A;;CC;;;$SIDofSecureMachineGroup)" ``` @@ -622,7 +622,7 @@ netsh advfirewall firewall add rule name=“Allow Encrypted Inbound Telnet to Gr Windows PowerShell -``` syntax +```powershell New-NetFirewallRule -DisplayName "Allow Encrypted Inbound Telnet to Group Members Only" -Program %SystemRoot%\System32\tlntsvr.exe -Protocol TCP -Direction Inbound -Action Allow -LocalPort 23 -Authentication Required -Encryption Required –RemoteUser $secureUserGroup –PolicyStore domain.contoso.com\Server_Isolation ``` @@ -634,7 +634,7 @@ In this example, we set the global IPsec setting to only allow transport mode tr Windows PowerShell -``` syntax +```powershell Set-NetFirewallSetting -RemoteMachineTransportAuthorizationList $secureMachineGroup ``` @@ -653,7 +653,7 @@ netsh advfirewall firewall add rule name="Inbound Secure Bypass Rule" dir=in sec Windows PowerShell -``` syntax +```powershell New-NetFirewallRule –DisplayName “Inbound Secure Bypass Rule" –Direction Inbound –Authentication Required –OverrideBlockRules $true -RemoteMachine $secureMachineGroup –RemoteUser $secureUserGroup –PolicyStore domain.contoso.com\domain_isolation ``` diff --git a/windows/security/threat-protection/windows-platform-common-criteria.md b/windows/security/threat-protection/windows-platform-common-criteria.md index d9cd25a523..f2d8e10f0a 100644 --- a/windows/security/threat-protection/windows-platform-common-criteria.md +++ b/windows/security/threat-protection/windows-platform-common-criteria.md @@ -4,7 +4,7 @@ description: This topic details how Microsoft supports the Common Criteria certi ms.prod: w10 audience: ITPro author: dulcemontemayor -ms.author: dolmont +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -23,33 +23,33 @@ Microsoft is committed to optimizing the security of its products and services. The Security Target describes security functionality and assurance measures used to evaluate Windows. - - [Microsoft Windows 10 (April 2018 Update)](http://download.microsoft.com/download/0/7/6/0764E933-DD0B-45A7-9144-1DD9F454DCEF/Windows%2010%201803%20GP%20OS%20Security%20Target.pdf) - - [Microsoft Windows 10 (Fall Creators Update)](https://download.microsoft.com/download/B/6/A/B6A5EC2C-6351-4FB9-8FF1-643D4BD5BE6E/Windows%2010%201709%20GP%20OS%20Security%20Target.pdf) - - [Microsoft Windows 10 (Creators Update)](https://download.microsoft.com/download/e/8/b/e8b8c42a-a0b6-4ba1-9bdc-e704e8289697/windows%2010%20version%201703%20gp%20os%20security%20target%20-%20public%20\(january%2016,%202018\)\(final\)\(clean\).pdf) - - [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](https://download.microsoft.com/download/1/c/3/1c3b5ab0-e064-4350-a31f-48312180d9b5/st_vid10823-st.pdf) - - [Microsoft Windows 10 (Anniversary Update) and Windows 10 Mobile (Anniversary Update)](https://download.microsoft.com/download/1/5/e/15eee6d3-f2a8-4441-8cb1-ce8c2ab91c24/windows%2010%20anniversary%20update%20mdf%20security%20target%20-%20public%20\(april%203%202017\).docx) - - [Microsoft Windows 10 (Anniversary Update) and Windows Server 2016](https://download.microsoft.com/download/f/8/c/f8c1c2a4-719c-48ae-942f-9fd3ce5b238f/windows%2010%20au%20and%20server%202016%20gp%20os%20security%20target%20-%20public%20\(december%202%202016\)%20\(clean\).docx) - - [Windows 10 (Anniversary Update) and Windows Server 2016 IPsec VPN Client](https://download.microsoft.com/download/b/f/5/bf59e430-e57b-462d-8dca-8ac3c93cfcff/windows%2010%20anniversary%20update%20ipsec%20vpn%20client%20security%20target%20-%20public%20\(december%2029%202016\)%20\(clean\).docx) - - [Microsoft Windows 10 IPsec VPN Client](https://download.microsoft.com/download/3/7/2/372beb03-b1ed-4bb6-9b9b-b8f43afc570d/st_vid10746-st.pdf) - - [Microsoft Windows 10 November 2015 Update with Surface Book](https://download.microsoft.com/download/a/c/2/ac2a6ed8-4d2f-4f48-a9bf-f059d6c9af38/windows%2010%20mdf3%20security%20target%20-%20public%20\(june%2022%202016\)\(final\).docx) - - [Microsoft Windows 10 Mobile with Lumia 950, 950 XL, 550, 635, and Windows 10 with Surface Pro 4](https://www.niap-ccevs.org/st/st_vid10677-st.pdf) - - [Windows 10 and Windows Server 2012 R2](http://www.commoncriteriaportal.org/files/epfiles/st_windows10.pdf) - - [Windows 10](https://www.niap-ccevs.org/st/st_vid10677-st.pdf) - - [Windows 8.1 with Surface 3 and Windows Phone 8.1 with Lumia 635 and Lumia 830](https://www.niap-ccevs.org/st/st_vid10635-st.pdf) - - [Microsoft Surface Pro 3 and Windows 8.1](https://www.niap-ccevs.org/st/st_vid10632-st.pdf) - - [Windows 8.1 and Windows Phone 8.1](https://www.niap-ccevs.org/st/st_vid10592-st.pdf) - - [Windows 8 and Windows Server 2012](https://www.niap-ccevs.org/st/st_vid10520-st.pdf) - - [Windows 8 and Windows RT](https://www.niap-ccevs.org/st/st_vid10620-st.pdf) - - [Windows 8 and Windows Server 2012 BitLocker](http://www.commoncriteriaportal.org/files/epfiles/st_vid10540-st.pdf) - - [Windows 8, Windows RT, and Windows Server 2012 IPsec VPN Client](http://www.commoncriteriaportal.org/files/epfiles/st_vid10529-st.pdf) - - [Windows 7 and Windows Server 2008 R2](http://www.commoncriteriaportal.org/files/epfiles/st_vid10390-st.pdf) - - [Microsoft Windows Server 2008 R2 Hyper-V Role](http://www.microsoft.com/download/en/details.aspx?id=29305) - - [Windows Vista and Windows Server 2008 at EAL4+](http://www.commoncriteriaportal.org/files/epfiles/st_vid10291-st.pdf) - - [Microsoft Windows Server 2008 Hyper-V Role](http://www.commoncriteriaportal.org/files/epfiles/0570b_pdf.pdf) - - [Windows Vista and Windows Server 2008 at EAL1](http://www.commoncriteriaportal.org/files/epfiles/efs-t005_msvista_msserver2008_eal1_st_v1.0.pdf) - - [Windows Server 2003 SP2 including R2, x64, and IA64; Windows XP Professional SP2 and x64 SP2; and Windows XP Embedded SP2](http://www.commoncriteriaportal.org/files/epfiles/st_vid10184-st.pdf) - - [Windows Server 2003 Certificate Server](http://www.commoncriteriaportal.org/files/epfiles/st_vid9507-st.pdf) - - [Windows Rights Management Services (RMS) 1.0 SP2](http://www.commoncriteriaportal.org/files/epfiles/st_vid10224-st.pdf) +- [Microsoft Windows 10 (April 2018 Update)](http://download.microsoft.com/download/0/7/6/0764E933-DD0B-45A7-9144-1DD9F454DCEF/Windows%2010%201803%20GP%20OS%20Security%20Target.pdf) +- [Microsoft Windows 10 (Fall Creators Update)](https://download.microsoft.com/download/B/6/A/B6A5EC2C-6351-4FB9-8FF1-643D4BD5BE6E/Windows%2010%201709%20GP%20OS%20Security%20Target.pdf) +- [Microsoft Windows 10 (Creators Update)](https://download.microsoft.com/download/e/8/b/e8b8c42a-a0b6-4ba1-9bdc-e704e8289697/windows%2010%20version%201703%20gp%20os%20security%20target%20-%20public%20\(january%2016,%202018\)\(final\)\(clean\).pdf) +- [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](https://download.microsoft.com/download/1/c/3/1c3b5ab0-e064-4350-a31f-48312180d9b5/st_vid10823-st.pdf) +- [Microsoft Windows 10 (Anniversary Update) and Windows 10 Mobile (Anniversary Update)](https://download.microsoft.com/download/1/5/e/15eee6d3-f2a8-4441-8cb1-ce8c2ab91c24/windows%2010%20anniversary%20update%20mdf%20security%20target%20-%20public%20\(april%203%202017\).docx) +- [Microsoft Windows 10 (Anniversary Update) and Windows Server 2016](https://download.microsoft.com/download/f/8/c/f8c1c2a4-719c-48ae-942f-9fd3ce5b238f/windows%2010%20au%20and%20server%202016%20gp%20os%20security%20target%20-%20public%20\(december%202%202016\)%20\(clean\).docx) +- [Windows 10 (Anniversary Update) and Windows Server 2016 IPsec VPN Client](https://download.microsoft.com/download/b/f/5/bf59e430-e57b-462d-8dca-8ac3c93cfcff/windows%2010%20anniversary%20update%20ipsec%20vpn%20client%20security%20target%20-%20public%20\(december%2029%202016\)%20\(clean\).docx) +- [Microsoft Windows 10 IPsec VPN Client](https://download.microsoft.com/download/3/7/2/372beb03-b1ed-4bb6-9b9b-b8f43afc570d/st_vid10746-st.pdf) +- [Microsoft Windows 10 November 2015 Update with Surface Book](https://download.microsoft.com/download/a/c/2/ac2a6ed8-4d2f-4f48-a9bf-f059d6c9af38/windows%2010%20mdf3%20security%20target%20-%20public%20\(june%2022%202016\)\(final\).docx) +- [Microsoft Windows 10 Mobile with Lumia 950, 950 XL, 550, 635, and Windows 10 with Surface Pro 4](https://www.niap-ccevs.org/st/st_vid10677-st.pdf) +- [Windows 10 and Windows Server 2012 R2](http://www.commoncriteriaportal.org/files/epfiles/st_windows10.pdf) +- [Windows 10](https://www.niap-ccevs.org/st/st_vid10677-st.pdf) +- [Windows 8.1 with Surface 3 and Windows Phone 8.1 with Lumia 635 and Lumia 830](https://www.niap-ccevs.org/st/st_vid10635-st.pdf) +- [Microsoft Surface Pro 3 and Windows 8.1](https://www.niap-ccevs.org/st/st_vid10632-st.pdf) +- [Windows 8.1 and Windows Phone 8.1](https://www.niap-ccevs.org/st/st_vid10592-st.pdf) +- [Windows 8 and Windows Server 2012](https://www.niap-ccevs.org/st/st_vid10520-st.pdf) +- [Windows 8 and Windows RT](https://www.niap-ccevs.org/st/st_vid10620-st.pdf) +- [Windows 8 and Windows Server 2012 BitLocker](http://www.commoncriteriaportal.org/files/epfiles/st_vid10540-st.pdf) +- [Windows 8, Windows RT, and Windows Server 2012 IPsec VPN Client](http://www.commoncriteriaportal.org/files/epfiles/st_vid10529-st.pdf) +- [Windows 7 and Windows Server 2008 R2](http://www.commoncriteriaportal.org/files/epfiles/st_vid10390-st.pdf) +- [Microsoft Windows Server 2008 R2 Hyper-V Role](http://www.microsoft.com/download/en/details.aspx?id=29305) +- [Windows Vista and Windows Server 2008 at EAL4+](http://www.commoncriteriaportal.org/files/epfiles/st_vid10291-st.pdf) +- [Microsoft Windows Server 2008 Hyper-V Role](http://www.commoncriteriaportal.org/files/epfiles/0570b_pdf.pdf) +- [Windows Vista and Windows Server 2008 at EAL1](http://www.commoncriteriaportal.org/files/epfiles/efs-t005_msvista_msserver2008_eal1_st_v1.0.pdf) +- [Windows Server 2003 SP2 including R2, x64, and IA64; Windows XP Professional SP2 and x64 SP2; and Windows XP Embedded SP2](http://www.commoncriteriaportal.org/files/epfiles/st_vid10184-st.pdf) +- [Windows Server 2003 Certificate Server](http://www.commoncriteriaportal.org/files/epfiles/st_vid9507-st.pdf) +- [Windows Rights Management Services (RMS) 1.0 SP2](http://www.commoncriteriaportal.org/files/epfiles/st_vid10224-st.pdf) ## Common Criteria Deployment and Administration @@ -59,77 +59,77 @@ These documents describe how to configure Windows to replicate the configuration **Windows 10, Windows 10 Mobile, Windows Server 2016, Windows Server 2012 R2** - - - [Microsoft Windows 10 (April 2018 Update)](http://download.microsoft.com/download/6/C/1/6C13FBFF-9CB0-455F-A1C8-3E3CB0ACBD7B/Windows%2010%201803%20GP%20OS%20Administrative%20Guide.pdf) - - [Microsoft Windows 10 (Fall Creators Update)](https://download.microsoft.com/download/5/D/2/5D26F473-0FCE-4AC4-9065-6AEC0FE5B693/Windows%2010%201709%20GP%20OS%20Administrative%20Guide.pdf) - - [Microsoft Windows 10 (Creators Update)](https://download.microsoft.com/download/e/9/7/e97f0c7f-e741-4657-8f79-2c0a7ca928e3/windows%2010%20cu%20gp%20os%20operational%20guidance%20\(jan%208%202017%20-%20public\).pdf) - - [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](https://download.microsoft.com/download/d/c/4/dc40b5c8-49c2-4587-8a04-ab3b81eb6fc4/st_vid10823-agd.pdf) - - [Microsoft Windows 10 (Anniversary Update) and Windows 10 Mobile (Anniversary Update)](https://download.microsoft.com/download/4/c/1/4c1f4ea4-2d66-4232-a0f5-925b2bc763bc/windows%2010%20au%20operational%20guidance%20\(16%20mar%202017\)\(clean\).docx) - - [Microsoft Windows 10 (Anniversary Update) and Windows Server 2016](https://download.microsoft.com/download/b/5/2/b52e9081-05c6-4895-91a3-732bfa0eb4da/windows%2010%20au%20and%20server%202016%20gp%20os%20operational%20guidance%20\(final\).docx) - - [Windows 10 (Anniversary Update) and Windows Server 2016 IPsec VPN Client Operational Guidance](https://download.microsoft.com/download/2/c/c/2cc8f929-233e-4a40-b673-57b449680984/windows%2010%20au%20and%20server%202016%20ipsec%20vpn%20client%20operational%20guidance%20\(21%20dec%202016\)%20\(public\).docx) - - [Microsoft Windows 10 IPsec VPN Client](https://download.microsoft.com/download/3/3/f/33fa01dd-b380-46e1-833f-fd85854b4022/st_vid10746-agd.pdf) - - [Microsoft Windows 10 November 2015 Update with Surface Book Administrative Guide](https://download.microsoft.com/download/3/2/c/32c6fa02-b194-478f-a0f6-0215b47d0f40/windows%2010%20mdf3%20mobile%20device%20pp%20operational%20guidance%20\(may%2027,%202016\)\(public\).docx) - - [Microsoft Windows 10 Mobile and Windows 10 Administrative Guide](https://download.microsoft.com/download/2/d/c/2dce3435-9328-48e2-9813-c2559a8d39fa/microsoft%20windows%2010%20and%20windows%2010%20mobile%20guidance.pdf) - - [Windows 10 and Windows Server 2012 R2 Administrative Guide](https://download.microsoft.com/download/0/f/d/0fd33c9a-98ac-499e-882f-274f80f3d4f0/microsoft%20windows%2010%20and%20server%202012%20r2%20gp%20os%20guidance.pdf) - - [Windows 10 Common Criteria Operational Guidance](https://download.microsoft.com/download/d/6/f/d6fb4cec-f0f2-4d00-ab2e-63bde3713f44/windows%2010%20mobile%20device%20operational%20guidance.pdf) + +- [Microsoft Windows 10 (April 2018 Update)](http://download.microsoft.com/download/6/C/1/6C13FBFF-9CB0-455F-A1C8-3E3CB0ACBD7B/Windows%2010%201803%20GP%20OS%20Administrative%20Guide.pdf) +- [Microsoft Windows 10 (Fall Creators Update)](https://download.microsoft.com/download/5/D/2/5D26F473-0FCE-4AC4-9065-6AEC0FE5B693/Windows%2010%201709%20GP%20OS%20Administrative%20Guide.pdf) +- [Microsoft Windows 10 (Creators Update)](https://download.microsoft.com/download/e/9/7/e97f0c7f-e741-4657-8f79-2c0a7ca928e3/windows%2010%20cu%20gp%20os%20operational%20guidance%20\(jan%208%202017%20-%20public\).pdf) +- [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](https://download.microsoft.com/download/d/c/4/dc40b5c8-49c2-4587-8a04-ab3b81eb6fc4/st_vid10823-agd.pdf) +- [Microsoft Windows 10 (Anniversary Update) and Windows 10 Mobile (Anniversary Update)](https://download.microsoft.com/download/4/c/1/4c1f4ea4-2d66-4232-a0f5-925b2bc763bc/windows%2010%20au%20operational%20guidance%20\(16%20mar%202017\)\(clean\).docx) +- [Microsoft Windows 10 (Anniversary Update) and Windows Server 2016](https://download.microsoft.com/download/b/5/2/b52e9081-05c6-4895-91a3-732bfa0eb4da/windows%2010%20au%20and%20server%202016%20gp%20os%20operational%20guidance%20\(final\).docx) +- [Windows 10 (Anniversary Update) and Windows Server 2016 IPsec VPN Client Operational Guidance](https://download.microsoft.com/download/2/c/c/2cc8f929-233e-4a40-b673-57b449680984/windows%2010%20au%20and%20server%202016%20ipsec%20vpn%20client%20operational%20guidance%20\(21%20dec%202016\)%20\(public\).docx) +- [Microsoft Windows 10 IPsec VPN Client](https://download.microsoft.com/download/3/3/f/33fa01dd-b380-46e1-833f-fd85854b4022/st_vid10746-agd.pdf) +- [Microsoft Windows 10 November 2015 Update with Surface Book Administrative Guide](https://download.microsoft.com/download/3/2/c/32c6fa02-b194-478f-a0f6-0215b47d0f40/windows%2010%20mdf3%20mobile%20device%20pp%20operational%20guidance%20\(may%2027,%202016\)\(public\).docx) +- [Microsoft Windows 10 Mobile and Windows 10 Administrative Guide](https://download.microsoft.com/download/2/d/c/2dce3435-9328-48e2-9813-c2559a8d39fa/microsoft%20windows%2010%20and%20windows%2010%20mobile%20guidance.pdf) +- [Windows 10 and Windows Server 2012 R2 Administrative Guide](https://download.microsoft.com/download/0/f/d/0fd33c9a-98ac-499e-882f-274f80f3d4f0/microsoft%20windows%2010%20and%20server%202012%20r2%20gp%20os%20guidance.pdf) +- [Windows 10 Common Criteria Operational Guidance](https://download.microsoft.com/download/d/6/f/d6fb4cec-f0f2-4d00-ab2e-63bde3713f44/windows%2010%20mobile%20device%20operational%20guidance.pdf) **Windows 8.1 and Windows Phone 8.1** - - [Microsoft Surface Pro 3 Common Criteria Mobile Operational Guidance](https://download.microsoft.com/download/b/e/3/be365594-daa5-4af3-a6b5-9533d61eae32/surface%20pro%203%20mobile%20operational%20guidance.docx) - - [Windows 8.1 and Windows Phone 8.1 CC Supplemental Admin Guide](https://download.microsoft.com/download/b/0/e/b0e30225-5017-4241-ac0a-6c40bc8e6714/mobile%20operational%20guidance.docx) +- [Microsoft Surface Pro 3 Common Criteria Mobile Operational Guidance](https://download.microsoft.com/download/b/e/3/be365594-daa5-4af3-a6b5-9533d61eae32/surface%20pro%203%20mobile%20operational%20guidance.docx) +- [Windows 8.1 and Windows Phone 8.1 CC Supplemental Admin Guide](https://download.microsoft.com/download/b/0/e/b0e30225-5017-4241-ac0a-6c40bc8e6714/mobile%20operational%20guidance.docx) **Windows 8, Windows RT, and Windows Server 2012** - - [Windows 8 and Windows Server 2012](https://download.microsoft.com/download/6/0/b/60b27ded-705a-4751-8e9f-642e635c3cf3/microsoft%20windows%208%20windows%20server%202012%20common%20criteria%20supplemental%20admin%20guidance.docx) - - [Windows 8 and Windows RT](https://download.microsoft.com/download/8/6/e/86e8c001-8556-4949-90cf-f5beac918026/microsoft%20windows%208%20microsoft%20windows%20rt%20common%20criteria%20supplemental%20admin.docx) - - [Windows 8 and Windows Server 2012 BitLocker](https://download.microsoft.com/download/0/8/4/08468080-540b-4326-91bf-f2a33b7e1764/administrative%20guidance%20for%20software%20full%20disk%20encryption%20clients.pdf) - - [Windows 8, Windows RT, and Windows Server 2012 IPsec VPN Client](https://download.microsoft.com/download/a/9/f/a9fd7e2d-023b-4925-a62f-58a7f1a6bd47/microsoft%20windows%208%20windows%20server%202012%20supplemental%20admin%20guidance%20ipsec%20vpn%20client.docx) +- [Windows 8 and Windows Server 2012](https://download.microsoft.com/download/6/0/b/60b27ded-705a-4751-8e9f-642e635c3cf3/microsoft%20windows%208%20windows%20server%202012%20common%20criteria%20supplemental%20admin%20guidance.docx) +- [Windows 8 and Windows RT](https://download.microsoft.com/download/8/6/e/86e8c001-8556-4949-90cf-f5beac918026/microsoft%20windows%208%20microsoft%20windows%20rt%20common%20criteria%20supplemental%20admin.docx) +- [Windows 8 and Windows Server 2012 BitLocker](https://download.microsoft.com/download/0/8/4/08468080-540b-4326-91bf-f2a33b7e1764/administrative%20guidance%20for%20software%20full%20disk%20encryption%20clients.pdf) +- [Windows 8, Windows RT, and Windows Server 2012 IPsec VPN Client](https://download.microsoft.com/download/a/9/f/a9fd7e2d-023b-4925-a62f-58a7f1a6bd47/microsoft%20windows%208%20windows%20server%202012%20supplemental%20admin%20guidance%20ipsec%20vpn%20client.docx) **Windows 7 and Windows Server 2008 R2** - - [Windows 7 and Windows Server 2008 R2 Supplemental CC Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=ee05b6d0-9939-4765-9217-63083bb94a00) - - [Windows Server 2008 R2 Hyper-V Common Criteria Configuration Guide](http://www.microsoft.com/download/en/details.aspx?id=29308) +- [Windows 7 and Windows Server 2008 R2 Supplemental CC Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=ee05b6d0-9939-4765-9217-63083bb94a00) +- [Windows Server 2008 R2 Hyper-V Common Criteria Configuration Guide](http://www.microsoft.com/download/en/details.aspx?id=29308) **Windows Vista and Windows Server 2008** - - [Windows Vista and Windows Server 2008 Supplemental CC Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=06166288-24c4-4c42-9daa-2b2473ddf567) - - [Windows Server 2008 Hyper-V Role Common Criteria Administrator Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=cb19538d-9e13-4ab6-af38-8f48abfdad08) +- [Windows Vista and Windows Server 2008 Supplemental CC Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=06166288-24c4-4c42-9daa-2b2473ddf567) +- [Windows Server 2008 Hyper-V Role Common Criteria Administrator Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=cb19538d-9e13-4ab6-af38-8f48abfdad08) **Windows Server 2003 SP2 including R2, x64, and Itanium** - - [Windows Server 2003 SP2 R2 Common Criteria Administrator Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=39598841-e693-4891-9234-cfd1550f3949) - - [Windows Server 2003 SP2 R2 Common Criteria Configuration Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=4f7b6a93-0307-480f-a5af-a20268cbd7cc) +- [Windows Server 2003 SP2 R2 Common Criteria Administrator Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=39598841-e693-4891-9234-cfd1550f3949) +- [Windows Server 2003 SP2 R2 Common Criteria Configuration Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=4f7b6a93-0307-480f-a5af-a20268cbd7cc) **Windows Server 2003 SP1(x86), x64, and IA64** - - [Windows Server 2003 with x64 Hardware Administrator's Guide](http://www.microsoft.com/downloads/details.aspx?familyid=8a26829f-c177-4b79-913a-4135fb7b96ef) - - [Windows Server 2003 with x64 Hardware Configuration Guide](http://www.microsoft.com/downloads/details.aspx?familyid=3f9ecd0a-74dd-4d23-a4e5-d7b63fed70e8) +- [Windows Server 2003 with x64 Hardware Administrator's Guide](http://www.microsoft.com/downloads/details.aspx?familyid=8a26829f-c177-4b79-913a-4135fb7b96ef) +- [Windows Server 2003 with x64 Hardware Configuration Guide](http://www.microsoft.com/downloads/details.aspx?familyid=3f9ecd0a-74dd-4d23-a4e5-d7b63fed70e8) **Windows Server 2003 SP1** - - [Windows Server 2003 Administrator's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=75736009-59e9-4a71-879e-cf581817b8cc) - - [Windows Server 2003 Configuration Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=a0ad1856-beb7-4285-b47c-381e8a210c38) +- [Windows Server 2003 Administrator's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=75736009-59e9-4a71-879e-cf581817b8cc) +- [Windows Server 2003 Configuration Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=a0ad1856-beb7-4285-b47c-381e8a210c38) **Windows XP Professional SP2 (x86) and x64 Edition** - - [Windows XP Common Criteria Administrator Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=9a7f0b16-72ce-4675-aec8-58785c4e37ee) - - [Windows XP Common Criteria Configuration Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=165da57d-f066-4ddf-9462-cbecfcd68694) - - [Windows XP Common Criteria User Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=7c1a4761-9b9e-429c-84eb-cd7b034c5779) - - [Windows XP Professional with x64 Hardware Administrator's Guide](http://www.microsoft.com/downloads/details.aspx?familyid=346f041e-d641-4af7-bdea-c5a3246d0431) - - [Windows XP Professional with x64 Hardware Configuration Guide](http://www.microsoft.com/downloads/details.aspx?familyid=a7075319-cc3d-4420-a00b-8c9a7068ad54) - - [Windows XP Professional with x64 Hardware User’s Guide](http://www.microsoft.com/downloads/details.aspx?familyid=26c49cf5-6159-4197-97ce-bf1fdfc54569) +- [Windows XP Common Criteria Administrator Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=9a7f0b16-72ce-4675-aec8-58785c4e37ee) +- [Windows XP Common Criteria Configuration Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=165da57d-f066-4ddf-9462-cbecfcd68694) +- [Windows XP Common Criteria User Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=7c1a4761-9b9e-429c-84eb-cd7b034c5779) +- [Windows XP Professional with x64 Hardware Administrator's Guide](http://www.microsoft.com/downloads/details.aspx?familyid=346f041e-d641-4af7-bdea-c5a3246d0431) +- [Windows XP Professional with x64 Hardware Configuration Guide](http://www.microsoft.com/downloads/details.aspx?familyid=a7075319-cc3d-4420-a00b-8c9a7068ad54) +- [Windows XP Professional with x64 Hardware User’s Guide](http://www.microsoft.com/downloads/details.aspx?familyid=26c49cf5-6159-4197-97ce-bf1fdfc54569) **Windows XP Professional SP2, and XP Embedded SP2** - - [Windows XP Professional Administrator's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=9bcac470-a0b3-4d34-a561-fa8308c0ff60) - - [Windows XP Professional Configuration Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=9f04915e-571a-422d-8ffa-5797051e81de) - - [Windows XP Professional User's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=d39d0028-7093-495c-80da-2b5b29a54bd8) +- [Windows XP Professional Administrator's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=9bcac470-a0b3-4d34-a561-fa8308c0ff60) +- [Windows XP Professional Configuration Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=9f04915e-571a-422d-8ffa-5797051e81de) +- [Windows XP Professional User's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=d39d0028-7093-495c-80da-2b5b29a54bd8) **Windows Server 2003 Certificate Server** - - [Windows Server 2003 Certificate Server Administrator's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=445093d8-45e2-4cf6-884c-8802c1e6cb2d) - - [Windows Server 2003 Certificate Server Configuration Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=46abc8b5-11be-4e3d-85c2-63226c3688d2) - - [Windows Server 2003 Certificate Server User's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=74f66d84-2654-48d0-b9b5-b383d383425e) +- [Windows Server 2003 Certificate Server Administrator's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=445093d8-45e2-4cf6-884c-8802c1e6cb2d) +- [Windows Server 2003 Certificate Server Configuration Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=46abc8b5-11be-4e3d-85c2-63226c3688d2) +- [Windows Server 2003 Certificate Server User's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=74f66d84-2654-48d0-b9b5-b383d383425e) ## Common Criteria Evaluation Technical Reports and Certification / Validation Reports @@ -137,41 +137,40 @@ These documents describe how to configure Windows to replicate the configuration An Evaluation Technical Report (ETR) is a report submitted to the Common Criteria certification authority for how Windows complies with the claims made in the Security Target. A Certification / Validation Report provides the results of the evaluation by the validation team. - - [Microsoft Windows 10 (April 2018 Update)](http://download.microsoft.com/download/6/7/1/67167BF2-885D-4646-A61E-96A0024B52BB/Windows%2010%201803%20GP%20OS%20Certification%20Report.pdf) - - [Microsoft Windows 10 (Fall Creators Update)](https://download.microsoft.com/download/2/C/2/2C20D013-0610-4047-B2FA-516819DFAE0A/Windows%2010%201709%20GP%20OS%20Certification%20Report.pdf) - - [Microsoft Windows 10 (Creators Update)](https://download.microsoft.com/download/3/2/c/32cdf627-dd23-4266-90ff-2f9685fd15c0/2017-49%20inf-2218%20cr.pdf) - - [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](https://download.microsoft.com/download/a/3/3/a336f881-4ac9-4c79-8202-95289f86bb7a/st_vid10823-vr.pdf) - - [Microsoft Windows 10 (Anniversary Update) and Windows 10 Mobile (Anniversary Update)](https://download.microsoft.com/download/f/2/f/f2f7176e-34f4-4ab0-993c-6606d207bb3c/st_vid10752-vr.pdf) - - [Microsoft Windows 10 (Anniversary Update) and Windows Server 2016](https://download.microsoft.com/download/5/4/8/548cc06e-c671-4502-bebf-20d38e49b731/2016-36-inf-1779.pdf) - - [Windows 10 (Anniversary Update) and Windows Server 2016 IPsec VPN Client](https://download.microsoft.com/download/2/0/a/20a8e686-3cd9-43c4-a22a-54b552a9788a/st_vid10753-vr.pdf) - - [Microsoft Windows 10 IPsec VPN Client](https://download.microsoft.com/download/9/b/6/9b633763-6078-48aa-b9ba-960da2172a11/st_vid10746-vr.pdf) - - [Microsoft Windows 10 November 2015 Update with Surface Book](https://download.microsoft.com/download/d/c/b/dcb7097d-1b9f-4786-bb07-3c169fefb579/st_vid10715-vr.pdf) - - [Microsoft Windows 10 Mobile with Lumia 950, 950 XL, 550, 635, and Windows 10 with Surface Pro 4](https://www.niap-ccevs.org/st/st_vid10694-vr.pdf) - - [Windows 10 and Windows Server 2012 R2](https://www.commoncriteriaportal.org/files/epfiles/cr_windows10.pdf) - - [Windows 10](https://www.niap-ccevs.org/st/st_vid10677-vr.pdf) - - [Windows 8.1 with Surface 3 and Windows Phone 8.1 with Lumia 635 and Lumia 830](https://www.niap-ccevs.org/st/st_vid10635-vr.pdf) - - [Microsoft Surface Pro 3 and Windows 8.1](https://www.niap-ccevs.org/st/st_vid10632-vr.pdf) - - [Windows 8.1 and Windows Phone 8.1](https://www.niap-ccevs.org/st/st_vid10592-vr.pdf) - - [Windows 8 and Windows Server 2012](https://www.niap-ccevs.org/st/st_vid10520-vr.pdf) - - [Windows 8 and Windows RT](https://www.niap-ccevs.org/st/st_vid10620-vr.pdf) - - [Windows 8 and Windows Server 2012 BitLocker](http://www.commoncriteriaportal.org/files/epfiles/st_vid10540-vr.pdf) - - [Windows 8, Windows RT, and Windows Server 2012 IPsec VPN Client](http://www.commoncriteriaportal.org/files/epfiles/st_vid10529-vr.pdf) - - [Windows 7 and Windows Server 2008 R2 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/st_vid10390-vr.pdf) - - [Windows Vista and Windows Server 2008 Validation Report at EAL4+](http://www.commoncriteriaportal.org/files/epfiles/st_vid10291-vr.pdf) - - [Windows Server 2008 Hyper-V Role Certification Report](http://www.commoncriteriaportal.org/files/epfiles/0570a_pdf.pdf) - - [Windows Vista and Windows Server 2008 Certification Report at EAL1](http://www.commoncriteriaportal.org/files/epfiles/efs-t005_msvista_msserver2008_eal1_cr_v1.0.pdf) - - [Windows XP / Windows Server 2003 with x64 Hardware ETR](http://www.microsoft.com/downloads/details.aspx?familyid=6e8d98f9-25b9-4c85-9bd9-24d91ea3c9ef) - - [Windows XP / Windows Server 2003 with x64 Hardware ETR, Part II](http://www.microsoft.com/downloads/details.aspx?familyid=0c35e7d8-9c56-4686-b902-d5ffb9915658) - - [Windows Server 2003 SP2 including R2, Standard, Enterprise, Datacenter, x64, and Itanium Editions Validation Report](http://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf) - - [Windows XP Professional SP2 and x64 SP2 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf) - - [Windows XP Embedded SP2 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf) - - [Windows XP and Windows Server 2003 ETR](http://www.microsoft.com/downloads/details.aspx?familyid=63cf2a1e-f578-4bb5-9245-d411f0f64265) - - [Windows XP and Windows Server 2003 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/st_vid9506-vr.pdf) - - [Windows Server 2003 Certificate Server ETR](http://www.microsoft.com/downloads/details.aspx?familyid=a594e77f-dcbb-4787-9d68-e4689e60a314) - - [Windows Server 2003 Certificate Server Validation Report](http://www.commoncriteriaportal.org/files/epfiles/st_vid9507-vr.pdf) - - [Microsoft Windows Rights Management Services (RMS) 1.0 SP2 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/st_vid10224-vr.pdf) +- [Microsoft Windows 10 (April 2018 Update)](http://download.microsoft.com/download/6/7/1/67167BF2-885D-4646-A61E-96A0024B52BB/Windows%2010%201803%20GP%20OS%20Certification%20Report.pdf) +- [Microsoft Windows 10 (Fall Creators Update)](https://download.microsoft.com/download/2/C/2/2C20D013-0610-4047-B2FA-516819DFAE0A/Windows%2010%201709%20GP%20OS%20Certification%20Report.pdf) +- [Microsoft Windows 10 (Creators Update)](https://download.microsoft.com/download/3/2/c/32cdf627-dd23-4266-90ff-2f9685fd15c0/2017-49%20inf-2218%20cr.pdf) +- [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](https://download.microsoft.com/download/a/3/3/a336f881-4ac9-4c79-8202-95289f86bb7a/st_vid10823-vr.pdf) +- [Microsoft Windows 10 (Anniversary Update) and Windows 10 Mobile (Anniversary Update)](https://download.microsoft.com/download/f/2/f/f2f7176e-34f4-4ab0-993c-6606d207bb3c/st_vid10752-vr.pdf) +- [Microsoft Windows 10 (Anniversary Update) and Windows Server 2016](https://download.microsoft.com/download/5/4/8/548cc06e-c671-4502-bebf-20d38e49b731/2016-36-inf-1779.pdf) +- [Windows 10 (Anniversary Update) and Windows Server 2016 IPsec VPN Client](https://download.microsoft.com/download/2/0/a/20a8e686-3cd9-43c4-a22a-54b552a9788a/st_vid10753-vr.pdf) +- [Microsoft Windows 10 IPsec VPN Client](https://download.microsoft.com/download/9/b/6/9b633763-6078-48aa-b9ba-960da2172a11/st_vid10746-vr.pdf) +- [Microsoft Windows 10 November 2015 Update with Surface Book](https://download.microsoft.com/download/d/c/b/dcb7097d-1b9f-4786-bb07-3c169fefb579/st_vid10715-vr.pdf) +- [Microsoft Windows 10 Mobile with Lumia 950, 950 XL, 550, 635, and Windows 10 with Surface Pro 4](https://www.niap-ccevs.org/st/st_vid10694-vr.pdf) +- [Windows 10 and Windows Server 2012 R2](https://www.commoncriteriaportal.org/files/epfiles/cr_windows10.pdf) +- [Windows 10](https://www.niap-ccevs.org/st/st_vid10677-vr.pdf) +- [Windows 8.1 with Surface 3 and Windows Phone 8.1 with Lumia 635 and Lumia 830](https://www.niap-ccevs.org/st/st_vid10635-vr.pdf) +- [Microsoft Surface Pro 3 and Windows 8.1](https://www.niap-ccevs.org/st/st_vid10632-vr.pdf) +- [Windows 8.1 and Windows Phone 8.1](https://www.niap-ccevs.org/st/st_vid10592-vr.pdf) +- [Windows 8 and Windows Server 2012](https://www.niap-ccevs.org/st/st_vid10520-vr.pdf) +- [Windows 8 and Windows RT](https://www.niap-ccevs.org/st/st_vid10620-vr.pdf) +- [Windows 8 and Windows Server 2012 BitLocker](http://www.commoncriteriaportal.org/files/epfiles/st_vid10540-vr.pdf) +- [Windows 8, Windows RT, and Windows Server 2012 IPsec VPN Client](http://www.commoncriteriaportal.org/files/epfiles/st_vid10529-vr.pdf) +- [Windows 7 and Windows Server 2008 R2 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/st_vid10390-vr.pdf) +- [Windows Vista and Windows Server 2008 Validation Report at EAL4+](http://www.commoncriteriaportal.org/files/epfiles/st_vid10291-vr.pdf) +- [Windows Server 2008 Hyper-V Role Certification Report](http://www.commoncriteriaportal.org/files/epfiles/0570a_pdf.pdf) +- [Windows Vista and Windows Server 2008 Certification Report at EAL1](http://www.commoncriteriaportal.org/files/epfiles/efs-t005_msvista_msserver2008_eal1_cr_v1.0.pdf) +- [Windows XP / Windows Server 2003 with x64 Hardware ETR](http://www.microsoft.com/downloads/details.aspx?familyid=6e8d98f9-25b9-4c85-9bd9-24d91ea3c9ef) +- [Windows XP / Windows Server 2003 with x64 Hardware ETR, Part II](http://www.microsoft.com/downloads/details.aspx?familyid=0c35e7d8-9c56-4686-b902-d5ffb9915658) +- [Windows Server 2003 SP2 including R2, Standard, Enterprise, Datacenter, x64, and Itanium Editions Validation Report](http://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf) +- [Windows XP Professional SP2 and x64 SP2 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf) +- [Windows XP Embedded SP2 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf) +- [Windows XP and Windows Server 2003 ETR](http://www.microsoft.com/downloads/details.aspx?familyid=63cf2a1e-f578-4bb5-9245-d411f0f64265) +- [Windows XP and Windows Server 2003 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/st_vid9506-vr.pdf) +- [Windows Server 2003 Certificate Server ETR](http://www.microsoft.com/downloads/details.aspx?familyid=a594e77f-dcbb-4787-9d68-e4689e60a314) +- [Windows Server 2003 Certificate Server Validation Report](http://www.commoncriteriaportal.org/files/epfiles/st_vid9507-vr.pdf) +- [Microsoft Windows Rights Management Services (RMS) 1.0 SP2 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/st_vid10224-vr.pdf) ## Other Common Criteria Related Documents - - [Identifying Windows XP and Windows Server 2003 Common Criteria Certified Requirements for the NIST Special Publication 800-53](https://download.microsoft.com/download/a/9/6/a96d1dfc-2bd4-408d-8d93-e0ede7529691/xpws03_ccto800-53.doc) - +- [Identifying Windows XP and Windows Server 2003 Common Criteria Certified Requirements for the NIST Special Publication 800-53](https://download.microsoft.com/download/a/9/6/a96d1dfc-2bd4-408d-8d93-e0ede7529691/xpws03_ccto800-53.doc) diff --git a/windows/security/threat-protection/windows-security-baselines.md b/windows/security/threat-protection/windows-security-baselines.md index 9a3a439e54..e59d8d582b 100644 --- a/windows/security/threat-protection/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-baselines.md @@ -5,7 +5,7 @@ keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium -ms.author: dolmont +ms.author: dansimp author: dulcemontemayor manager: dansimp audience: ITPro diff --git a/windows/threat-protection/docfx.json b/windows/threat-protection/docfx.json index 12bbd676fa..d4d30ecdba 100644 --- a/windows/threat-protection/docfx.json +++ b/windows/threat-protection/docfx.json @@ -34,6 +34,7 @@ "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", "ms.topic": "article", + "audience": "ITPro", "ms.date": "04/05/2017", "_op_documentIdPathDepotMapping": { "./": { diff --git a/windows/whats-new/docfx.json b/windows/whats-new/docfx.json index b86924bf53..8d403d8128 100644 --- a/windows/whats-new/docfx.json +++ b/windows/whats-new/docfx.json @@ -34,6 +34,7 @@ "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "ms.technology": "windows", "ms.topic": "article", + "audience": "ITPro", "feedback_system": "GitHub", "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", diff --git a/windows/whats-new/get-started-with-1709.md b/windows/whats-new/get-started-with-1709.md index 6dc2400981..b7879030be 100644 --- a/windows/whats-new/get-started-with-1709.md +++ b/windows/whats-new/get-started-with-1709.md @@ -38,7 +38,7 @@ To view availability dates and servicing options for each version and update of ## Windows 10 Roadmap -If you'd like to gain some insight into preview, or in-development features, visit the [Windows 10 Roadmap](https://www.microsoft.com/en-us/WindowsForBusiness/windows-roadmap) page. You'll be able to filter by feature state and product category, to make this information easier to navigate. +If you'd like to gain some insight into preview, or in-development features, visit the [Windows 10 Roadmap](https://www.microsoft.com/WindowsForBusiness/windows-roadmap) page. You'll be able to filter by feature state and product category, to make this information easier to navigate. ## Top support solutions for Windows 10 diff --git a/windows/whats-new/images/virus-and-threat-protection.png b/windows/whats-new/images/virus-and-threat-protection.png index f5fd5287bc..f289d22531 100644 Binary files a/windows/whats-new/images/virus-and-threat-protection.png and b/windows/whats-new/images/virus-and-threat-protection.png differ diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md index 27d454fa86..b4809b546b 100644 --- a/windows/whats-new/index.md +++ b/windows/whats-new/index.md @@ -1,38 +1,40 @@ ---- -title: What's new in Windows 10 (Windows 10) -description: Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more. -ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44 -keywords: ["What's new in Windows 10", "Windows 10"] -ms.prod: w10 -audience: itpro author: greg-lindsay -manager: laurawi -ms.localizationpriority: high -ms.topic: article ---- - -# What's new in Windows 10 - -Windows 10 provides IT professionals with advanced protection against modern security threats and comprehensive management and control over devices and apps, as well as flexible deployment, update, and support options. Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more. - -## In this section - -- [What's new in Windows 10, version 1903](whats-new-windows-10-version-1903.md) -- [What's new in Windows 10, version 1809](whats-new-windows-10-version-1809.md) -- [What's new in Windows 10, version 1803](whats-new-windows-10-version-1803.md) -- [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md) -- [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md) -- [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md) -- [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md) - -## Learn more - -- [Windows 10 release information](https://technet.microsoft.com/windows/release-info) -- [Windows 10 update history](https://support.microsoft.com/help/12387/windows-10-update-history) -- [Windows 10 content from Microsoft Ignite](https://go.microsoft.com/fwlink/p/?LinkId=613210) -- [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkId=690485) - -## See also - -[Windows 10 Enterprise LTSC](ltsc/index.md)
                        -[Edit an existing topic using the Edit link](contribute-to-a-topic.md) - +--- +title: What's new in Windows 10 (Windows 10) +description: Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more. +ms.assetid: F1867017-76A1-4761-A200-7450B96AEF44 +keywords: ["What's new in Windows 10", "Windows 10"] +ms.prod: w10 +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.localizationpriority: high +ms.topic: article +--- + +# What's new in Windows 10 + +Windows 10 provides IT professionals with advanced protection against modern security threats and comprehensive management and control over devices and apps, as well as flexible deployment, update, and support options. Learn about new features in Windows 10 for IT professionals, such as Windows Information Protection, Windows Hello, Device Guard, and more. + +## In this section + +- [What's new in Windows 10, version 1903](whats-new-windows-10-version-1903.md) +- [What's new in Windows 10, version 1809](whats-new-windows-10-version-1809.md) +- [What's new in Windows 10, version 1803](whats-new-windows-10-version-1803.md) +- [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md) +- [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md) +- [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md) +- [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md) + +## Learn more + +- [Windows 10 release information](https://technet.microsoft.com/windows/release-info) +- [Windows 10 update history](https://support.microsoft.com/help/12387/windows-10-update-history) +- [Windows 10 content from Microsoft Ignite](https://go.microsoft.com/fwlink/p/?LinkId=613210) +- [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkId=690485) + +## See also + +[Windows 10 Enterprise LTSC](ltsc/index.md)
                        +[Edit an existing topic using the Edit link](contribute-to-a-topic.md) + diff --git a/windows/whats-new/ltsc/index.md b/windows/whats-new/ltsc/index.md index fa6b259b1c..b1464088fc 100644 --- a/windows/whats-new/ltsc/index.md +++ b/windows/whats-new/ltsc/index.md @@ -1,50 +1,52 @@ ---- -title: Windows 10 Enterprise LTSC -description: New and updated IT Pro content about new features in Windows 10, LTSC (also known as Windows 10 LTSB). -keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 LTSC", "Windows 10 LTSB"] -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -manager: laurawi -ms.localizationpriority: low -ms.topic: article ---- - -# Windows 10 Enterprise LTSC - -**Applies to** -- Windows 10 Enterprise LTSC - -## In this topic - -This topic provides links to articles with information about what's new in each release of Windows 10 Enterprise LTSC, and includes a short description of this servicing channel. - -[What's New in Windows 10 Enterprise 2019 LTSC](whats-new-windows-10-2019.md)
                        -[What's New in Windows 10 Enterprise 2016 LTSC](whats-new-windows-10-2016.md)
                        -[What's New in Windows 10 Enterprise 2015 LTSC](whats-new-windows-10-2015.md) - -## The Long Term Servicing Channel (LTSC) - -The following table summarizes equivalent feature update versions of Windows 10 LTSC and semi-annual channel (SAC) releases. - -| LTSC release | Equivalent SAC release | Availability date | -| --- | --- | --- | -| Windows 10 Enterprise 2015 LTSC | Windows 10, Version 1507 | 7/29/2015 | -| Windows 10 Enterprise 2016 LTSC | Windows 10, Version 1607 | 8/2/2016 | -| Windows 10 Enterprise 2019 LTSC | Windows 10, Version 1809 | 11/13/2018 | - ->[!NOTE] ->The Long Term Servicing Channel was previously called the Long Term Servicing Branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB. - -With the LTSC servicing model, customers can delay receiving feature updates and instead only receive monthly quality updates on devices. Features from Windows 10 that could be updated with new functionality, including Cortana, Edge, and all in-box Universal Windows apps, are also not included. Feature updates are offered in new LTSC releases every 2–3 years instead of every 6 months, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle. Microsoft is committed to providing bug fixes and security patches for each LTSC release during this 10 year period. - ->[!IMPORTANT] ->The Long Term Servicing Channel is not intended for deployment on most or all the PCs in an organization. The LTSC edition of Windows 10 provides customers with access to a deployment option for their special-purpose devices and environments. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. These devices are also typically not heavily dependent on support from external apps and tools. Since the feature set for LTSC does not change for the lifetime of the release, over time there might be some external tools that do not continue to provide legacy support. See [LTSC: What is it, and when it should be used](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181). - -For detailed information about Windows 10 servicing, see [Overview of Windows as a service](/windows/deployment/update/waas-overview). - -## See Also - -[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
                        -[Windows 10 - Release information](https://docs.microsoft.com/windows/windows-10/release-information): Windows 10 current versions by servicing option. +--- +title: Windows 10 Enterprise LTSC +description: New and updated IT Pro content about new features in Windows 10, LTSC (also known as Windows 10 LTSB). +keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 LTSC", "Windows 10 LTSB"] +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.localizationpriority: low +ms.topic: article +--- + +# Windows 10 Enterprise LTSC + +**Applies to** +- Windows 10 Enterprise LTSC + +## In this topic + +This topic provides links to articles with information about what's new in each release of Windows 10 Enterprise LTSC, and includes a short description of this servicing channel. + +[What's New in Windows 10 Enterprise 2019 LTSC](whats-new-windows-10-2019.md)
                        +[What's New in Windows 10 Enterprise 2016 LTSC](whats-new-windows-10-2016.md)
                        +[What's New in Windows 10 Enterprise 2015 LTSC](whats-new-windows-10-2015.md) + +## The Long Term Servicing Channel (LTSC) + +The following table summarizes equivalent feature update versions of Windows 10 LTSC and semi-annual channel (SAC) releases. + +| LTSC release | Equivalent SAC release | Availability date | +| --- | --- | --- | +| Windows 10 Enterprise 2015 LTSC | Windows 10, Version 1507 | 7/29/2015 | +| Windows 10 Enterprise 2016 LTSC | Windows 10, Version 1607 | 8/2/2016 | +| Windows 10 Enterprise 2019 LTSC | Windows 10, Version 1809 | 11/13/2018 | + +>[!NOTE] +>The Long Term Servicing Channel was previously called the Long Term Servicing Branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB. + +With the LTSC servicing model, customers can delay receiving feature updates and instead only receive monthly quality updates on devices. Features from Windows 10 that could be updated with new functionality, including Cortana, Edge, and all in-box Universal Windows apps, are also not included. Feature updates are offered in new LTSC releases every 2–3 years instead of every 6 months, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle. Microsoft is committed to providing bug fixes and security patches for each LTSC release during this 10 year period. + +>[!IMPORTANT] +>The Long Term Servicing Channel is not intended for deployment on most or all the PCs in an organization. The LTSC edition of Windows 10 provides customers with access to a deployment option for their special-purpose devices and environments. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. These devices are also typically not heavily dependent on support from external apps and tools. Since the feature set for LTSC does not change for the lifetime of the release, over time there might be some external tools that do not continue to provide legacy support. See [LTSC: What is it, and when it should be used](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181). + +For detailed information about Windows 10 servicing, see [Overview of Windows as a service](/windows/deployment/update/waas-overview). + +## See Also + +[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
                        +[Windows 10 - Release information](https://docs.microsoft.com/windows/windows-10/release-information): Windows 10 current versions by servicing option. diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index 129309368a..4c6f69c1a2 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -1,631 +1,631 @@ ---- -title: What's new in Windows 10 Enterprise 2019 LTSC -ms.reviewer: -manager: laurawi -ms.author: greglin -description: New and updated IT Pro content about new features in Windows 10 Enterprise 2019 LTSC (also known as Windows 10 Enterprise 2019 LTSB). -keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 Enterprise 2019 LTSC"] -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -ms.localizationpriority: low -ms.topic: article ---- - -# What's new in Windows 10 Enterprise 2019 LTSC - -**Applies to** -- Windows 10 Enterprise 2019 LTSC - -This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise 2019 LTSC, compared to Windows 10 Enterprise 2016 LTSC (LTSB). For a brief description of the LTSC servicing channel and associated support, see [Windows 10 Enterprise LTSC](index.md). - ->[!NOTE] ->Features in Windows 10 Enterprise 2019 LTSC are equivalent to Windows 10, version 1809. - -Windows 10 Enterprise LTSC 2019 builds on Windows 10 Pro, version 1809 adding premium features designed to address the needs of large and mid-size organizations (including large academic institutions), such as: - - Advanced protection against modern security threats - - Full flexibility of OS deployment - - Updating and support options - - Comprehensive device and app management and control capabilities - -The Windows 10 Enterprise LTSC 2019 release is an important release for LTSC users because it includes the cumulative enhancements provided in Windows 10 versions 1703, 1709, 1803, and 1809. Details about these enhancements are provided below. - ->[!IMPORTANT] ->The LTSC release is [intended for special use devices](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181). Support for LTSC by apps and tools that are designed for the semi-annual channel release of Windows 10 might be limited. - -## Microsoft Intune - ->Microsoft Intune supports Windows 10 Enterprise LTSC 2019 and later. This includes support for features such as [Windows Autopilot](#windows-autopilot). However, note that Windows Update for Business (WUfB) does not currently support any LTSC releases, therefore you should use WSUS or Configuration Manager for patching. - -## Security - -This version of Window 10 includes security improvements for threat protection, information protection, and identity protection. - -### Threat protection - -#### Windows Defender ATP - -The Windows Defender Advanced Threat Protection ([Windows Defender ATP](/windows/security/threat-protection/index)) platform inludes the security pillars shown in the following diagram. In this version of Windows, Windows Defender ATP includes powerful analytics, security stack integration, and centralized management for better detection, prevention, investigation, response, and management. - -![Windows Defender ATP](../images/wdatp.png) - -##### Attack surface reduction - -Attack surface reduction includes host-based intrusion prevention systems such as [controlled folder access](/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard). - - This feature can help prevent ransomware and other destructive malware from changing your personal files. In some cases, apps that you normally use might be blocked from making changes to common folders like **Documents** and **Pictures**. We’ve made it easier for you to add apps that were recently blocked so you can keep using your device without turning off the feature altogether. - - When an app is blocked, it will appear in a recently blocked apps list, which you can get to by clicking **Manage settings** under the **Ransomware protection** heading. Click **Allow an app through Controlled folder access**. After the prompt, click the **+** button and choose **Recently blocked apps**. Select any of the apps to add them to the allowed list. You can also browse for an app from this page. - -###### Windows Defender Firewall - -Windows Defender Firewall now supports Windows Subsystem for Linux (WSL) processes. You can add specific rules for a WSL process just as you would for any Windows process. Also, Windows Defender Firewall now supports notifications for WSL processes. For example, when a Linux tool wants to allow access to a port from the outside (like SSH or a web server like nginx), Windows Defender Firewall will prompt to allow access just like it would for a Windows process when the port starts accepting connections. This was first introduced in [Build 17627](https://docs.microsoft.com/windows/wsl/release-notes#build-17618-skip-ahead). - -##### Windows Defender Device Guard - -[Device Guard](/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control) has always been a collection of technologies that can be combined to lock down a PC, including: -- Software-based protection provided by code integrity policies -- Hardware-based protection provided by Hypervisor-protected code integrity (HVCI) - -But these protections can also be configured separately. And, unlike HVCI, code integrity policies do not require virtualization-based security (VBS). To help underscore the distinct value of these protections, code integrity policies have been rebranded as [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control). - -### Next-gen protection - -#### Office 365 Ransomware Detection - -For Office 365 Home and Office 365 Personal subscribers, Ransomware Detection notifies you when your OneDrive files have been attacked and guides you through the process of restoring your files. For more information, see [Ransomware detection and recovering your files](https://support.office.com/en-us/article/ransomware-detection-and-recovering-your-files-0d90ec50-6bfd-40f4-acc7-b8c12c73637f?ui=en-US&rs=en-US&ad=US) - -### Endpoint detection and response - -Endpoint detection and response is improved. Enterprise customers can now take advantage of the entire Windows security stack with Windows Defender Antivirus **detections** and Device Guard **blocks** being surfaced in the Windows Defender ATP portal. - - Windows Defender is now called Windows Defender Antivirus and now shares detection status between M365 services and interoperates with Windows Defender ATP. Additional policies have also been implemented to enhance cloud based protection, and new channels are available for emergency protection. For more information, see [Virus and threat protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection) and [Use next-gen technologies in Windows Defender Antivirus through cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus). - - We've also [increased the breadth of the documentation library for enterprise security admins](/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10). The new library includes information on: -- [Deploying and enabling AV protection](/windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus) -- [Managing updates](/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus) -- [Reporting](/windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus) -- [Configuring features](/windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features) -- [Troubleshooting](/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus) - - Some of the highlights of the new library include [Evaluation guide for Windows Defender AV](/windows/threat-protection/windows-defender-antivirus//evaluate-windows-defender-antivirus) and [Deployment guide for Windows Defender AV in a virtual desktop infrastructure environment](/windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus). - - New features for Windows Defender AV in Windows 10 Enterprise 2019 LTSC include: -- [Updates to how the Block at First Sight feature can be configured](/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus) -- [The ability to specify the level of cloud-protection](/windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus) -- [Windows Defender Antivirus protection in the Windows Defender Security Center app](/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus) - - We've [invested heavily in helping to protect against ransomware](https://blogs.windows.com/business/2016/11/11/defending-against-ransomware-with-windows-10-anniversary-update/#UJlHc6SZ2Zm44jCt.97), and we continue that investment with [updated behavior monitoring and always-on real-time protection](/windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus). - - **Endpoint detection and response** is also enhanced. New **detection** capabilities include: -- [Use the threat intelligence API to create custom alerts](/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection) - Understand threat intelligence concepts, enable the threat intel application, and create custom threat intelligence alerts for your organization. - - [Custom detection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-custom-detections). With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats. This can be done by leveraging the power of Advanced hunting through the creation of custom detection rules. - - Improvements on OS memory and kernel sensors to enable detection of attackers who are using in-memory and kernel-level attacks. - - Upgraded detections of ransomware and other advanced attacks. - - Historical detection capability ensures new detection rules apply to up to six months of stored data to detect previous attacks that might not have been noticed. - - **Threat reponse** is improved when an attack is detected, enabling immediate action by security teams to contain a breach: -- [Take response actions on a machine](/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection) - Quickly respond to detected attacks by isolating machines or collecting an investigation package. - - [Take response actions on a file](/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection) - Quickly respond to detected attacks by stopping and quarantining files or blocking a file. - -Additional capabilities have been added to help you gain a holistic view on **investigations** include: - - [Threat analytics](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics) - Threat Analytics is a set of interactive reports published by the Windows Defender ATP research team as soon as emerging threats and outbreaks are identified. The reports help security operations teams assess impact on their environment and provides recommended actions to contain, increase organizational resilience, and prevent specific threats. - - [Query data using Advanced hunting in Windows Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection) - - [Use Automated investigations to investigate and remediate threats](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection) - - [Investigate a user account](/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection) - Identify user accounts with the most active alerts and investigate cases of potential compromised credentials. - - [Alert process tree](/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection#alert-process-tree) - Aggregates multiple detections and related events into a single view to reduce case resolution time. - - [Pull alerts using REST API](/windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection) - Use REST API to pull alerts from Windows Defender ATP. - -Other enhanced security features include: -- [Check sensor health state](/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection) - Check an endpoint's ability to provide sensor data and communicate with the Windows Defender ATP service and fix known issues. -- [Managed security service provider (MSSP) support](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection) - Windows Defender ATP adds support for this scenario by providing MSSP integration. The integration will allow MSSPs to take the following actions: Get access to MSSP customer's Windows Defender Security Center portal, fetch email notifications, and fetch alerts through security information and event management (SIEM) tools. -- [Integration with Azure Security Center](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection#integration-with-azure-security-center) - Windows Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Windows Defender ATP to provide improved threat detection for Windows Servers. -- [Integration with Microsoft Cloud App Security](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration) - Microsoft Cloud App Security leverages Windows Defender ATP endpoint signals to allow direct visibility into cloud application usage including the use of unsupported cloud services (shadow IT) from all Windows Defender ATP monitored machines. -- [Onboard Windows Server 2019](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection#windows-server-version-1803-and-windows-server-2019) - Windows Defender ATP now adds support for Windows Server 2019. You'll be able to onboard Windows Server 2019 in the same method available for Windows 10 client machines. -- [Onboard previous versions of Windows](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection) - Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor. -- [Enable conditional access to better protect users, devices, and data](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection) - -We've also added a new assessment for the Windows time service to the **Device performance & health** section. If we detect that your device’s time is not properly synced with our time servers and the time-syncing service is disabled, we’ll provide the option for you to turn it back on. - -We’re continuing to work on how other security apps you’ve installed show up in the **Windows Security** app. There’s a new page called **Security providers** that you can find in the **Settings** section of the app. Click **Manage providers** to see a list of all the other security providers (including antivirus, firewall, and web protection) that are running on your device. Here you can easily open the providers’ apps or get more information on how to resolve issues reported to you through **Windows Security**. - -This also means you’ll see more links to other security apps within **Windows Security**. For example, if you open the **Firewall & network protection** section, you’ll see the firewall apps that are running on your device under each firewall type, which includes domain, private, and public networks). - -You can read more about ransomware mitigations and detection capability at: -- [Averting ransomware epidemics in corporate networks with Windows Defender ATP](https://blogs.technet.microsoft.com/mmpc/2017/01/30/averting-ransomware-epidemics-in-corporate-networks-with-windows-defender-atp/) -- [Ransomware Protection in Windows 10 Anniversary Update whitepaper (PDF)](http://wincom.blob.core.windows.net/documents/Ransomware_protection_in_Windows_10_Anniversary_Update.pdf) -- [Microsoft Malware Protection Center blog](https://blogs.technet.microsoft.com/mmpc/category/research/ransomware/) - -Also see [New capabilities of Windows Defender ATP further maximizing the effectiveness and robustness of endpoint security](https://blogs.windows.com/business/2018/04/17/new-capabilities-of-windows-defender-atp-further-maximizing-the-effectiveness-and-robustness-of-endpoint-security/#62FUJ3LuMXLQidVE.97) - -Get a quick, but in-depth overview of Windows Defender ATP for Windows 10: [Windows Defender Advanced Threat Protection](/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection). - -For more information about features of Windows Defender ATP available in different editions of Windows 10, see the [Windows 10 commercial edition comparison](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf). - -### Information protection - -Improvements have been added to Windows Information Protection and BitLocker. - -#### Windows Information Protection - -Windows Information Protection is now designed to work with Microsoft Office and Azure Information Protection. For more information, see [Deploying and managing Windows Information Protection (WIP) with Azure Information Protection](https://myignite.microsoft.com/sessions/53660?source=sessions). - -Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network. For more info, see [Create a Windows Information Protection (WIP) policy using Microsoft Intune](/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune) and [Associate and deploy your Windows Information Protection (WIP) and VPN policies by using Microsoft Intune](/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune). - -You can also now collect your audit event logs by using the Reporting configuration service provider (CSP) or the Windows Event Forwarding (for Windows desktop domain-joined devices). For info, see the brand-new topic, [How to collect Windows Information Protection (WIP) audit event logs](/windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs). - -This release enables support for WIP with Files on Demand, allows file encryption while the file is open in another app, and improves performance. For more information, see [OneDrive Files On-Demand For The Enterprise](https://techcommunity.microsoft.com/t5/OneDrive-Blog/OneDrive-Files-On-Demand-For-The-Enterprise/ba-p/117234). - -### BitLocker - -The minimum PIN length is being changed from 6 to 4, with a default of 6. For more information, see [BitLocker Group Policy settings](https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-group-policy-settings#bkmk-unlockpol3). - -#### Silent enforcement on fixed drives - -Through a Modern Device Management (MDM) policy, BitLocker can be enabled silently for standard Azure Active Directory (AAD) joined users. In Windows 10, version 1803 automatic BitLocker encryption was enabled for standard AAD users, but this still required modern hardware that passed the Hardware Security Test Interface (HSTI). This new functionality enables BitLocker via policy even on devices that don’t pass the HSTI. - -This is an update to the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp), which was introduced in Windows 10, version 1703, and leveraged by Intune and others. - -This feature will soon be enabled on Olympia Corp as an optional feature. - -#### Delivering BitLocker policy to AutoPilot devices during OOBE - -You can choose which encryption algorithm to apply to BitLocker encryption capable devices, rather than automatically having those devices encrypt themselves with the default algorithm. This allows the encryption algorithm (and other BitLocker policies that must be applied prior to encryption), to be delivered before BitLocker encryption begins. - -For example, you can choose the XTS-AES 256 encryption algorithm, and have it applied to devices that would normally encrypt themselves automatically with the default XTS-AES 128 algorithm during OOBE. - -To achieve this: - -1. Configure the [encryption method settings](https://docs.microsoft.com/intune/endpoint-protection-windows-10#windows-encryption) in the Windows 10 Endpoint Protection profile to the desired encryption algorithm. -2. [Assign the policy](https://docs.microsoft.com/intune/device-profile-assign) to your Autopilot device group. - - **IMPORTANT**: The encryption policy must be assigned to **devices** in the group, not users. -3. Enable the Autopilot [Enrollment Status Page](https://docs.microsoft.com/windows/deployment/windows-autopilot/enrollment-status) (ESP) for these devices. - - **IMPORTANT**: If the ESP is not enabled, the policy will not apply before encryption starts. - -### Identity protection - -Improvements have been added are to Windows Hello for Business and Credential Guard. - -#### Windows Hello for Business - -New features in Windows Hello enable a better device lock experience, using multifactor unlock with new location and user proximity signals. Using Bluetooth signals, you can configure your Windows 10 device to automatically lock when you walk away from it, or to prevent others from accessing the device when you are not present. - -New features in [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/hello-identity-verification.md) inlcude: -- You can now reset a forgotten PIN without deleting company managed data or apps on devices managed by [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune). -- For Windows Phone devices, an administrator is able to initiate a remote PIN reset through the Intune portal. -- For Windows desktops, users are able to reset a forgotten PIN through **Settings > Accounts > Sign-in options**. For more details, check out [What if I forget my PIN?](/windows/security/identity-protection/hello-for-business/hello-features#pin-reset). - -[Windows Hello](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features) now supports FIDO 2.0 authentication for Azure AD Joined Windows 10 devices and has enhanced support for shared devices, as described in the [Kiosk configuration](#kiosk-configuration) section. -- Windows Hello is now [password-less on S-mode](https://www.windowslatest.com/2018/02/12/microsoft-make-windows-10-password-less-platform/). -- Support for S/MIME with Windows Hello for Business and APIs for non-Microsoft identity lifecycle management solutions. -- Windows Hello is part of the account protection pillar in Windows Defender Security Center. Account Protection will encourage password users to set up Windows Hello Face, Fingerprint or PIN for faster sign in, and will notify Dynamic lock users if Dynamic lock has stopped working because their phone or device Bluetooth is off. -- You can set up Windows Hello from lock screen for MSA accounts. We’ve made it easier for Microsoft account users to set up Windows Hello on their devices for faster and more secure sign-in. Previously, you had to navigate deep into Settings to find Windows Hello. Now, you can set up Windows Hello Face, Fingerprint or PIN straight from your lock screen by clicking the Windows Hello tile under Sign-in options. -- New [public API](https://docs.microsoft.com/uwp/api/windows.security.authentication.web.core.webauthenticationcoremanager.findallaccountsasync#Windows_Security_Authentication_Web_Core_WebAuthenticationCoreManager_FindAllAccountsAsync_Windows_Security_Credentials_WebAccountProvider_) for secondary account SSO for a particular identity provider. -- It is easier to set up Dynamic lock, and WD SC actionable alerts have been added when Dynamic lock stops working (ex: phone Bluetooth is off). - -For more information, see: [Windows Hello and FIDO2 Security Keys enable secure and easy authentication for shared devices](https://blogs.windows.com/business/2018/04/17/windows-hello-fido2-security-keys/#OdKBg3pwJQcEKCbJ.97) - -#### Windows Defender Credential Guard - -Windows Defender Credential Guard is a security service in Windows 10 built to protect Active Directory (AD) domain credentials so that they can't be stolen or misused by malware on a user's machine. It is designed to protect against well-known threats such as Pass-the-Hash and credential harvesting. - -Windows Defender Credential Guard has always been an optional feature, but Windows 10 in S mode turns this functionality on by default when the machine has been Azure Active Directory joined. This provides an added level of security when connecting to domain resources not normally present on devices running Windows 10 in S mode. Please note that Windows Defender Credential Guard is available only to S mode devices or Enterprise and Education Editions. - -For more information, see [Credential Guard Security Considerations](/windows/access-protection/credential-guard/credential-guard-requirements#security-considerations). - -### Other security improvments - -#### Windows security baselines - -Microsoft has released new [Windows security baselines](https://docs.microsoft.com/windows/device-security/windows-security-baselines) for Windows Server and Windows 10. A security baseline is a group of Microsoft-recommended configuration settings with an explanation of their security impact. For more information, and to download the Policy Analyzer tool, see [Microsoft Security Compliance Toolkit 1.0](https://docs.microsoft.com/windows/device-security/security-compliance-toolkit-10). - -**Windows security baselines** have been updated for Windows 10. A [security baseline](https://docs.microsoft.com/windows/device-security/windows-security-baselines) is a group of Microsoft-recommended configuration settings and explains their security impact. For more information, and to download the Policy Analyzer tool, see [Microsoft Security Compliance Toolkit 1.0](https://docs.microsoft.com/windows/device-security/security-compliance-toolkit-10). - -The new [security baseline for Windows 10 version 1803](https://docs.microsoft.com/windows/security/threat-protection/security-compliance-toolkit-10) has been published. - -#### SMBLoris vulnerability - -An issue, known as “SMBLoris�?, which could result in denial of service, has been addressed. - -#### Windows Security Center - -Windows Defender Security Center is now called **Windows Security Center**. - -You can still get to the app in all the usual ways – simply ask Cortana to open Windows Security Center(WSC) or interact with the taskbar icon. WSC lets you manage all your security needs, including **Windows Defender Antivirus** and **Windows Defender Firewall**. - -The WSC service now requires antivirus products to run as a protected process to register. Products that have not yet implemented this will not appear in the Windows Security Center user interface, and Windows Defender Antivirus will remain enabled side-by-side with these products. - -WSC now includes the Fluent Design System elements you know and love. You’ll also notice we’ve adjusted the spacing and padding around the app. It will now dynamically size the categories on the main page if more room is needed for extra info. We also updated the title bar so that it will use your accent color if you have enabled that option in **Color Settings**. - -![alt text](../images/defender.png "Windows Security Center") - -#### Group Policy Security Options - -The security setting [**Interactive logon: Display user information when the session is locked**](/windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked) has been updated to work in conjunction with the **Privacy** setting in **Settings** > **Accounts** > **Sign-in options**. - -A new security policy setting -[**Interactive logon: Don't display username at sign-in**](/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in) has been introduced in Windows 10 Enterprise 2019 LTSC. This security policy setting determines whether the username is displayed during sign in. It works in conjunction with the **Privacy** setting in **Settings** > **Accounts** > **Sign-in options**. The setting only affects the **Other user** tile. - -#### Windows 10 in S mode - -We’ve continued to work on the **Current threats** area in [Virus & threat protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection), which now displays all threats that need action. You can quickly take action on threats from this screen: - -![Virus & threat protection settings](../images/virus-and-threat-protection.png "Virus & threat protection settings") - -## Deployment - -### Windows Autopilot - -[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) is a deployment tool introduced with Windows 10, version 1709 and is also available for Windows 10 Enterprise 2019 LTSC (and later versions). Windows Autopilot provides a modern device lifecycle management service powered by the cloud to deliver a zero touch experience for deploying Windows 10. - -Windows Autopilot is currently available with Surface, Dell, HP, and Lenovo. Other OEM partners such as Panasonic, and Acer will support Autopilot soon. Check the [Windows IT Pro Blog](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog) or this article for updated information. - -Using Intune, Autopilot now enables locking the device during provisioning during the Windows Out Of Box Experience (OOBE) until policies and settings for the device get provisioned, thereby ensuring that by the time the user gets to the desktop, the device is secured and configured correctly. - -You can also apply an Autopilot deployment profile to your devices using Microsoft Store for Business. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the Autopilot deployment profile you applied to the device. For more information, see [Manage Windows device deployment with Windows Autopilot Deployment](https://docs.microsoft.com/microsoft-store/add-profile-to-devices). - -#### Windows Autopilot self-deploying mode - -Windows Autopilot self-deploying mode enables a zero touch device provisioning experience. Simply power on the device, plug it into the Ethernet, and the device is fully configured automatically by Windows Autopilot. - -This self-deploying capability removes the current need to have an end user interact by pressing the “Next” button during the deployment process. - -You can utilize Windows Autopilot self-deploying mode to register the device to an AAD tenant, enroll in your organization’s MDM provider, and provision policies and applications, all with no user authentication or user interaction required. - -To learn more about Autopilot self-deploying mode and to see step-by-step instructions to perform such a deployment, [Windows Autopilot self-deploying mode](https://docs.microsoft.com/windows/deployment/windows-autopilot/self-deploying). - - -#### Autopilot Reset - -IT Pros can use Autopilot Reset to quickly remove personal files, apps, and settings. A custom login screen is available from the lock screen that enables you to apply original settings and management enrollment (Azure Active Directory and device management) so that devices are returned to a fully configured, known, IT-approved state and ready to use. For more information, see [Reset devices with Autopilot Reset](https://docs.microsoft.com/education/windows/autopilot-reset). - -### MBR2GPT.EXE - -MBR2GPT.EXE is a new command-line tool introduced with Windows 10, version 1703 and also available in Windows 10 Enterprise 2019 LTSC (and later versions). MBR2GPT converts a disk from Master Boot Record (MBR) to GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool is designed to be run from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS). - -The GPT partition format is newer and enables the use of larger and more disk partitions. It also provides added data reliability, supports additional partition types, and enables faster boot and shutdown speeds. If you convert the system disk on a computer from MBR to GPT, you must also configure the computer to boot in UEFI mode, so make sure that your device supports UEFI before attempting to convert the system disk. - -Additional security features of Windows 10 that are enabled when you boot in UEFI mode include: Secure Boot, Early Launch Anti-malware (ELAM) driver, Windows Trusted Boot, Measured Boot, Device Guard, Credential Guard, and BitLocker Network Unlock. - -For details, see [MBR2GPT.EXE](/windows/deployment/mbr-to-gpt). - -### DISM - -The following new DISM commands have been added to manage feature updates: - - DISM /Online /Initiate-OSUninstall - – Initiates a OS uninstall to take the computer back to the previous installation of windows. - DISM /Online /Remove-OSUninstall - – Removes the OS uninstall capability from the computer. - DISM /Online /Get-OSUninstallWindow - – Displays the number of days after upgrade during which uninstall can be performed. - DISM /Online /Set-OSUninstallWindow - – Sets the number of days after upgrade during which uninstall can be performed. - -For more information, see [DISM operating system uninstall command-line options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/dism-uninstallos-command-line-options). - -### Windows Setup - -You can now run your own custom actions or scripts in parallel with Windows Setup. Setup will also migrate your scripts to next feature release, so you only need to add them once. - -Prerequisites: -- Windows 10, version 1803 or Windows 10 Enterprise 2019 LTSC, or later. -- Windows 10 Enterprise or Pro - -For more information, see [Run custom actions during feature update](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions). - -It is also now possible to run a script if the user rolls back their version of Windows using the PostRollback option. - - /PostRollback [\setuprollback.cmd] [/postrollback {system / admin}] - -For more information, see [Windows Setup Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options#21) - -New command-line switches are also available to control BitLocker: - - Setup.exe /BitLocker AlwaysSuspend - – Always suspend bitlocker during upgrade. - Setup.exe /BitLocker TryKeepActive - – Enable upgrade without suspending bitlocker but if upgrade, does not work then suspend bitlocker and complete the upgrade. - Setup.exe /BitLocker ForceKeepActive - – Enable upgrade without suspending bitlocker, but if upgrade does not work, fail the upgrade. - -For more information, see [Windows Setup Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options#33) - -### Feature update improvements - -Portions of the work done during the offline phases of a Windows update have been moved to the online phase. This has resulted in a significant reduction of offline time when installing updates. For more information, see [We're listening to you](https://insider.windows.com/en-us/articles/were-listening-to-you/). - -### SetupDiag - -[SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag) is a new command-line tool that can help diagnose why a Windows 10 update failed. - -SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues. In the current version of SetupDiag there are 53 rules contained in the rules.xml file, which is extracted when SetupDiag is run. The rules.xml file will be updated as new versions of SetupDiag are made available. - -## Sign-in - -### Faster sign-in to a Windows 10 shared pc - -If you have shared devices deployed in your work place, **Fast sign-in** enables users to sign in to a [shared Windows 10 PC](https://docs.microsoft.com/windows/configuration/set-up-shared-or-guest-pc) in a flash! - -**To enable fast sign-in:** -1. Set up a shared or guest device with Windows 10, version 1809 or Windows 10 Enterprise 2019 LTSC. -2. Set the Policy CSP, and the **Authentication** and **EnableFastFirstSignIn** policies to enable fast sign-in. -3. Sign-in to a shared PC with your account. You'll notice the difference! - - ![fast sign-in](../images/fastsignin.png "fast sign-in") - -### Web sign-in to Windows 10 - -Until now, Windows logon only supported the use of identities federated to ADFS or other providers that support the WS-Fed protocol. We are introducing “web sign-in,” a new way of signing into your Windows PC. Web Sign-in enables Windows logon support for non-ADFS federated providers (e.g.SAML). - -**To try out web sign-in:** -1. Azure AD Join your Windows 10 PC. (Web sign-in is only supported on Azure AD Joined PCs). -2. Set the Policy CSP, and the Authentication and EnableWebSignIn polices to enable web sign-in. -3. On the lock screen, select web sign-in under sign-in options. -4. Click the “Sign in” button to continue. - -![Web sign-in](../images/websignin.png "web sign-in") - -## Windows Analytics - -### Upgrade Readiness - ->[!IMPORTANT] ->Upgrade Readiness will not allow you to assess an upgrade to an LTSC release (LTSC builds are not available as target versions). However, you can enroll devices running LTSC to plan for an upgrade to a semi-annual channel release. - -Upgrade Readiness helps you ensure that applications and drivers are ready for a Windows 10 upgrade. The solution provides up-to-date application and driver inventory, information about known issues, troubleshooting guidance, and per-device readiness and tracking details. The Upgrade Readiness tool moved from public preview to general availability on March 2, 2017. - -The development of Upgrade Readiness has been heavily influenced by input from the community the development of new features is ongoing. To begin using Upgrade Readiness, add it to an existing Operation Management Suite (OMS) workspace or sign up for a new OMS workspace with the Upgrade Readiness solution enabled. - -For more information about Upgrade Readiness, see the following topics: - -- [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics/) -- [Manage Windows upgrades with Upgrade Readiness](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness) - -Upgrade Readiness provides insights into application and driver compatibility issues. New capabilities include better app coverage, post-upgrade health reports, and enhanced report filtering capabilities. For more information, see [Manage Windows upgrades with Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness). - -### Update Compliance - -Update Compliance helps you to keep Windows 10 devices in your organization secure and up-to-date. - -Update Compliance is a solution built using OMS Log Analytics that provides information about installation status of monthly quality and feature updates. Details are provided about the deployment progress of existing updates and the status of future updates. Information is also provided about devices that might need attention to resolve issues. - -For more information about Update Compliance, see [Monitor Windows Updates with Update Compliance](/windows/deployment/update/update-compliance-monitor). - -New capabilities in Update Compliance let you monitor Windows Defender protection status, compare compliance with industry peers, and optimize bandwidth for deploying updates. For more information, see [Monitor Windows Updates and Windows Defender Antivirus with Update Compliance](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor). - -### Device Health - -Maintaining devices is made easier with Device Health, a new, premium analytic tool that identifies devices and drivers that crash frequently and might need to be rebuilt or replaced. For more information, see [Monitor the health of devices with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor). - -## Accessibility and Privacy - -### Accessibility - -"Out of box" accessibility is enhanced with auto-generated picture descriptions. For more information about accessibility, see [Accessibility information for IT Professionals](https://docs.microsoft.com/windows/configuration/windows-10-accessibility-for-itpros). Also see the accessibility section in the [What’s new in the Windows 10 April 2018 Update](https://blogs.windows.com/windowsexperience/2018/04/30/whats-new-in-the-windows-10-april-2018-update/) blog post. - -### Privacy - -In the Feedback and Settings page under Privacy Settings you can now delete the diagnostic data your device has sent to Microsoft. You can also view this diagnostic data using the [Diagnostic Data Viewer](https://docs.microsoft.com/windows/configuration/diagnostic-data-viewer-overview) app. - -## Configuration - -### Kiosk configuration - -Microsoft Edge has many improvements specifically targeted to Kiosks, however Edge is not available in the LTSC release of Windows 10. Internet Explorer is included in Windows 10 LTSC releases as its feature set is not changing, and it will continue to get security fixes for the life of a Windows 10 LTSC release. - -If you wish to take advantage of [Kiosk capabilities in Edge](https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy), consider [Kiosk mode](https://docs.microsoft.com/windows/configuration/kiosk-methods) with a semi-annual release channel. - -### Co-management - -Intune and System Center Configuration Manager policies have been added to enable hyrid Azure AD-joined authentication. Mobile Device Management (MDM) has added over 150 new policies and settings in this release, including the [MDMWinsOverGP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-controlpolicyconflict) policy, to enable easier transition to cloud-based management. - -For more information, see [What's New in MDM enrollment and management](https://docs.microsoft.com/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew1803) - -### OS uninstall period - -The OS uninstall period is a length of time that users are given when they can optionally roll back a Windows 10 update. With this release, administrators can use Intune or [DISM](#dism) to customize the length of the OS uninstall period. - -### Azure Active Directory join in bulk - -Using the new wizards in Windows Configuration Designer, you can [create provisioning packages to enroll devices in Azure Active Directory](/windows/configuration/provisioning-packages/provisioning-packages#configuration-designer-wizards). Azure AD join in bulk is available in the desktop, mobile, kiosk, and Surface Hub wizards. - -![get bulk token action in wizard](../images/bulk-token.png) - -### Windows Spotlight - -The following new Group Policy and mobile device management (MDM) settings are added to help you configure Windows Spotlight user experiences: - -- **Turn off the Windows Spotlight on Action Center** -- **Do not use diagnostic data for tailored experiences** -- **Turn off the Windows Welcome Experience** - -[Learn more about Windows Spotlight.](/windows/configuration/windows-spotlight) - -### Start and taskbar layout - -Previously, the customized taskbar could only be deployed using Group Policy or provisioning packages. Windows 10 Enterprise 2019 LTSC adds support for customized taskbars to [MDM](/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management). - -[Additional MDM policy settings are available for Start and taskbar layout](/windows/configuration/windows-10-start-layout-options-and-policies). New MDM policy settings include: - -- Settings for the User tile: [**Start/HideUserTile**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hideusertile), [**Start/HideSwitchAccount**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hideswitchaccount), [**Start/HideSignOut**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidesignout), [**Start/HideLock**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidelock), and [**Start/HideChangeAccountSettings**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidechangeaccountsettings) -- Settings for Power: [**Start/HidePowerButton**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidepowerbutton), [**Start/HideHibernate**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidehibernate), [**Start/HideRestart**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hiderestart), [**Start/HideShutDown**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hideshutdown), and [**Start/HideSleep**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidesleep) -- Additional new settings: [**Start/HideFrequentlyUsedApps**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidefrequentlyusedapps), [**Start/HideRecentlyAddedApps**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hiderecentlyaddedapps), **AllowPinnedFolder**, **ImportEdgeAssets**, [**Start/HideRecentJumplists**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hiderecentjumplists), [**Start/NoPinningToTaskbar**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-nopinningtotaskbar), [**Settings/PageVisibilityList**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#settings-pagevisibilitylist), and [**Start/HideAppsList**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hideapplist). - -## Windows Update - -### Windows Update for Business - -Windows Update for Business now provides greater control over updates, with the ability to pause and uninstall problematic updates using Intune. For more information, see [Manage software updates in Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure). - -The pause feature has been changed, and now requires a start date to set up. Users are now able to pause through **Settings > Update & security > Windows Update > Advanced options** in case a policy has not been configured. We have also increased the pause limit on quality updates to 35 days. You can find more information on pause in [Pause Feature Updates](/windows/deployment/update/waas-configure-wufb#pause-feature-updates) and [Pause Quality Updates](/windows/deployment/update/waas-configure-wufb#pause-quality-updates). - - -Windows Update for Business managed devices are now able to defer feature update installation by up to 365 days (it used to be 180 days). In settings, users are able to select their branch readiness level and update deferal periods. See [Configure devices for Current Branch (CB) or Current Branch for Business (CBB)](/windows/deployment/update/waas-configure-wufb#configure-devices-for-current-branch-or-current-branch-for-business), [Configure when devices receive Feature Updates](/windows/deployment/update/waas-configure-wufb#configure-when-devices-receive-feature-updates) and [Configure when devices receive Quality Updates](/windows/deployment/update/waas-configure-wufb#configure-when-devices-receive-quality-updates) for details. - -WUfB now has additional controls available to manage Windows Insider Program enrollment through policies. For more information, see [Manage Windows Insider Program flights](https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb#configure-when-devices-receive-windows-insider-preview-builds). - -Windows Update for Business now provides greater control over updates, with the ability to pause and uninstall problematic updates using Intune. For more information, see [Manage software updates in Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure). - -The pause feature has been changed, and now requires a start date to set up. Users are now able to pause through **Settings > Update & security > Windows Update > Advanced options** in case a policy has not been configured. We have also increased the pause limit on quality updates to 35 days. You can find more information on pause in [Pause Feature Updates](/windows/deployment/update/waas-configure-wufb#pause-feature-updates) and [Pause Quality Updates](/windows/deployment/update/waas-configure-wufb#pause-quality-updates). - - -Windows Update for Business managed devices are now able to defer feature update installation by up to 365 days (it used to be 180 days). In settings, users are able to select their branch readiness level and update deferal periods. See [Configure devices for Current Branch (CB) or Current Branch for Business (CBB)](/windows/deployment/update/waas-configure-wufb#configure-devices-for-current-branch-or-current-branch-for-business), [Configure when devices receive Feature Updates](/windows/deployment/update/waas-configure-wufb#configure-when-devices-receive-feature-updates) and [Configure when devices receive Quality Updates](/windows/deployment/update/waas-configure-wufb#configure-when-devices-receive-quality-updates) for details. - -WUfB now has additional controls available to manage Windows Insider Program enrollment through policies. For more information, see [Manage Windows Insider Program flights](https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb#configure-when-devices-receive-windows-insider-preview-builds). - -### Windows Insider for Business - -We recently added the option to download Windows 10 Insider Preview builds using your corporate credentials in Azure Active Directory (AAD). By enrolling devices in AAD, you increase the visibility of feedback submitted by users in your organization – especially on features that support your specific business needs. For details, see [Windows Insider Program for Business](/windows/deployment/update/waas-windows-insider-for-business). - -You can now register your Azure AD domains to the Windows Insider Program. For more information, see [Windows Insider Program for Business](https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business#getting-started-with-windows-insider-program-for-business). - - -### Optimize update delivery - -With changes delivered in Windows 10 Enterprise 2019 LTSC, [Express updates](/windows/deployment/update/waas-optimize-windows-10-updates#express-update-delivery) are now fully supported with System Center Configuration Manager, starting with version 1702 of Configuration Manager, as well as with other third-party updating and management products that [implement this new functionality](https://technet.microsoft.com/windows-server-docs/management/windows-server-update-services/deploy/express-update-delivery-isv-support). This is in addition to current Express support on Windows Update, Windows Update for Business and WSUS. - ->[!NOTE] -> The above changes can be made available to Windows 10, version 1607, by installing the April 2017 cumulative update. - -Delivery Optimization policies now enable you to configure additional restrictions to have more control in various scenarios. - -Added policies include: -- [Allow uploads while the device is on battery while under set Battery level](/windows/deployment/update/waas-delivery-optimization#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) -- [Enable Peer Caching while the device connects via VPN](/windows/deployment/update/waas-delivery-optimization#enable-peer-caching-while-the-device-connects-via-vpn) -- [Minimum RAM (inclusive) allowed to use Peer Caching](/windows/deployment/update/waas-delivery-optimization#minimum-ram-allowed-to-use-peer-caching) -- [Minimum disk size allowed to use Peer Caching](/windows/deployment/update/waas-delivery-optimization#minimum-disk-size-allowed-to-use-peer-caching) -- [Minimum Peer Caching Content File Size](/windows/deployment/update/waas-delivery-optimization#minimum-peer-caching-content-file-size) - -To check out all the details, see [Configure Delivery Optimization for Windows 10 updates](/windows/deployment/update/waas-delivery-optimization) - -### Uninstalled in-box apps no longer automatically reinstall - -Starting with Windows 10 Enterprise 2019 LTSC, in-box apps that were uninstalled by the user won't automatically reinstall as part of the feature update installation process. - -Additionally, apps de-provisioned by admins on Windows 10 Enterprise 2019 LTSC machines will stay de-provisioned after future feature update installations. This will not apply to the update from Windows 10 Enterprise 2016 LTSC (or earlier) to Windows 10 Enterprise 2019 LTSC. - -## Management - -### New MDM capabilities - -Windows 10 Enterprise 2019 LTSC adds many new [configuration service providers (CSPs)](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) that provide new capabilities for managing Windows 10 devices using MDM or provisioning packages. Among other things, these CSPs enable you to configure a few hundred of the most useful Group Policy settings via MDM - see [Policy CSP - ADMX-backed policies](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-admx-backed). - -Some of the other new CSPs are: - -- The [DynamicManagement CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/dynamicmanagement-csp) allows you to manage devices differently depending on location, network, or time. For example, managed devices can have cameras disabled when at a work location, the cellular service can be disabled when outside the country to avoid roaming charges, or the wireless network can be disabled when the device is not within the corporate building or campus. Once configured, these settings will be enforced even if the device can’t reach the management server when the location or network changes. The Dynamic Management CSP enables configuration of policies that change how the device is managed in addition to setting the conditions on which the change occurs. - -- The [CleanPC CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/cleanpc-csp) allows removal of user-installed and pre-installed applications, with the option to persist user data. - -- The [BitLocker CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/bitlocker-csp) is used to manage encryption of PCs and devices. For example, you can require storage card encryption on mobile devices, or require encryption for operating system drives. - -- The [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp) is used to configure a proxy server for ethernet and Wi-Fi connections. - -- The [Office CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/office-csp) enables a Microsoft Office client to be installed on a device via the Office Deployment Tool. For more information, see [Configuration options for the Office Deployment Tool](https://technet.microsoft.com/library/jj219426.aspx). - -- The [EnterpriseAppVManagement CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp) is used to manage virtual applications in Windows 10 PCs (Enterprise and Education editions) and enables App-V sequenced apps to be streamed to PCs even when managed by MDM. - -IT pros can use the new [MDM Migration Analysis Tool (MMAT)](https://aka.ms/mmat) to determine which Group Policy settings have been configured for a user or computer and cross-reference those settings against a built-in list of supported MDM policies. MMAT can generate both XML and HTML reports indicating the level of support for each Group Policy setting and MDM equivalents. - -[Learn more about new MDM capabilities.](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/new-in-windows-mdm-enrollment-management#whatsnew10) - -MDM has been expanded to include domain joined devices with Azure Active Directory registration. Group Policy can be used with Active Directory joined devices to trigger auto-enrollment to MDM. For more information, see [Enroll a Windows 10 device automatically using Group Policy](https://docs.microsoft.com/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy). - -Multiple new configuration items are also added. For more information, see [What's new in MDM enrollment and management](https://docs.microsoft.com/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew1709). - -### Mobile application management support for Windows 10 - -The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. MAM support is built into Windows on top of Windows Information Protection (WIP), starting in Windows 10 Enterprise 2019 LTSC. - -For more info, see [Implement server-side support for mobile application management on Windows](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/implement-server-side-mobile-application-management). - -### MDM diagnostics - -In Windows 10 Enterprise 2019 LTSC, we continue our work to improve the diagnostic experience for modern management. By introducing auto-logging for mobile devices, Windows will automatically collect logs when encountering an error in MDM, eliminating the need to have always-on logging for memory-constrained devices. Additionally, we are introducing [Microsoft Message Analyzer](https://www.microsoft.com/download/details.aspx?id=44226) as an additional tool to help Support personnel quickly reduce issues to their root cause, while saving time and cost. - -### Application Virtualization for Windows (App-V) - -Previous versions of the Microsoft Application Virtualization Sequencer (App-V Sequencer) have required you to manually create your sequencing environment. Windows 10 Enterprise 2019 LTSC introduces two new PowerShell cmdlets, New-AppVSequencerVM and Connect-AppvSequencerVM, which automatically create your sequencing environment for you, including provisioning your virtual machine. Additionally, the App-V Sequencer has been updated to let you sequence or update multiple apps at the same time, while automatically capturing and storing your customizations as an App-V project template (.appvt) file, and letting you use PowerShell or Group Policy settings to automatically cleanup your unpublished packages after a device restart. - -For more info, see the following topics: -- [Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)](/windows/application-management/app-v/appv-auto-provision-a-vm) -- [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](/windows/application-management/app-v/appv-auto-batch-sequencing) -- [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](/windows/application-management/app-v/appv-auto-batch-updating) -- [Automatically cleanup unpublished packages on the App-V client](/windows/application-management/app-v/appv-auto-clean-unpublished-packages) - -### Windows diagnostic data - -Learn more about the diagnostic data that's collected at the Basic level and some examples of the types of data that is collected at the Full level. - -- [Windows 10, version 1703 basic level Windows diagnostic events and fields](/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703) -- [Windows 10, version 1703 Diagnostic Data](/windows/configuration/windows-diagnostic-data-1703) - -### Group Policy spreadsheet - -Learn about the new Group Policies that were added in Windows 10 Enterprise 2019 LTSC. - -- [Group Policy Settings Reference for Windows and Windows Server](https://www.microsoft.com/download/details.aspx?id=25250) - -### Mixed Reality Apps - -This version of Windows 10 introduces [Windows Mixed Reality](https://blogs.windows.com/windowsexperience/2017/10/03/the-era-of-windows-mixed-reality-begins-october-17/). Organizations that use WSUS must take action to enable Windows Mixed Reality. You can also prohibit use of Windows Mixed Reality by blocking installation of the Mixed Reality Portal. For more information, see [Enable or block Windows Mixed Reality apps in the enterprise](https://docs.microsoft.com/windows/application-management/manage-windows-mixed-reality). - -## Networking - -### Network stack - -Several network stack enhancements are available in this release. Some of these features were also available in Windows 10, version 1703. For more information, see [Core Network Stack Features in the Creators Update for Windows 10](https://blogs.technet.microsoft.com/networking/2017/07/13/core-network-stack-features-in-the-creators-update-for-windows-10/). - -### Miracast over Infrastructure - -In this version of Windows 10, Microsoft has extended the ability to send a Miracast stream over a local network rather than over a direct wireless link. This functionality is based on the [Miracast over Infrastructure Connection Establishment Protocol (MS-MICE)](https://msdn.microsoft.com/library/mt796768.aspx). - -How it works: - -Users attempt to connect to a Miracast receiver as they did previously. When the list of Miracast receivers is populated, Windows 10 will identify that the receiver is capable of supporting a connection over the infrastructure. When the user selects a Miracast receiver, Windows 10 will attempt to resolve the device's hostname via standard DNS, as well as via multicast DNS (mDNS). If the name is not resolvable via either DNS method, Windows 10 will fall back to establishing the Miracast session using the standard Wi-Fi direct connection. - -Miracast over Infrastructure offers a number of benefits: - -- Windows automatically detects when sending the video stream over this path is applicable. -- Windows will only choose this route if the connection is over Ethernet or a secure Wi-Fi network. -- Users do not have to change how they connect to a Miracast receiver. They use the same UX as for standard Miracast connections. -- No changes to current wireless drivers or PC hardware are required. -- It works well with older wireless hardware that is not optimized for Miracast over Wi-Fi Direct. -- It leverages an existing connection which both reduces the time to connect and provides a very stable stream. - -Enabling Miracast over Infrastructure: - -If you have a device that has been updated to Windows 10 Enterprise 2019 LTSC, then you automatically have this new feature. To take advantage of it in your environment, you need to ensure the following is true within your deployment: - -- The device (PC, phone, or Surface Hub) needs to be running Windows 10, version 1703, Windows 10 Enterprise 2019 LTSC, or a later OS. -- A Windows PC or Surface Hub can act as a Miracast over Infrastructure *receiver*. A Windows PC or phone can act as a Miracast over Infrastructure *source*. - - As a Miracast receiver, the PC or Surface Hub must be connected to your enterprise network via either Ethernet or a secure Wi-Fi connection (e.g. using either WPA2-PSK or WPA2-Enterprise security). If the Hub is connected to an open Wi-Fi connection, Miracast over Infrastructure will disable itself. - - As a Miracast source, the PC or phone must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. -- The DNS Hostname (device name) of the device needs to be resolvable via your DNS servers. You can achieve this by either allowing your device to register automatically via Dynamic DNS, or by manually creating an A or AAAA record for the device's hostname. -- Windows 10 PCs must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. - -It is important to note that Miracast over Infrastructure is not a replacement for standard Miracast. Instead, the functionality is complementary, and provides an advantage to users who are part of the enterprise network. Users who are guests to a particular location and don’t have access to the enterprise network will continue to connect using the Wi-Fi Direct connection method. - -## Registry editor improvements - -We added a dropdown that displays as you type to help complete the next part of the path. You can also press **Ctrl + Backspace** to delete the last word, and **Ctrl + Delete** to delete the next word. - -![Registry editor dropdown](../images/regeditor.png "Registry editor dropdown") - -## Remote Desktop with Biometrics - -Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. - -To get started, sign into your device using Windows Hello for Business. Bring up **Remote Desktop Connection** (mstsc.exe), type the name of the computer you want to connect to, and click **Connect**. - -- Windows remembers that you signed using Windows Hello for Business, and automatically selects Windows Hello for Business to authenticate you to your RDP session. You can also click **More choices** to choose alternate credentials. -- Windows uses facial recognition to authenticate the RDP session to the Windows Server 2016 Hyper-V server. You can continue to use Windows Hello for Business in the remote session, but you must use your PIN. - -See the following example: - -![Enter your credentials](../images/RDPwBioTime.png "Windows Hello") -![Enter your credentials](../images/RDPwBio2.png "Windows Hello personal") -![Microsoft Hyper-V Server 2016](../images/hyper-v.png "Microsoft Hyper-V Server 2016") - -## See Also - -[Windows 10 Enterprise LTSC](index.md): A short description of the LTSC servicing channel with links to information about each release. +--- +title: What's new in Windows 10 Enterprise 2019 LTSC +ms.reviewer: +manager: laurawi +ms.author: greglin +description: New and updated IT Pro content about new features in Windows 10 Enterprise 2019 LTSC (also known as Windows 10 Enterprise 2019 LTSB). +keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 Enterprise 2019 LTSC"] +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +author: greg-lindsay +ms.localizationpriority: low +ms.topic: article +--- + +# What's new in Windows 10 Enterprise 2019 LTSC + +**Applies to** +- Windows 10 Enterprise 2019 LTSC + +This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise 2019 LTSC, compared to Windows 10 Enterprise 2016 LTSC (LTSB). For a brief description of the LTSC servicing channel and associated support, see [Windows 10 Enterprise LTSC](index.md). + +>[!NOTE] +>Features in Windows 10 Enterprise 2019 LTSC are equivalent to Windows 10, version 1809. + +Windows 10 Enterprise LTSC 2019 builds on Windows 10 Pro, version 1809 adding premium features designed to address the needs of large and mid-size organizations (including large academic institutions), such as: +- Advanced protection against modern security threats +- Full flexibility of OS deployment +- Updating and support options +- Comprehensive device and app management and control capabilities + +The Windows 10 Enterprise LTSC 2019 release is an important release for LTSC users because it includes the cumulative enhancements provided in Windows 10 versions 1703, 1709, 1803, and 1809. Details about these enhancements are provided below. + +>[!IMPORTANT] +>The LTSC release is [intended for special use devices](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/LTSC-What-is-it-and-when-should-it-be-used/ba-p/293181). Support for LTSC by apps and tools that are designed for the semi-annual channel release of Windows 10 might be limited. + +## Microsoft Intune + +>Microsoft Intune supports Windows 10 Enterprise LTSC 2019 and later. This includes support for features such as [Windows Autopilot](#windows-autopilot). However, note that Windows Update for Business (WUfB) does not currently support any LTSC releases, therefore you should use WSUS or Configuration Manager for patching. + +## Security + +This version of Window 10 includes security improvements for threat protection, information protection, and identity protection. + +### Threat protection + +#### Windows Defender ATP + +The Windows Defender Advanced Threat Protection ([Windows Defender ATP](/windows/security/threat-protection/index)) platform inludes the security pillars shown in the following diagram. In this version of Windows, Windows Defender ATP includes powerful analytics, security stack integration, and centralized management for better detection, prevention, investigation, response, and management. + +![Windows Defender ATP](../images/wdatp.png) + +##### Attack surface reduction + +Attack surface reduction includes host-based intrusion prevention systems such as [controlled folder access](/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard). + - This feature can help prevent ransomware and other destructive malware from changing your personal files. In some cases, apps that you normally use might be blocked from making changes to common folders like **Documents** and **Pictures**. We’ve made it easier for you to add apps that were recently blocked so you can keep using your device without turning off the feature altogether. + - When an app is blocked, it will appear in a recently blocked apps list, which you can get to by clicking **Manage settings** under the **Ransomware protection** heading. Click **Allow an app through Controlled folder access**. After the prompt, click the **+** button and choose **Recently blocked apps**. Select any of the apps to add them to the allowed list. You can also browse for an app from this page. + +###### Windows Defender Firewall + +Windows Defender Firewall now supports Windows Subsystem for Linux (WSL) processes. You can add specific rules for a WSL process just as you would for any Windows process. Also, Windows Defender Firewall now supports notifications for WSL processes. For example, when a Linux tool wants to allow access to a port from the outside (like SSH or a web server like nginx), Windows Defender Firewall will prompt to allow access just like it would for a Windows process when the port starts accepting connections. This was first introduced in [Build 17627](https://docs.microsoft.com/windows/wsl/release-notes#build-17618-skip-ahead). + +##### Windows Defender Device Guard + +[Device Guard](/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control) has always been a collection of technologies that can be combined to lock down a PC, including: +- Software-based protection provided by code integrity policies +- Hardware-based protection provided by Hypervisor-protected code integrity (HVCI) + +But these protections can also be configured separately. And, unlike HVCI, code integrity policies do not require virtualization-based security (VBS). To help underscore the distinct value of these protections, code integrity policies have been rebranded as [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control). + +### Next-gen protection + +#### Office 365 Ransomware Detection + +For Office 365 Home and Office 365 Personal subscribers, Ransomware Detection notifies you when your OneDrive files have been attacked and guides you through the process of restoring your files. For more information, see [Ransomware detection and recovering your files](https://support.office.com/en-us/article/ransomware-detection-and-recovering-your-files-0d90ec50-6bfd-40f4-acc7-b8c12c73637f?ui=en-US&rs=en-US&ad=US) + +### Endpoint detection and response + +Endpoint detection and response is improved. Enterprise customers can now take advantage of the entire Windows security stack with Windows Defender Antivirus **detections** and Device Guard **blocks** being surfaced in the Windows Defender ATP portal. + + Windows Defender is now called Windows Defender Antivirus and now shares detection status between M365 services and interoperates with Windows Defender ATP. Additional policies have also been implemented to enhance cloud based protection, and new channels are available for emergency protection. For more information, see [Virus and threat protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection) and [Use next-gen technologies in Windows Defender Antivirus through cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus). + + We've also [increased the breadth of the documentation library for enterprise security admins](/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10). The new library includes information on: +- [Deploying and enabling AV protection](/windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus) +- [Managing updates](/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus) +- [Reporting](/windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus) +- [Configuring features](/windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features) +- [Troubleshooting](/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus) + + Some of the highlights of the new library include [Evaluation guide for Windows Defender AV](/windows/threat-protection/windows-defender-antivirus//evaluate-windows-defender-antivirus) and [Deployment guide for Windows Defender AV in a virtual desktop infrastructure environment](/windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus). + + New features for Windows Defender AV in Windows 10 Enterprise 2019 LTSC include: +- [Updates to how the Block at First Sight feature can be configured](/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus) +- [The ability to specify the level of cloud-protection](/windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus) +- [Windows Defender Antivirus protection in the Windows Defender Security Center app](/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus) + + We've [invested heavily in helping to protect against ransomware](https://blogs.windows.com/business/2016/11/11/defending-against-ransomware-with-windows-10-anniversary-update/#UJlHc6SZ2Zm44jCt.97), and we continue that investment with [updated behavior monitoring and always-on real-time protection](/windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus). + + **Endpoint detection and response** is also enhanced. New **detection** capabilities include: +- [Use the threat intelligence API to create custom alerts](/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection) - Understand threat intelligence concepts, enable the threat intel application, and create custom threat intelligence alerts for your organization. + - [Custom detection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-custom-detections). With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats. This can be done by leveraging the power of Advanced hunting through the creation of custom detection rules. + - Improvements on OS memory and kernel sensors to enable detection of attackers who are using in-memory and kernel-level attacks. + - Upgraded detections of ransomware and other advanced attacks. + - Historical detection capability ensures new detection rules apply to up to six months of stored data to detect previous attacks that might not have been noticed. + + **Threat reponse** is improved when an attack is detected, enabling immediate action by security teams to contain a breach: +- [Take response actions on a machine](/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection) - Quickly respond to detected attacks by isolating machines or collecting an investigation package. + - [Take response actions on a file](/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection) - Quickly respond to detected attacks by stopping and quarantining files or blocking a file. + +Additional capabilities have been added to help you gain a holistic view on **investigations** include: +- [Threat analytics](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics) - Threat Analytics is a set of interactive reports published by the Windows Defender ATP research team as soon as emerging threats and outbreaks are identified. The reports help security operations teams assess impact on their environment and provides recommended actions to contain, increase organizational resilience, and prevent specific threats. +- [Query data using Advanced hunting in Windows Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection) +- [Use Automated investigations to investigate and remediate threats](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection) +- [Investigate a user account](/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection) - Identify user accounts with the most active alerts and investigate cases of potential compromised credentials. +- [Alert process tree](/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection#alert-process-tree) - Aggregates multiple detections and related events into a single view to reduce case resolution time. +- [Pull alerts using REST API](/windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection) - Use REST API to pull alerts from Windows Defender ATP. + +Other enhanced security features include: +- [Check sensor health state](/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection) - Check an endpoint's ability to provide sensor data and communicate with the Windows Defender ATP service and fix known issues. +- [Managed security service provider (MSSP) support](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection) - Windows Defender ATP adds support for this scenario by providing MSSP integration. The integration will allow MSSPs to take the following actions: Get access to MSSP customer's Windows Defender Security Center portal, fetch email notifications, and fetch alerts through security information and event management (SIEM) tools. +- [Integration with Azure Security Center](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection#integration-with-azure-security-center) - Windows Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Windows Defender ATP to provide improved threat detection for Windows Servers. +- [Integration with Microsoft Cloud App Security](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration) - Microsoft Cloud App Security leverages Windows Defender ATP endpoint signals to allow direct visibility into cloud application usage including the use of unsupported cloud services (shadow IT) from all Windows Defender ATP monitored machines. +- [Onboard Windows Server 2019](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection#windows-server-version-1803-and-windows-server-2019) - Windows Defender ATP now adds support for Windows Server 2019. You'll be able to onboard Windows Server 2019 in the same method available for Windows 10 client machines. +- [Onboard previous versions of Windows](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection) - Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor. +- [Enable conditional access to better protect users, devices, and data](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection) + +We've also added a new assessment for the Windows time service to the **Device performance & health** section. If we detect that your device’s time is not properly synced with our time servers and the time-syncing service is disabled, we’ll provide the option for you to turn it back on. + +We’re continuing to work on how other security apps you’ve installed show up in the **Windows Security** app. There’s a new page called **Security providers** that you can find in the **Settings** section of the app. Click **Manage providers** to see a list of all the other security providers (including antivirus, firewall, and web protection) that are running on your device. Here you can easily open the providers’ apps or get more information on how to resolve issues reported to you through **Windows Security**. + +This also means you’ll see more links to other security apps within **Windows Security**. For example, if you open the **Firewall & network protection** section, you’ll see the firewall apps that are running on your device under each firewall type, which includes domain, private, and public networks). + +You can read more about ransomware mitigations and detection capability at: +- [Averting ransomware epidemics in corporate networks with Windows Defender ATP](https://blogs.technet.microsoft.com/mmpc/2017/01/30/averting-ransomware-epidemics-in-corporate-networks-with-windows-defender-atp/) +- [Ransomware Protection in Windows 10 Anniversary Update whitepaper (PDF)](http://wincom.blob.core.windows.net/documents/Ransomware_protection_in_Windows_10_Anniversary_Update.pdf) +- [Microsoft Malware Protection Center blog](https://blogs.technet.microsoft.com/mmpc/category/research/ransomware/) + +Also see [New capabilities of Windows Defender ATP further maximizing the effectiveness and robustness of endpoint security](https://blogs.windows.com/business/2018/04/17/new-capabilities-of-windows-defender-atp-further-maximizing-the-effectiveness-and-robustness-of-endpoint-security/#62FUJ3LuMXLQidVE.97) + +Get a quick, but in-depth overview of Windows Defender ATP for Windows 10: [Windows Defender Advanced Threat Protection](/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection). + +For more information about features of Windows Defender ATP available in different editions of Windows 10, see the [Windows 10 commercial edition comparison](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf). + +### Information protection + +Improvements have been added to Windows Information Protection and BitLocker. + +#### Windows Information Protection + +Windows Information Protection is now designed to work with Microsoft Office and Azure Information Protection. For more information, see [Deploying and managing Windows Information Protection (WIP) with Azure Information Protection](https://myignite.microsoft.com/sessions/53660?source=sessions). + +Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network. For more info, see [Create a Windows Information Protection (WIP) policy using Microsoft Intune](/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune) and [Associate and deploy your Windows Information Protection (WIP) and VPN policies by using Microsoft Intune](/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune). + +You can also now collect your audit event logs by using the Reporting configuration service provider (CSP) or the Windows Event Forwarding (for Windows desktop domain-joined devices). For info, see the brand-new topic, [How to collect Windows Information Protection (WIP) audit event logs](/windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs). + +This release enables support for WIP with Files on Demand, allows file encryption while the file is open in another app, and improves performance. For more information, see [OneDrive Files On-Demand For The Enterprise](https://techcommunity.microsoft.com/t5/OneDrive-Blog/OneDrive-Files-On-Demand-For-The-Enterprise/ba-p/117234). + +### BitLocker + +The minimum PIN length is being changed from 6 to 4, with a default of 6. For more information, see [BitLocker Group Policy settings](https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-group-policy-settings#bkmk-unlockpol3). + +#### Silent enforcement on fixed drives + +Through a Modern Device Management (MDM) policy, BitLocker can be enabled silently for standard Azure Active Directory (AAD) joined users. In Windows 10, version 1803 automatic BitLocker encryption was enabled for standard AAD users, but this still required modern hardware that passed the Hardware Security Test Interface (HSTI). This new functionality enables BitLocker via policy even on devices that don’t pass the HSTI. + +This is an update to the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp), which was introduced in Windows 10, version 1703, and leveraged by Intune and others. + +This feature will soon be enabled on Olympia Corp as an optional feature. + +#### Delivering BitLocker policy to AutoPilot devices during OOBE + +You can choose which encryption algorithm to apply to BitLocker encryption capable devices, rather than automatically having those devices encrypt themselves with the default algorithm. This allows the encryption algorithm (and other BitLocker policies that must be applied prior to encryption), to be delivered before BitLocker encryption begins. + +For example, you can choose the XTS-AES 256 encryption algorithm, and have it applied to devices that would normally encrypt themselves automatically with the default XTS-AES 128 algorithm during OOBE. + +To achieve this: + +1. Configure the [encryption method settings](https://docs.microsoft.com/intune/endpoint-protection-windows-10#windows-encryption) in the Windows 10 Endpoint Protection profile to the desired encryption algorithm. +2. [Assign the policy](https://docs.microsoft.com/intune/device-profile-assign) to your Autopilot device group. + - **IMPORTANT**: The encryption policy must be assigned to **devices** in the group, not users. +3. Enable the Autopilot [Enrollment Status Page](https://docs.microsoft.com/windows/deployment/windows-autopilot/enrollment-status) (ESP) for these devices. + - **IMPORTANT**: If the ESP is not enabled, the policy will not apply before encryption starts. + +### Identity protection + +Improvements have been added are to Windows Hello for Business and Credential Guard. + +#### Windows Hello for Business + +New features in Windows Hello enable a better device lock experience, using multifactor unlock with new location and user proximity signals. Using Bluetooth signals, you can configure your Windows 10 device to automatically lock when you walk away from it, or to prevent others from accessing the device when you are not present. + +New features in [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/hello-identity-verification.md) inlcude: +- You can now reset a forgotten PIN without deleting company managed data or apps on devices managed by [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune). +- For Windows Phone devices, an administrator is able to initiate a remote PIN reset through the Intune portal. +- For Windows desktops, users are able to reset a forgotten PIN through **Settings > Accounts > Sign-in options**. For more details, check out [What if I forget my PIN?](/windows/security/identity-protection/hello-for-business/hello-features#pin-reset). + +[Windows Hello](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features) now supports FIDO 2.0 authentication for Azure AD Joined Windows 10 devices and has enhanced support for shared devices, as described in the [Kiosk configuration](#kiosk-configuration) section. +- Windows Hello is now [password-less on S-mode](https://www.windowslatest.com/2018/02/12/microsoft-make-windows-10-password-less-platform/). +- Support for S/MIME with Windows Hello for Business and APIs for non-Microsoft identity lifecycle management solutions. +- Windows Hello is part of the account protection pillar in Windows Defender Security Center. Account Protection will encourage password users to set up Windows Hello Face, Fingerprint or PIN for faster sign in, and will notify Dynamic lock users if Dynamic lock has stopped working because their phone or device Bluetooth is off. +- You can set up Windows Hello from lock screen for MSA accounts. We’ve made it easier for Microsoft account users to set up Windows Hello on their devices for faster and more secure sign-in. Previously, you had to navigate deep into Settings to find Windows Hello. Now, you can set up Windows Hello Face, Fingerprint or PIN straight from your lock screen by clicking the Windows Hello tile under Sign-in options. +- New [public API](https://docs.microsoft.com/uwp/api/windows.security.authentication.web.core.webauthenticationcoremanager.findallaccountsasync#Windows_Security_Authentication_Web_Core_WebAuthenticationCoreManager_FindAllAccountsAsync_Windows_Security_Credentials_WebAccountProvider_) for secondary account SSO for a particular identity provider. +- It is easier to set up Dynamic lock, and WD SC actionable alerts have been added when Dynamic lock stops working (ex: phone Bluetooth is off). + +For more information, see: [Windows Hello and FIDO2 Security Keys enable secure and easy authentication for shared devices](https://blogs.windows.com/business/2018/04/17/windows-hello-fido2-security-keys/#OdKBg3pwJQcEKCbJ.97) + +#### Windows Defender Credential Guard + +Windows Defender Credential Guard is a security service in Windows 10 built to protect Active Directory (AD) domain credentials so that they can't be stolen or misused by malware on a user's machine. It is designed to protect against well-known threats such as Pass-the-Hash and credential harvesting. + +Windows Defender Credential Guard has always been an optional feature, but Windows 10 in S mode turns this functionality on by default when the machine has been Azure Active Directory joined. This provides an added level of security when connecting to domain resources not normally present on devices running Windows 10 in S mode. Please note that Windows Defender Credential Guard is available only to S mode devices or Enterprise and Education Editions. + +For more information, see [Credential Guard Security Considerations](/windows/access-protection/credential-guard/credential-guard-requirements#security-considerations). + +### Other security improvments + +#### Windows security baselines + +Microsoft has released new [Windows security baselines](https://docs.microsoft.com/windows/device-security/windows-security-baselines) for Windows Server and Windows 10. A security baseline is a group of Microsoft-recommended configuration settings with an explanation of their security impact. For more information, and to download the Policy Analyzer tool, see [Microsoft Security Compliance Toolkit 1.0](https://docs.microsoft.com/windows/device-security/security-compliance-toolkit-10). + +**Windows security baselines** have been updated for Windows 10. A [security baseline](https://docs.microsoft.com/windows/device-security/windows-security-baselines) is a group of Microsoft-recommended configuration settings and explains their security impact. For more information, and to download the Policy Analyzer tool, see [Microsoft Security Compliance Toolkit 1.0](https://docs.microsoft.com/windows/device-security/security-compliance-toolkit-10). + +The new [security baseline for Windows 10 version 1803](https://docs.microsoft.com/windows/security/threat-protection/security-compliance-toolkit-10) has been published. + +#### SMBLoris vulnerability + +An issue, known as “SMBLoris�?, which could result in denial of service, has been addressed. + +#### Windows Security Center + +Windows Defender Security Center is now called **Windows Security Center**. + +You can still get to the app in all the usual ways – simply ask Cortana to open Windows Security Center(WSC) or interact with the taskbar icon. WSC lets you manage all your security needs, including **Windows Defender Antivirus** and **Windows Defender Firewall**. + +The WSC service now requires antivirus products to run as a protected process to register. Products that have not yet implemented this will not appear in the Windows Security Center user interface, and Windows Defender Antivirus will remain enabled side-by-side with these products. + +WSC now includes the Fluent Design System elements you know and love. You’ll also notice we’ve adjusted the spacing and padding around the app. It will now dynamically size the categories on the main page if more room is needed for extra info. We also updated the title bar so that it will use your accent color if you have enabled that option in **Color Settings**. + +![alt text](../images/defender.png "Windows Security Center") + +#### Group Policy Security Options + +The security setting [**Interactive logon: Display user information when the session is locked**](/windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked) has been updated to work in conjunction with the **Privacy** setting in **Settings** > **Accounts** > **Sign-in options**. + +A new security policy setting +[**Interactive logon: Don't display username at sign-in**](/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in) has been introduced in Windows 10 Enterprise 2019 LTSC. This security policy setting determines whether the username is displayed during sign in. It works in conjunction with the **Privacy** setting in **Settings** > **Accounts** > **Sign-in options**. The setting only affects the **Other user** tile. + +#### Windows 10 in S mode + +We’ve continued to work on the **Current threats** area in [Virus & threat protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection), which now displays all threats that need action. You can quickly take action on threats from this screen: + +![Virus & threat protection settings](../images/virus-and-threat-protection.png "Virus & threat protection settings") + +## Deployment + +### Windows Autopilot + +[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) is a deployment tool introduced with Windows 10, version 1709 and is also available for Windows 10 Enterprise 2019 LTSC (and later versions). Windows Autopilot provides a modern device lifecycle management service powered by the cloud to deliver a zero touch experience for deploying Windows 10. + +Windows Autopilot is currently available with Surface, Dell, HP, and Lenovo. Other OEM partners such as Panasonic, and Acer will support Autopilot soon. Check the [Windows IT Pro Blog](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog) or this article for updated information. + +Using Intune, Autopilot now enables locking the device during provisioning during the Windows Out Of Box Experience (OOBE) until policies and settings for the device get provisioned, thereby ensuring that by the time the user gets to the desktop, the device is secured and configured correctly. + +You can also apply an Autopilot deployment profile to your devices using Microsoft Store for Business. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the Autopilot deployment profile you applied to the device. For more information, see [Manage Windows device deployment with Windows Autopilot Deployment](https://docs.microsoft.com/microsoft-store/add-profile-to-devices). + +#### Windows Autopilot self-deploying mode + +Windows Autopilot self-deploying mode enables a zero touch device provisioning experience. Simply power on the device, plug it into the Ethernet, and the device is fully configured automatically by Windows Autopilot. + +This self-deploying capability removes the current need to have an end user interact by pressing the “Next” button during the deployment process. + +You can utilize Windows Autopilot self-deploying mode to register the device to an AAD tenant, enroll in your organization’s MDM provider, and provision policies and applications, all with no user authentication or user interaction required. + +To learn more about Autopilot self-deploying mode and to see step-by-step instructions to perform such a deployment, [Windows Autopilot self-deploying mode](https://docs.microsoft.com/windows/deployment/windows-autopilot/self-deploying). + + +#### Autopilot Reset + +IT Pros can use Autopilot Reset to quickly remove personal files, apps, and settings. A custom login screen is available from the lock screen that enables you to apply original settings and management enrollment (Azure Active Directory and device management) so that devices are returned to a fully configured, known, IT-approved state and ready to use. For more information, see [Reset devices with Autopilot Reset](https://docs.microsoft.com/education/windows/autopilot-reset). + +### MBR2GPT.EXE + +MBR2GPT.EXE is a new command-line tool introduced with Windows 10, version 1703 and also available in Windows 10 Enterprise 2019 LTSC (and later versions). MBR2GPT converts a disk from Master Boot Record (MBR) to GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool is designed to be run from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS). + +The GPT partition format is newer and enables the use of larger and more disk partitions. It also provides added data reliability, supports additional partition types, and enables faster boot and shutdown speeds. If you convert the system disk on a computer from MBR to GPT, you must also configure the computer to boot in UEFI mode, so make sure that your device supports UEFI before attempting to convert the system disk. + +Additional security features of Windows 10 that are enabled when you boot in UEFI mode include: Secure Boot, Early Launch Anti-malware (ELAM) driver, Windows Trusted Boot, Measured Boot, Device Guard, Credential Guard, and BitLocker Network Unlock. + +For details, see [MBR2GPT.EXE](/windows/deployment/mbr-to-gpt). + +### DISM + +The following new DISM commands have been added to manage feature updates: + + DISM /Online /Initiate-OSUninstall + – Initiates a OS uninstall to take the computer back to the previous installation of windows. + DISM /Online /Remove-OSUninstall + – Removes the OS uninstall capability from the computer. + DISM /Online /Get-OSUninstallWindow + – Displays the number of days after upgrade during which uninstall can be performed. + DISM /Online /Set-OSUninstallWindow + – Sets the number of days after upgrade during which uninstall can be performed. + +For more information, see [DISM operating system uninstall command-line options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/dism-uninstallos-command-line-options). + +### Windows Setup + +You can now run your own custom actions or scripts in parallel with Windows Setup. Setup will also migrate your scripts to next feature release, so you only need to add them once. + +Prerequisites: +- Windows 10, version 1803 or Windows 10 Enterprise 2019 LTSC, or later. +- Windows 10 Enterprise or Pro + +For more information, see [Run custom actions during feature update](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions). + +It is also now possible to run a script if the user rolls back their version of Windows using the PostRollback option. + + /PostRollback [\setuprollback.cmd] [/postrollback {system / admin}] + +For more information, see [Windows Setup Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options#21) + +New command-line switches are also available to control BitLocker: + + Setup.exe /BitLocker AlwaysSuspend + – Always suspend bitlocker during upgrade. + Setup.exe /BitLocker TryKeepActive + – Enable upgrade without suspending bitlocker but if upgrade, does not work then suspend bitlocker and complete the upgrade. + Setup.exe /BitLocker ForceKeepActive + – Enable upgrade without suspending bitlocker, but if upgrade does not work, fail the upgrade. + +For more information, see [Windows Setup Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options#33) + +### Feature update improvements + +Portions of the work done during the offline phases of a Windows update have been moved to the online phase. This has resulted in a significant reduction of offline time when installing updates. For more information, see [We're listening to you](https://insider.windows.com/en-us/articles/were-listening-to-you/). + +### SetupDiag + +[SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag) is a new command-line tool that can help diagnose why a Windows 10 update failed. + +SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues. In the current version of SetupDiag there are 53 rules contained in the rules.xml file, which is extracted when SetupDiag is run. The rules.xml file will be updated as new versions of SetupDiag are made available. + +## Sign-in + +### Faster sign-in to a Windows 10 shared pc + +If you have shared devices deployed in your work place, **Fast sign-in** enables users to sign in to a [shared Windows 10 PC](https://docs.microsoft.com/windows/configuration/set-up-shared-or-guest-pc) in a flash! + +**To enable fast sign-in:** +1. Set up a shared or guest device with Windows 10, version 1809 or Windows 10 Enterprise 2019 LTSC. +2. Set the Policy CSP, and the **Authentication** and **EnableFastFirstSignIn** policies to enable fast sign-in. +3. Sign-in to a shared PC with your account. You'll notice the difference! + + ![fast sign-in](../images/fastsignin.png "fast sign-in") + +### Web sign-in to Windows 10 + +Until now, Windows logon only supported the use of identities federated to ADFS or other providers that support the WS-Fed protocol. We are introducing “web sign-in,” a new way of signing into your Windows PC. Web Sign-in enables Windows logon support for non-ADFS federated providers (e.g.SAML). + +**To try out web sign-in:** +1. Azure AD Join your Windows 10 PC. (Web sign-in is only supported on Azure AD Joined PCs). +2. Set the Policy CSP, and the Authentication and EnableWebSignIn polices to enable web sign-in. +3. On the lock screen, select web sign-in under sign-in options. +4. Click the “Sign in” button to continue. + +![Web sign-in](../images/websignin.png "web sign-in") + +## Windows Analytics + +### Upgrade Readiness + +>[!IMPORTANT] +>Upgrade Readiness will not allow you to assess an upgrade to an LTSC release (LTSC builds are not available as target versions). However, you can enroll devices running LTSC to plan for an upgrade to a semi-annual channel release. + +Upgrade Readiness helps you ensure that applications and drivers are ready for a Windows 10 upgrade. The solution provides up-to-date application and driver inventory, information about known issues, troubleshooting guidance, and per-device readiness and tracking details. The Upgrade Readiness tool moved from public preview to general availability on March 2, 2017. + +The development of Upgrade Readiness has been heavily influenced by input from the community the development of new features is ongoing. To begin using Upgrade Readiness, add it to an existing Operation Management Suite (OMS) workspace or sign up for a new OMS workspace with the Upgrade Readiness solution enabled. + +For more information about Upgrade Readiness, see the following topics: + +- [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics/) +- [Manage Windows upgrades with Upgrade Readiness](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness) + +Upgrade Readiness provides insights into application and driver compatibility issues. New capabilities include better app coverage, post-upgrade health reports, and enhanced report filtering capabilities. For more information, see [Manage Windows upgrades with Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness). + +### Update Compliance + +Update Compliance helps you to keep Windows 10 devices in your organization secure and up-to-date. + +Update Compliance is a solution built using OMS Log Analytics that provides information about installation status of monthly quality and feature updates. Details are provided about the deployment progress of existing updates and the status of future updates. Information is also provided about devices that might need attention to resolve issues. + +For more information about Update Compliance, see [Monitor Windows Updates with Update Compliance](/windows/deployment/update/update-compliance-monitor). + +New capabilities in Update Compliance let you monitor Windows Defender protection status, compare compliance with industry peers, and optimize bandwidth for deploying updates. For more information, see [Monitor Windows Updates and Windows Defender Antivirus with Update Compliance](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor). + +### Device Health + +Maintaining devices is made easier with Device Health, a new, premium analytic tool that identifies devices and drivers that crash frequently and might need to be rebuilt or replaced. For more information, see [Monitor the health of devices with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor). + +## Accessibility and Privacy + +### Accessibility + +"Out of box" accessibility is enhanced with auto-generated picture descriptions. For more information about accessibility, see [Accessibility information for IT Professionals](https://docs.microsoft.com/windows/configuration/windows-10-accessibility-for-itpros). Also see the accessibility section in the [What’s new in the Windows 10 April 2018 Update](https://blogs.windows.com/windowsexperience/2018/04/30/whats-new-in-the-windows-10-april-2018-update/) blog post. + +### Privacy + +In the Feedback and Settings page under Privacy Settings you can now delete the diagnostic data your device has sent to Microsoft. You can also view this diagnostic data using the [Diagnostic Data Viewer](https://docs.microsoft.com/windows/configuration/diagnostic-data-viewer-overview) app. + +## Configuration + +### Kiosk configuration + +Microsoft Edge has many improvements specifically targeted to Kiosks, however Edge is not available in the LTSC release of Windows 10. Internet Explorer is included in Windows 10 LTSC releases as its feature set is not changing, and it will continue to get security fixes for the life of a Windows 10 LTSC release. + +If you wish to take advantage of [Kiosk capabilities in Edge](https://docs.microsoft.com/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy), consider [Kiosk mode](https://docs.microsoft.com/windows/configuration/kiosk-methods) with a semi-annual release channel. + +### Co-management + +Intune and System Center Configuration Manager policies have been added to enable hyrid Azure AD-joined authentication. Mobile Device Management (MDM) has added over 150 new policies and settings in this release, including the [MDMWinsOverGP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-controlpolicyconflict) policy, to enable easier transition to cloud-based management. + +For more information, see [What's New in MDM enrollment and management](https://docs.microsoft.com/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew1803) + +### OS uninstall period + +The OS uninstall period is a length of time that users are given when they can optionally roll back a Windows 10 update. With this release, administrators can use Intune or [DISM](#dism) to customize the length of the OS uninstall period. + +### Azure Active Directory join in bulk + +Using the new wizards in Windows Configuration Designer, you can [create provisioning packages to enroll devices in Azure Active Directory](/windows/configuration/provisioning-packages/provisioning-packages#configuration-designer-wizards). Azure AD join in bulk is available in the desktop, mobile, kiosk, and Surface Hub wizards. + +![get bulk token action in wizard](../images/bulk-token.png) + +### Windows Spotlight + +The following new Group Policy and mobile device management (MDM) settings are added to help you configure Windows Spotlight user experiences: + +- **Turn off the Windows Spotlight on Action Center** +- **Do not use diagnostic data for tailored experiences** +- **Turn off the Windows Welcome Experience** + +[Learn more about Windows Spotlight.](/windows/configuration/windows-spotlight) + +### Start and taskbar layout + +Previously, the customized taskbar could only be deployed using Group Policy or provisioning packages. Windows 10 Enterprise 2019 LTSC adds support for customized taskbars to [MDM](/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management). + +[Additional MDM policy settings are available for Start and taskbar layout](/windows/configuration/windows-10-start-layout-options-and-policies). New MDM policy settings include: + +- Settings for the User tile: [**Start/HideUserTile**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hideusertile), [**Start/HideSwitchAccount**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hideswitchaccount), [**Start/HideSignOut**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidesignout), [**Start/HideLock**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidelock), and [**Start/HideChangeAccountSettings**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidechangeaccountsettings) +- Settings for Power: [**Start/HidePowerButton**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidepowerbutton), [**Start/HideHibernate**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidehibernate), [**Start/HideRestart**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hiderestart), [**Start/HideShutDown**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hideshutdown), and [**Start/HideSleep**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidesleep) +- Additional new settings: [**Start/HideFrequentlyUsedApps**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hidefrequentlyusedapps), [**Start/HideRecentlyAddedApps**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hiderecentlyaddedapps), **AllowPinnedFolder**, **ImportEdgeAssets**, [**Start/HideRecentJumplists**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hiderecentjumplists), [**Start/NoPinningToTaskbar**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-nopinningtotaskbar), [**Settings/PageVisibilityList**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#settings-pagevisibilitylist), and [**Start/HideAppsList**](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#start-hideapplist). + +## Windows Update + +### Windows Update for Business + +Windows Update for Business now provides greater control over updates, with the ability to pause and uninstall problematic updates using Intune. For more information, see [Manage software updates in Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure). + +The pause feature has been changed, and now requires a start date to set up. Users are now able to pause through **Settings > Update & security > Windows Update > Advanced options** in case a policy has not been configured. We have also increased the pause limit on quality updates to 35 days. You can find more information on pause in [Pause Feature Updates](/windows/deployment/update/waas-configure-wufb#pause-feature-updates) and [Pause Quality Updates](/windows/deployment/update/waas-configure-wufb#pause-quality-updates). + + +Windows Update for Business managed devices are now able to defer feature update installation by up to 365 days (it used to be 180 days). In settings, users are able to select their branch readiness level and update deferal periods. See [Configure devices for Current Branch (CB) or Current Branch for Business (CBB)](/windows/deployment/update/waas-configure-wufb#configure-devices-for-current-branch-or-current-branch-for-business), [Configure when devices receive Feature Updates](/windows/deployment/update/waas-configure-wufb#configure-when-devices-receive-feature-updates) and [Configure when devices receive Quality Updates](/windows/deployment/update/waas-configure-wufb#configure-when-devices-receive-quality-updates) for details. + +WUfB now has additional controls available to manage Windows Insider Program enrollment through policies. For more information, see [Manage Windows Insider Program flights](https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb#configure-when-devices-receive-windows-insider-preview-builds). + +Windows Update for Business now provides greater control over updates, with the ability to pause and uninstall problematic updates using Intune. For more information, see [Manage software updates in Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure). + +The pause feature has been changed, and now requires a start date to set up. Users are now able to pause through **Settings > Update & security > Windows Update > Advanced options** in case a policy has not been configured. We have also increased the pause limit on quality updates to 35 days. You can find more information on pause in [Pause Feature Updates](/windows/deployment/update/waas-configure-wufb#pause-feature-updates) and [Pause Quality Updates](/windows/deployment/update/waas-configure-wufb#pause-quality-updates). + + +Windows Update for Business managed devices are now able to defer feature update installation by up to 365 days (it used to be 180 days). In settings, users are able to select their branch readiness level and update deferal periods. See [Configure devices for Current Branch (CB) or Current Branch for Business (CBB)](/windows/deployment/update/waas-configure-wufb#configure-devices-for-current-branch-or-current-branch-for-business), [Configure when devices receive Feature Updates](/windows/deployment/update/waas-configure-wufb#configure-when-devices-receive-feature-updates) and [Configure when devices receive Quality Updates](/windows/deployment/update/waas-configure-wufb#configure-when-devices-receive-quality-updates) for details. + +WUfB now has additional controls available to manage Windows Insider Program enrollment through policies. For more information, see [Manage Windows Insider Program flights](https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb#configure-when-devices-receive-windows-insider-preview-builds). + +### Windows Insider for Business + +We recently added the option to download Windows 10 Insider Preview builds using your corporate credentials in Azure Active Directory (AAD). By enrolling devices in AAD, you increase the visibility of feedback submitted by users in your organization – especially on features that support your specific business needs. For details, see [Windows Insider Program for Business](/windows/deployment/update/waas-windows-insider-for-business). + +You can now register your Azure AD domains to the Windows Insider Program. For more information, see [Windows Insider Program for Business](https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business#getting-started-with-windows-insider-program-for-business). + + +### Optimize update delivery + +With changes delivered in Windows 10 Enterprise 2019 LTSC, [Express updates](/windows/deployment/update/waas-optimize-windows-10-updates#express-update-delivery) are now fully supported with System Center Configuration Manager, starting with version 1702 of Configuration Manager, as well as with other third-party updating and management products that [implement this new functionality](https://technet.microsoft.com/windows-server-docs/management/windows-server-update-services/deploy/express-update-delivery-isv-support). This is in addition to current Express support on Windows Update, Windows Update for Business and WSUS. + +>[!NOTE] +> The above changes can be made available to Windows 10, version 1607, by installing the April 2017 cumulative update. + +Delivery Optimization policies now enable you to configure additional restrictions to have more control in various scenarios. + +Added policies include: +- [Allow uploads while the device is on battery while under set Battery level](/windows/deployment/update/waas-delivery-optimization#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) +- [Enable Peer Caching while the device connects via VPN](/windows/deployment/update/waas-delivery-optimization#enable-peer-caching-while-the-device-connects-via-vpn) +- [Minimum RAM (inclusive) allowed to use Peer Caching](/windows/deployment/update/waas-delivery-optimization#minimum-ram-allowed-to-use-peer-caching) +- [Minimum disk size allowed to use Peer Caching](/windows/deployment/update/waas-delivery-optimization#minimum-disk-size-allowed-to-use-peer-caching) +- [Minimum Peer Caching Content File Size](/windows/deployment/update/waas-delivery-optimization#minimum-peer-caching-content-file-size) + +To check out all the details, see [Configure Delivery Optimization for Windows 10 updates](/windows/deployment/update/waas-delivery-optimization) + +### Uninstalled in-box apps no longer automatically reinstall + +Starting with Windows 10 Enterprise 2019 LTSC, in-box apps that were uninstalled by the user won't automatically reinstall as part of the feature update installation process. + +Additionally, apps de-provisioned by admins on Windows 10 Enterprise 2019 LTSC machines will stay de-provisioned after future feature update installations. This will not apply to the update from Windows 10 Enterprise 2016 LTSC (or earlier) to Windows 10 Enterprise 2019 LTSC. + +## Management + +### New MDM capabilities + +Windows 10 Enterprise 2019 LTSC adds many new [configuration service providers (CSPs)](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) that provide new capabilities for managing Windows 10 devices using MDM or provisioning packages. Among other things, these CSPs enable you to configure a few hundred of the most useful Group Policy settings via MDM - see [Policy CSP - ADMX-backed policies](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-admx-backed). + +Some of the other new CSPs are: + +- The [DynamicManagement CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/dynamicmanagement-csp) allows you to manage devices differently depending on location, network, or time. For example, managed devices can have cameras disabled when at a work location, the cellular service can be disabled when outside the country to avoid roaming charges, or the wireless network can be disabled when the device is not within the corporate building or campus. Once configured, these settings will be enforced even if the device can’t reach the management server when the location or network changes. The Dynamic Management CSP enables configuration of policies that change how the device is managed in addition to setting the conditions on which the change occurs. + +- The [CleanPC CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/cleanpc-csp) allows removal of user-installed and pre-installed applications, with the option to persist user data. + +- The [BitLocker CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/bitlocker-csp) is used to manage encryption of PCs and devices. For example, you can require storage card encryption on mobile devices, or require encryption for operating system drives. + +- The [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp) is used to configure a proxy server for ethernet and Wi-Fi connections. + +- The [Office CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/office-csp) enables a Microsoft Office client to be installed on a device via the Office Deployment Tool. For more information, see [Configuration options for the Office Deployment Tool](https://technet.microsoft.com/library/jj219426.aspx). + +- The [EnterpriseAppVManagement CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterpriseappvmanagement-csp) is used to manage virtual applications in Windows 10 PCs (Enterprise and Education editions) and enables App-V sequenced apps to be streamed to PCs even when managed by MDM. + +IT pros can use the new [MDM Migration Analysis Tool (MMAT)](https://aka.ms/mmat) to determine which Group Policy settings have been configured for a user or computer and cross-reference those settings against a built-in list of supported MDM policies. MMAT can generate both XML and HTML reports indicating the level of support for each Group Policy setting and MDM equivalents. + +[Learn more about new MDM capabilities.](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/new-in-windows-mdm-enrollment-management#whatsnew10) + +MDM has been expanded to include domain joined devices with Azure Active Directory registration. Group Policy can be used with Active Directory joined devices to trigger auto-enrollment to MDM. For more information, see [Enroll a Windows 10 device automatically using Group Policy](https://docs.microsoft.com/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy). + +Multiple new configuration items are also added. For more information, see [What's new in MDM enrollment and management](https://docs.microsoft.com/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew1709). + +### Mobile application management support for Windows 10 + +The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. MAM support is built into Windows on top of Windows Information Protection (WIP), starting in Windows 10 Enterprise 2019 LTSC. + +For more info, see [Implement server-side support for mobile application management on Windows](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/implement-server-side-mobile-application-management). + +### MDM diagnostics + +In Windows 10 Enterprise 2019 LTSC, we continue our work to improve the diagnostic experience for modern management. By introducing auto-logging for mobile devices, Windows will automatically collect logs when encountering an error in MDM, eliminating the need to have always-on logging for memory-constrained devices. Additionally, we are introducing [Microsoft Message Analyzer](https://www.microsoft.com/download/details.aspx?id=44226) as an additional tool to help Support personnel quickly reduce issues to their root cause, while saving time and cost. + +### Application Virtualization for Windows (App-V) + +Previous versions of the Microsoft Application Virtualization Sequencer (App-V Sequencer) have required you to manually create your sequencing environment. Windows 10 Enterprise 2019 LTSC introduces two new PowerShell cmdlets, New-AppVSequencerVM and Connect-AppvSequencerVM, which automatically create your sequencing environment for you, including provisioning your virtual machine. Additionally, the App-V Sequencer has been updated to let you sequence or update multiple apps at the same time, while automatically capturing and storing your customizations as an App-V project template (.appvt) file, and letting you use PowerShell or Group Policy settings to automatically cleanup your unpublished packages after a device restart. + +For more info, see the following topics: +- [Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)](/windows/application-management/app-v/appv-auto-provision-a-vm) +- [Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](/windows/application-management/app-v/appv-auto-batch-sequencing) +- [Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)](/windows/application-management/app-v/appv-auto-batch-updating) +- [Automatically cleanup unpublished packages on the App-V client](/windows/application-management/app-v/appv-auto-clean-unpublished-packages) + +### Windows diagnostic data + +Learn more about the diagnostic data that's collected at the Basic level and some examples of the types of data that is collected at the Full level. + +- [Windows 10, version 1703 basic level Windows diagnostic events and fields](/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703) +- [Windows 10, version 1703 Diagnostic Data](/windows/configuration/windows-diagnostic-data-1703) + +### Group Policy spreadsheet + +Learn about the new Group Policies that were added in Windows 10 Enterprise 2019 LTSC. + +- [Group Policy Settings Reference for Windows and Windows Server](https://www.microsoft.com/download/details.aspx?id=25250) + +### Mixed Reality Apps + +This version of Windows 10 introduces [Windows Mixed Reality](https://blogs.windows.com/windowsexperience/2017/10/03/the-era-of-windows-mixed-reality-begins-october-17/). Organizations that use WSUS must take action to enable Windows Mixed Reality. You can also prohibit use of Windows Mixed Reality by blocking installation of the Mixed Reality Portal. For more information, see [Enable or block Windows Mixed Reality apps in the enterprise](https://docs.microsoft.com/windows/application-management/manage-windows-mixed-reality). + +## Networking + +### Network stack + +Several network stack enhancements are available in this release. Some of these features were also available in Windows 10, version 1703. For more information, see [Core Network Stack Features in the Creators Update for Windows 10](https://blogs.technet.microsoft.com/networking/2017/07/13/core-network-stack-features-in-the-creators-update-for-windows-10/). + +### Miracast over Infrastructure + +In this version of Windows 10, Microsoft has extended the ability to send a Miracast stream over a local network rather than over a direct wireless link. This functionality is based on the [Miracast over Infrastructure Connection Establishment Protocol (MS-MICE)](https://msdn.microsoft.com/library/mt796768.aspx). + +How it works: + +Users attempt to connect to a Miracast receiver as they did previously. When the list of Miracast receivers is populated, Windows 10 will identify that the receiver is capable of supporting a connection over the infrastructure. When the user selects a Miracast receiver, Windows 10 will attempt to resolve the device's hostname via standard DNS, as well as via multicast DNS (mDNS). If the name is not resolvable via either DNS method, Windows 10 will fall back to establishing the Miracast session using the standard Wi-Fi direct connection. + +Miracast over Infrastructure offers a number of benefits: + +- Windows automatically detects when sending the video stream over this path is applicable. +- Windows will only choose this route if the connection is over Ethernet or a secure Wi-Fi network. +- Users do not have to change how they connect to a Miracast receiver. They use the same UX as for standard Miracast connections. +- No changes to current wireless drivers or PC hardware are required. +- It works well with older wireless hardware that is not optimized for Miracast over Wi-Fi Direct. +- It leverages an existing connection which both reduces the time to connect and provides a very stable stream. + +Enabling Miracast over Infrastructure: + +If you have a device that has been updated to Windows 10 Enterprise 2019 LTSC, then you automatically have this new feature. To take advantage of it in your environment, you need to ensure the following is true within your deployment: + +- The device (PC, phone, or Surface Hub) needs to be running Windows 10, version 1703, Windows 10 Enterprise 2019 LTSC, or a later OS. +- A Windows PC or Surface Hub can act as a Miracast over Infrastructure *receiver*. A Windows PC or phone can act as a Miracast over Infrastructure *source*. + - As a Miracast receiver, the PC or Surface Hub must be connected to your enterprise network via either Ethernet or a secure Wi-Fi connection (e.g. using either WPA2-PSK or WPA2-Enterprise security). If the Hub is connected to an open Wi-Fi connection, Miracast over Infrastructure will disable itself. + - As a Miracast source, the PC or phone must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. +- The DNS Hostname (device name) of the device needs to be resolvable via your DNS servers. You can achieve this by either allowing your device to register automatically via Dynamic DNS, or by manually creating an A or AAAA record for the device's hostname. +- Windows 10 PCs must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. + +It is important to note that Miracast over Infrastructure is not a replacement for standard Miracast. Instead, the functionality is complementary, and provides an advantage to users who are part of the enterprise network. Users who are guests to a particular location and don’t have access to the enterprise network will continue to connect using the Wi-Fi Direct connection method. + +## Registry editor improvements + +We added a dropdown that displays as you type to help complete the next part of the path. You can also press **Ctrl + Backspace** to delete the last word, and **Ctrl + Delete** to delete the next word. + +![Registry editor dropdown](../images/regeditor.png "Registry editor dropdown") + +## Remote Desktop with Biometrics + +Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. + +To get started, sign into your device using Windows Hello for Business. Bring up **Remote Desktop Connection** (mstsc.exe), type the name of the computer you want to connect to, and click **Connect**. + +- Windows remembers that you signed using Windows Hello for Business, and automatically selects Windows Hello for Business to authenticate you to your RDP session. You can also click **More choices** to choose alternate credentials. +- Windows uses facial recognition to authenticate the RDP session to the Windows Server 2016 Hyper-V server. You can continue to use Windows Hello for Business in the remote session, but you must use your PIN. + +See the following example: + +![Enter your credentials](../images/RDPwBioTime.png "Windows Hello") +![Enter your credentials](../images/RDPwBio2.png "Windows Hello personal") +![Microsoft Hyper-V Server 2016](../images/hyper-v.png "Microsoft Hyper-V Server 2016") + +## See Also + +[Windows 10 Enterprise LTSC](index.md): A short description of the LTSC servicing channel with links to information about each release. diff --git a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md index cfc863d9b5..d4aae3c31c 100644 --- a/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md +++ b/windows/whats-new/whats-new-windows-10-version-1507-and-1511.md @@ -3,14 +3,13 @@ title: What's new in Windows 10, versions 1507 and 1511 (Windows 10) description: This topic lists new and updated topics in the What's new in Windows 10 documentation for Windows 10 and Windows 10 Mobile. ms.assetid: 75F285B0-09BE-4821-9B42-37B9BE54CEC6 ms.reviewer: -manager: dansimp -ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: dansimp +author: greg-lindsay +manager: laurawi +ms.author: greglin ms.localizationpriority: high -ms.date: 10/16/2017 ms.topic: article --- diff --git a/windows/whats-new/whats-new-windows-10-version-1607.md b/windows/whats-new/whats-new-windows-10-version-1607.md index a77ae7c354..4a42f3e98b 100644 --- a/windows/whats-new/whats-new-windows-10-version-1607.md +++ b/windows/whats-new/whats-new-windows-10-version-1607.md @@ -5,12 +5,11 @@ keywords: ["What's new in Windows 10", "Windows 10", "anniversary update"] ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: dansimp ms.localizationpriority: high -ms.date: 10/16/2017 ms.reviewer: -manager: dansimp -ms.author: dansimp +author: greg-lindsay +manager: laurawi +ms.author: greglin ms.topic: article --- diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 0e1be04497..71c7f06847 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -5,13 +5,12 @@ keywords: ["What's new in Windows 10", "Windows 10", "creators update"] ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: dansimp ms.localizationpriority: high ms.assetid: dca7c655-c4f6-45f8-aa02-64187b202617 ms.reviewer: -manager: dansimp -ms.author: dansimp -ms.date: 10/16/2017 +author: greg-lindsay +manager: laurawi +ms.author: greglin ms.topic: article --- diff --git a/windows/whats-new/whats-new-windows-10-version-1709.md b/windows/whats-new/whats-new-windows-10-version-1709.md index df1f40120d..ef9b4541f0 100644 --- a/windows/whats-new/whats-new-windows-10-version-1709.md +++ b/windows/whats-new/whats-new-windows-10-version-1709.md @@ -5,11 +5,10 @@ keywords: ["What's new in Windows 10", "Windows 10", "Fall Creators Update"] ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: dansimp -ms.date: 01/24/2018 ms.reviewer: -manager: dansimp -ms.author: dansimp +author: greg-lindsay +manager: laurawi +ms.author: greglin ms.localizationpriority: high ms.topic: article --- @@ -25,7 +24,7 @@ A brief description of new or updated features in this version of Windows 10 is   -> [!video https://www.microsoft.com/en-us/videoplayer/embed/43942201-bec9-4f8b-8ba7-2d9bfafa8bba?autoplay=false] +> [!video https://www.microsoft.com/videoplayer/embed/43942201-bec9-4f8b-8ba7-2d9bfafa8bba?autoplay=false] ## Deployment @@ -96,7 +95,7 @@ Windows Defender Application Guard hardens a favorite attacker entry-point by is ### Window Defender Exploit Guard -Window Defender Exploit Guard provides intrusion prevention capabilities to reduce the attack and exploit surface of applications. Exploit Guard has many of the threat mitigations that were available in Enhanced Mitigation Experience Toolkit (EMET) toolkit, a deprecated security download. These mitigations are now built into Windows and configurable with Exploit Guard. For more information, see [Windows Defender Exploit Guard](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard). +Window Defender Exploit Guard provides intrusion prevention capabilities to reduce the attack and exploit surface of applications. Exploit Guard has many of the threat mitigations that were available in Enhanced Mitigation Experience Toolkit (EMET) toolkit, a deprecated security download. These mitigations are now built into Windows and configurable with Exploit Guard. These mitigations include [Exploit protection](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/exploit-protection), [Attack surface reduction protection](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction), [Controlled folder access](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/controlled-folder-access), and [Network protection](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/network-protection). ### Windows Defender Device Guard diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 7c41c62396..e13290b34f 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -5,11 +5,10 @@ keywords: ["What's new in Windows 10", "Windows 10", "April 2018 Update"] ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: dansimp -ms.date: 07/07/2018 ms.reviewer: -manager: dansimp -ms.author: dansimp +author: greg-lindsay +manager: laurawi +ms.author: greglin ms.localizationpriority: high ms.topic: article --- @@ -25,7 +24,7 @@ This article lists new and updated features and content that are of interest to The following 3-minute video summarizes some of the new features that are available for IT Pros in this release. -> [!video https://www.microsoft.com/en-us/videoplayer/embed/RE21ada?autoplay=false] +> [!video https://www.microsoft.com/videoplayer/embed/RE21ada?autoplay=false] ## Deployment @@ -66,7 +65,7 @@ With this release you can easily deploy and manage kiosk devices with Microsoft - To help with troubleshooting, you can now view error reports generated if an assigned access-configured app has issues. For more information, see: -- [Making IT simpler with a modern workplace](https://www.microsoft.com/en-us/microsoft-365/blog/2018/04/27/making-it-simpler-with-a-modern-workplace/) +- [Making IT simpler with a modern workplace](https://www.microsoft.com/microsoft-365/blog/2018/04/27/making-it-simpler-with-a-modern-workplace/) - [Simplifying kiosk management for IT with Windows 10](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Simplifying-kiosk-management-for-IT-with-Windows-10/ba-p/187691) ### Windows 10 Subscription Activation @@ -178,11 +177,11 @@ Windows Defender Antivirus now shares detection status between M365 services and ### Windows Defender Exploit Guard -Windows Defender Exploit Guard enhanced attack surface area reduction, extended support to Microsoft Office applications, and now supports Windows Server. [Virtualization-based Security](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/Windows-Defender-System-Guard-Making-a-leap-forward-in-platform/m-p/167303) (VBS) and Hypervisor-protected code integrity (HVCI) can now be enabled across the Windows 10 ecosystem. These Exploit Guard features can now be enabled through the Windows Defender Security Center. +Windows Defender Exploit Guard enhanced attack surface area reduction, extended support to Microsoft Office applications, and now supports Windows Server. [Virtualization-based Security](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/Windows-Defender-System-Guard-Making-a-leap-forward-in-platform/m-p/167303) (VBS) and Hypervisor-protected code integrity (HVCI) can now be enabled across the Windows 10 ecosystem. These Exploit Guard features can now be enabled through the Windows Defender Security Center. -For more information, see [Reduce attack surfaces with Windows Defender Exploit Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard) +For more information, see [Reduce attack surfaces](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction) -### Windows Defender ATP +### Windows Defender ATP [Windows Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection) has been enhanced with many new capabilities. For more information, see the following topics: diff --git a/windows/whats-new/whats-new-windows-10-version-1809.md b/windows/whats-new/whats-new-windows-10-version-1809.md index 7bf5f8b3ee..0ff6fadb69 100644 --- a/windows/whats-new/whats-new-windows-10-version-1809.md +++ b/windows/whats-new/whats-new-windows-10-version-1809.md @@ -1,14 +1,14 @@ --- title: What's new in Windows 10, version 1809 ms.reviewer: -manager: dansimp -ms.author: dansimp description: New and updated features in Windows 10, version 1809 keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 October 2018 Update"] ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: dansimp +author: greg-lindsay +manager: laurawi +ms.author: greglin ms.localizationpriority: high ms.topic: article --- @@ -67,7 +67,7 @@ This is an update to the [BitLocker CSP](https://docs.microsoft.com/windows/clie This feature will soon be enabled on Olympia Corp as an optional feature. -#### Delivering BitLocker policy to AutoPilot devices during OOBE +#### Delivering BitLocker policy to AutoPilot devices during OOBE You can choose which encryption algorithm to apply to BitLocker encryption capable devices, rather than automatically having those devices encrypt themselves with the default algorithm. This allows the encryption algorithm (and other BitLocker policies that must be applied prior to encryption), to be delivered before BitLocker encryption begins. @@ -160,6 +160,15 @@ Windows Defender ATP now adds support for Windows Server 2019. You'll be able to - [Onboard previous versions of Windows](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection)
                        Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor +## Cloud Clipboard + +Cloud clipboard helps users copy content between devices. It also manages the clipboard histroy so that you can paste your old copied data. You can access it by using **Windows+V**. Set up Cloud clipboard: + +1. Go to **Windows Settings** and select **Systems**. +2. On the left menu, click on **Clipboard**. +3. Turn on **Clipboard history**. +4. Turn on **Sync across devices**. Chose whether or not to automatically sync copied text across your devices. + ## Kiosk setup experience We introduced a simplified assigned access configuration experience in **Settings** that allows device administrators to easily set up a PC as a kiosk or digital sign. A wizard experience walks you through kiosk setup including creating a kiosk account that will automatically sign in when a device starts. diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index 0301b62f00..d5949e5781 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -1,151 +1,153 @@ ---- -title: What's new in Windows 10, version 1903 -description: New and updated IT Pro content about new features in Windows 10, version 1903 (also known as the Windows 10 May 2019 Update). -keywords: ["What's new in Windows 10", "Windows 10", "May 2019 Update"] -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro author: greg-lindsay -manager: laurawi -ms.localizationpriority: high -ms.topic: article ---- - -# What's new in Windows 10, version 1903 IT Pro content - -**Applies to** -- Windows 10, version 1903 - -This article lists new and updated features and content that are of interest to IT Pros for Windows 10 version 1903, also known as the Windows 10 May 2019 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 1809. - ->[!NOTE] ->New disk space requirement for Windows 10, version 1903 applies only to OEMs for the manufacture of new PCs. This new requirement does not apply to existing devices. PCs that don’t meet new device disk space requirements will continue to receive updates and the 1903 update will require about the same amount of free disk space as previous updates. For more information, see [Reserved storage](#reserved-storage). - -## Deployment - -### Windows Autopilot - -[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. The following Windows Autopilot features are available in Windows 10, version 1903 and later: - -- [Windows Autopilot for white glove deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/white-glove) is new in this version of Windows. "White glove" deployment enables partners or IT staff to pre-provision devices so they are fully configured and business ready for your users. -- The Intune [enrollment status page](https://docs.microsoft.com/intune/windows-enrollment-status) (ESP) now tracks Intune Management Extensions​. -- [Cortana voiceover](https://docs.microsoft.com/windows-hardware/customize/desktop/cortana-voice-support) and speech recognition during OOBE is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs. -- Windows Autopilot is self-updating during OOBE. Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE. -- Windows Autopilot will set the [diagnostics data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE. - -### Windows 10 Subscription Activation - -Windows 10 Education support has been added to Windows 10 Subscription Activation. - -With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to the enterprise-grade edition for educational institutions – Windows 10 Education. For more information, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation). - -### SetupDiag - -[SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag) version 1.4.1 is available. - -SetupDiag is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues. In the current version of SetupDiag there are 53 rules contained in the rules.xml file, which is extracted when SetupDiag is run. The rules.xml file will be updated as new versions of SetupDiag are made available. - -### Reserved storage - -[**Reserved storage**](https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Windows-10-and-reserved-storage/ba-p/428327): Reserved storage sets aside disk space to be used by updates, apps, temporary files, and system caches. It improves the day-to-day function of your PC by ensuring critical OS functions always have access to disk space. Reserved storage will be enabled automatically on new PCs with Windows 10, version 1903 pre-installed, and for clean installs. It will not be enabled when updating from a previous version of Windows 10. - -## Servicing - -- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Office 365 ProPlus updates, and Intune content, with System Center Configuration Manager content coming soon! -- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. -- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. -- **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. -- **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again. -- **Improved update notifications**: When there’s an update requiring you to restart your device, you’ll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar. -- **Intelligent active hours**: To further enhance active hours, users will now have the option to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. -- **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. - -## Security - -### Windows Information Protection - -With this release, Windows Defender ATP extends discovery and protection of sensitive information with [Auto Labeling](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels#how-wip-protects-automatically-classified-files). - -### Security configuration framework - -With this release of Windows 10, Microsoft is introducing a [new taxonomy for security configurations](https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework), called the **SECCON framework**, comprised of 5 device security configurations. - -### Security baseline for Windows 10 and Windows Server - -The draft release of the [security configuration baseline settings](https://blogs.technet.microsoft.com/secguide/2019/04/24/security-baseline-draft-for-windows-10-v1903-and-windows-server-v1903/) for Windows 10, version 1903 and for Windows Server version 1903 is available. - -### Intune security baselines - -[Intune Security Baselines](https://docs.microsoft.com/intune/security-baselines) (Preview): Now includes many settings supported by Intune that you can use to help secure and protect your users and devices. You can automatically set these settings to values recommended by security teams. - -### Microsoft Defender Advanced Threat Protection (ATP): - -- [Attack surface area reduction](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) – IT admins can configure devices with advanced web protection that enables them to define allow and deny lists for specific URL’s and IP addresses. -- [Next generation protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) – Controls have been extended to protection from ransomware, credential misuse, and attacks that are transmitted through removable storage. - - Integrity enforcement capabilities – Enable remote runtime attestation of Windows 10 platform. - - Tamper-proofing capabilities – Uses virtualization-based security to isolate critical ATP security capabilities away from the OS and attackers. -- [Platform support](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Protecting-Windows-Server-with-Windows-Defender-ATP/ba-p/267114) – In addition to Windows 10, Windows Defender ATP’s functionality has been extended to support Windows 7 and Windows 8.1 clients, as well as macOS, Linux, and Windows Server with both its Endpoint Detection (EDR) and Endpoint Protection Platform (EPP) capabilities. - -### Microsoft Defender ATP next-gen protection technologies: - -- **Advanced machine learning**: Improved with advanced machine learning and AI models that enable it to protect against apex attackers using innovative vulnerability exploit techniques, tools and malware. -- **Emergency outbreak protection**: Provides emergency outbreak protection which will automatically update devices with new intelligence when a new outbreak has been detected. -- **Certified ISO 27001 compliance**: Ensures that the cloud service has analyzed for threats, vulnerabilities and impacts, and that risk management and security controls are in place. -- **Geolocation support**: Support geolocation and sovereignty of sample data as well as configurable retention policies. - -### Threat Protection - -- [Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849): Isolated desktop environment where you can run untrusted software without the fear of lasting impact to your device. -- [Microphone privacy settings](https://support.microsoft.com/en-us/help/4468232/windows-10-camera-microphone-and-privacy-microsoft-privacy): A microphone icon appears in the notification area letting you see which apps are using your microphone. - -- [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) enhancements: - - Standalone users can install and configure their Windows Defender Application Guard settings without needing to change Registry key settings. Enterprise users can check their settings to see what their administrators have configured for their machines to better understand the behavior. - - WDAG is now an extension in Google Chrome and Mozilla Firefox. Many users are in a hybrid browser environment, and would like to extend WDAG’s browser isolation technology beyond Microsoft Edge. In the latest release, users can install the WDAG extension in their Chrome or Firefox browsers. This extension will redirect untrusted navigations to the WDAG Edge browser. There is also a companion app to enable this feature in the Microsoft Store. Users can quickly launch WDAG from their desktop using this app. This feature is also available in Windows 10, version 1803 or later with the latest updates. - - To try this extension: - 1. Configure WDAG policies on your device. - 2. Go to the Chrome Web Store or Firefox Add-ons and search for Application Guard. Install the extension. - 3. Follow any additional configuration steps on the extension setup page. - 4. Reboot the device. - 5. Navigate to an untrusted site in Chrome and Firefox. - - - WDAG allows dynamic navigation: Application Guard now allows users to navigate back to their default host browser from the WDAG Microsoft Edge. Previously, users browsing in WDAG Edge would see an error page when they try to go to a trusted site within the container browser. With this new feature, users will automatically be redirected to their host default browser when they enter or click on a trusted site in WDAG Edge. This feature is also available in Windows 10, version 1803 or later with the latest updates. - -- [Windows Defender Application Control (WDAC)](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control): In Windows 10, version 1903 WDAC has a number of new features that light up key scenarios and provide feature parity with AppLocker. - - [Multiple Policies](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies): WDAC now supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: 1) enforce and audit side-by-side, 2) simpler targeting for policies with different scope/intent, 3) expanding a policy using a new ‘supplemental’ policy. - - [Path-Based Rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules): The path condition identifies an app by its location in the file system of the computer or on the network instead of a signer or hash identifier. Additionally, WDAC has an option that allows admins to enforce at runtime that only code from paths that are not user-writeable is executed. When code tries to execute at runtime, the directory is scanned and files will be checked for write permissions for non-known admins. If a file is found to be user writeable, the executable is blocked from running unless it is authorized by something other than a path rule like a signer or hash rule.
                        - This brings WDAC to functionality parity with AppLocker in terms of support for file path rules. WDAC improves upon the security of policies based on file path rules with the availability of the user-writability permission checks at runtime time, which is a capability that is not available with AppLocker. - - [Allow COM Object Registration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy): Previously, WDAC enforced a built-in allow list for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy. - -#### System Guard - -[System Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) has added a new feature in this version of Windows called **SMM Firmware Measurement**. This feature is built on top of [System Guard Secure Launch](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection) to check that the System Management Mode (SMM) firmware on the device is operating in a healthy manner - specifically, OS memory and secrets are protected from SMM. There are currently no devices out there with compatible hardware, but they will be coming out in the next few months. - -This new feature is displayed under the Device Security page with the string “Your device exceeds the requirements for enhanced hardware security” if configured properly: - -![System Guard](images/system-guard.png "SMM Firmware Measurement") - -### Identity Protection - -- [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less login for websites supporting FIDO2 authentication, such as Microsoft account and Azure AD. -- [Streamlined Windows Hello PIN reset experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience): Microsoft account users have a revamped Windows Hello PIN reset experience with the same look and feel as signing in on the web. -- Sign-in with [Password-less](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience! -- [Remote Desktop with Biometrics](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#remote-desktop-with-biometrics): Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. - -### Security management - -- [Windows Defender Firewall now supports Windows Subsystem for Linux (WSL)](https://blogs.windows.com/windowsexperience/2018/04/19/announcing-windows-10-insider-preview-build-17650-for-skip-ahead/#II14f7VlSBcZ0Gs4.97): Lets you add rules for WSL process, just like for Windows processes. -- [Windows Security app](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center) improvements now include Protection history, including detailed and easier to understand information about threats and available actions, Controlled Folder Access blocks are now in the Protection history, Windows Defender Offline Scanning tool actions, and any pending recommendations. -- [Tamper Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection) lets you prevent others from tampering with important security features. - -## Microsoft Edge - -Several new features are coming in the next version of Edge. See the [news from Build 2019](https://blogs.windows.com/msedgedev/2019/05/06/edge-chromium-build-2019-pwa-ie-mode-devtools/#2QJF4u970WjQ2Sv7.97) for more information. - -## See Also - -[What's New in Windows Server, version 1903](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1903): New and updated features in Windows Server.
                        -[Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features.
                        -[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
                        -[What's new in Windows 10](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware.
                        -[What's new in Windows 10 for developers](https://blogs.windows.com/buildingapps/2019/04/18/start-developing-on-windows-10-may-2019-update-today/#2Lp8FUFQ3Jm8KVcq.97): New and updated features in Windows 10 that are of interest to developers. +--- +title: What's new in Windows 10, version 1903 +description: New and updated IT Pro content about new features in Windows 10, version 1903 (also known as the Windows 10 May 2019 Update). +keywords: ["What's new in Windows 10", "Windows 10", "May 2019 Update"] +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.localizationpriority: high +ms.topic: article +--- + +# What's new in Windows 10, version 1903 IT Pro content + +**Applies to** +- Windows 10, version 1903 + +This article lists new and updated features and content that are of interest to IT Pros for Windows 10 version 1903, also known as the Windows 10 May 2019 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 1809. + +>[!NOTE] +>New disk space requirement for Windows 10, version 1903 applies only to OEMs for the manufacture of new PCs. This new requirement does not apply to existing devices. PCs that don’t meet new device disk space requirements will continue to receive updates and the 1903 update will require about the same amount of free disk space as previous updates. For more information, see [Reserved storage](#reserved-storage). + +## Deployment + +### Windows Autopilot + +[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. The following Windows Autopilot features are available in Windows 10, version 1903 and later: + +- [Windows Autopilot for white glove deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/white-glove) is new in this version of Windows. "White glove" deployment enables partners or IT staff to pre-provision devices so they are fully configured and business ready for your users. +- The Intune [enrollment status page](https://docs.microsoft.com/intune/windows-enrollment-status) (ESP) now tracks Intune Management Extensions​. +- [Cortana voiceover](https://docs.microsoft.com/windows-hardware/customize/desktop/cortana-voice-support) and speech recognition during OOBE is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs. +- Windows Autopilot is self-updating during OOBE. Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE. +- Windows Autopilot will set the [diagnostics data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE. + +### Windows 10 Subscription Activation + +Windows 10 Education support has been added to Windows 10 Subscription Activation. + +With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to the enterprise-grade edition for educational institutions – Windows 10 Education. For more information, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation). + +### SetupDiag + +[SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag) version 1.4.1 is available. + +SetupDiag is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues. In the current version of SetupDiag there are 53 rules contained in the rules.xml file, which is extracted when SetupDiag is run. The rules.xml file will be updated as new versions of SetupDiag are made available. + +### Reserved storage + +[**Reserved storage**](https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Windows-10-and-reserved-storage/ba-p/428327): Reserved storage sets aside disk space to be used by updates, apps, temporary files, and system caches. It improves the day-to-day function of your PC by ensuring critical OS functions always have access to disk space. Reserved storage will be enabled automatically on new PCs with Windows 10, version 1903 pre-installed, and for clean installs. It will not be enabled when updating from a previous version of Windows 10. + +## Servicing + +- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Office 365 ProPlus updates, and Intune content, with System Center Configuration Manager content coming soon! +- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. +- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. +- **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. +- **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again. +- **Improved update notifications**: When there’s an update requiring you to restart your device, you’ll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar. +- **Intelligent active hours**: To further enhance active hours, users will now have the option to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. +- **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. + +## Security + +### Windows Information Protection + +With this release, Windows Defender ATP extends discovery and protection of sensitive information with [Auto Labeling](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels#how-wip-protects-automatically-classified-files). + +### Security configuration framework + +With this release of Windows 10, Microsoft is introducing a [new taxonomy for security configurations](https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework), called the **SECCON framework**, comprised of 5 device security configurations. + +### Security baseline for Windows 10 and Windows Server + +The draft release of the [security configuration baseline settings](https://blogs.technet.microsoft.com/secguide/2019/04/24/security-baseline-draft-for-windows-10-v1903-and-windows-server-v1903/) for Windows 10, version 1903 and for Windows Server version 1903 is available. + +### Intune security baselines + +[Intune Security Baselines](https://docs.microsoft.com/intune/security-baselines) (Preview): Now includes many settings supported by Intune that you can use to help secure and protect your users and devices. You can automatically set these settings to values recommended by security teams. + +### Microsoft Defender Advanced Threat Protection (ATP): + +- [Attack surface area reduction](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) – IT admins can configure devices with advanced web protection that enables them to define allow and deny lists for specific URL’s and IP addresses. +- [Next generation protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) – Controls have been extended to protection from ransomware, credential misuse, and attacks that are transmitted through removable storage. + - Integrity enforcement capabilities – Enable remote runtime attestation of Windows 10 platform. + - Tamper-proofing capabilities – Uses virtualization-based security to isolate critical ATP security capabilities away from the OS and attackers. +- [Platform support](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Protecting-Windows-Server-with-Windows-Defender-ATP/ba-p/267114) – In addition to Windows 10, Windows Defender ATP’s functionality has been extended to support Windows 7 and Windows 8.1 clients, as well as macOS, Linux, and Windows Server with both its Endpoint Detection (EDR) and Endpoint Protection Platform (EPP) capabilities. + +### Microsoft Defender ATP next-gen protection technologies: + +- **Advanced machine learning**: Improved with advanced machine learning and AI models that enable it to protect against apex attackers using innovative vulnerability exploit techniques, tools and malware. +- **Emergency outbreak protection**: Provides emergency outbreak protection which will automatically update devices with new intelligence when a new outbreak has been detected. +- **Certified ISO 27001 compliance**: Ensures that the cloud service has analyzed for threats, vulnerabilities and impacts, and that risk management and security controls are in place. +- **Geolocation support**: Support geolocation and sovereignty of sample data as well as configurable retention policies. + +### Threat Protection + +- [Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849): Isolated desktop environment where you can run untrusted software without the fear of lasting impact to your device. +- [Microphone privacy settings](https://support.microsoft.com/en-us/help/4468232/windows-10-camera-microphone-and-privacy-microsoft-privacy): A microphone icon appears in the notification area letting you see which apps are using your microphone. + +- [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) enhancements: + - Standalone users can install and configure their Windows Defender Application Guard settings without needing to change Registry key settings. Enterprise users can check their settings to see what their administrators have configured for their machines to better understand the behavior. + - WDAG is now an extension in Google Chrome and Mozilla Firefox. Many users are in a hybrid browser environment, and would like to extend WDAG’s browser isolation technology beyond Microsoft Edge. In the latest release, users can install the WDAG extension in their Chrome or Firefox browsers. This extension will redirect untrusted navigations to the WDAG Edge browser. There is also a companion app to enable this feature in the Microsoft Store. Users can quickly launch WDAG from their desktop using this app. This feature is also available in Windows 10, version 1803 or later with the latest updates. + + To try this extension: + 1. Configure WDAG policies on your device. + 2. Go to the Chrome Web Store or Firefox Add-ons and search for Application Guard. Install the extension. + 3. Follow any additional configuration steps on the extension setup page. + 4. Reboot the device. + 5. Navigate to an untrusted site in Chrome and Firefox. + + - WDAG allows dynamic navigation: Application Guard now allows users to navigate back to their default host browser from the WDAG Microsoft Edge. Previously, users browsing in WDAG Edge would see an error page when they try to go to a trusted site within the container browser. With this new feature, users will automatically be redirected to their host default browser when they enter or click on a trusted site in WDAG Edge. This feature is also available in Windows 10, version 1803 or later with the latest updates. + +- [Windows Defender Application Control (WDAC)](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control): In Windows 10, version 1903 WDAC has a number of new features that light up key scenarios and provide feature parity with AppLocker. + - [Multiple Policies](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies): WDAC now supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: 1) enforce and audit side-by-side, 2) simpler targeting for policies with different scope/intent, 3) expanding a policy using a new ‘supplemental’ policy. + - [Path-Based Rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules): The path condition identifies an app by its location in the file system of the computer or on the network instead of a signer or hash identifier. Additionally, WDAC has an option that allows admins to enforce at runtime that only code from paths that are not user-writeable is executed. When code tries to execute at runtime, the directory is scanned and files will be checked for write permissions for non-known admins. If a file is found to be user writeable, the executable is blocked from running unless it is authorized by something other than a path rule like a signer or hash rule.
                        + This brings WDAC to functionality parity with AppLocker in terms of support for file path rules. WDAC improves upon the security of policies based on file path rules with the availability of the user-writability permission checks at runtime time, which is a capability that is not available with AppLocker. + - [Allow COM Object Registration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy): Previously, WDAC enforced a built-in allow list for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy. + +#### System Guard + +[System Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) has added a new feature in this version of Windows called **SMM Firmware Measurement**. This feature is built on top of [System Guard Secure Launch](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection) to check that the System Management Mode (SMM) firmware on the device is operating in a healthy manner - specifically, OS memory and secrets are protected from SMM. There are currently no devices out there with compatible hardware, but they will be coming out in the next few months. + +This new feature is displayed under the Device Security page with the string “Your device exceeds the requirements for enhanced hardware security” if configured properly: + +![System Guard](images/system-guard.png "SMM Firmware Measurement") + +### Identity Protection + +- [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less login for websites supporting FIDO2 authentication, such as Microsoft account and Azure AD. +- [Streamlined Windows Hello PIN reset experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience): Microsoft account users have a revamped Windows Hello PIN reset experience with the same look and feel as signing in on the web. +- Sign-in with [Password-less](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience! +- [Remote Desktop with Biometrics](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features#remote-desktop-with-biometrics): Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. + +### Security management + +- [Windows Defender Firewall now supports Windows Subsystem for Linux (WSL)](https://blogs.windows.com/windowsexperience/2018/04/19/announcing-windows-10-insider-preview-build-17650-for-skip-ahead/#II14f7VlSBcZ0Gs4.97): Lets you add rules for WSL process, just like for Windows processes. +- [Windows Security app](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center) improvements now include Protection history, including detailed and easier to understand information about threats and available actions, Controlled Folder Access blocks are now in the Protection history, Windows Defender Offline Scanning tool actions, and any pending recommendations. +- [Tamper Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection) lets you prevent others from tampering with important security features. + +## Microsoft Edge + +Several new features are coming in the next version of Edge. See the [news from Build 2019](https://blogs.windows.com/msedgedev/2019/05/06/edge-chromium-build-2019-pwa-ie-mode-devtools/#2QJF4u970WjQ2Sv7.97) for more information. + +## See Also + +[What's New in Windows Server, version 1903](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1903): New and updated features in Windows Server.
                        +[Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features.
                        +[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
                        +[What's new in Windows 10](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware.
                        +[What's new in Windows 10 for developers](https://blogs.windows.com/buildingapps/2019/04/18/start-developing-on-windows-10-may-2019-update-today/#2Lp8FUFQ3Jm8KVcq.97): New and updated features in Windows 10 that are of interest to developers.